Superintendencia de Industria y Comercio

• Within a period of 4 months, Facebook will have to implement useful measures, improve security and, in addition, will have to certify them.
• The order given is of a preventive nature.
• Other countries in the world such as Ireland, the United States, Great Britain, France, the Netherlands, Canada, Australia and New Zealand have also adopted this type of actions.

The Superintendence of Industry and Commerce (SIC) ordered Facebook to adopt new measures and improve existing ones to guarantee the security of the personal data of more than 31 million Colombian users of the social network, the decision was taken through resolution number 1321 of January 24 of 2019.

The order stated that the measures must be appropriate, useful, effective and demonstrable to comply the requirements of the principle and duty of security of Colombian regulation, according to which Facebook must guarantee the security of the personal data, by avoiding the following:

•  Unauthorized or fraudulent access
• Unauthorized or fraudulent use
• Unauthorized or fraudulent consultation
• Unauthorized or fraudulent adulteration
• Unauthorized or fraudulent loss

Facebook must comply with the order within a period of four (4) months, to demonstrate that has improved its security measures the social network will have to present a certification issued by an independent, impartial, professional and specialized entity in matters of information of security. Whoever issues the certificate will be selected by Facebook, but it must be a third party whose management is free of any conflict of interest that diminishes independence and alien to any type of subordination with respect to Facebook.

The SIC recalled that Facebook is the digital social network with the largest number of users in the world and in the Republic of Colombia. Indeed, Facebook has approximately 2.410 million users around the world of almost 4.130 million Internet users. In other

words, Facebook collects, uses and circulates personal data from no less than 58% of people with Internet access.

As for Colombia, the number of Facebook users is 31 million people, that is, 68% of Colombians. Therefore, Facebook has the enormous responsibility of guaranteeing the security of the information of all its users, forcing it to be extremely diligent in this task and not to save efforts to respond for the security of the data of millions of people.

The order given is PREVENTIVE to avoid affecting the security of the data of Colombians. It was adopted because of the events, investigations and actions of data protection authorities of eight countries of the world (Ireland, the United States, Great Britain, France, the Netherlands, Canada, Australia and New Zealand) and the legal actions initiated by the Attorney General of the District of Columbia (United States) whose objective is that Facebook: (i) assume responsibility for the security flaws and the exposure of the personal information of its users and, (ii) develop new protocols that effectively protect the data of its users to ensure that an event such as the one that occurred does not happen again.

Finally, and in the framework of the International Day of Personal Data, the SIC recalled that the protection of personal data is a constitutional and fundamental right in the Republic of Colombia. Security measures that do not comply with the aforementioned characteristics or that fail to meet the aforementioned objectives endanger some human rights and turn the processing of personal data into activities that are inconsistent with the constitutional and legal mandates.