Law 1581 of 2012 speaks of the general regulatory provisions for the protection of personal data, therefore, the horizontal property regime, when seen as a legal person before the Superintendence of Industry and Commerce (SIC), is obliged to comply with this law. and the respective regulations that complement it.

The Superintendence of Industry and Commerce imposed a fine on the Carrera Séptima Horizontal Property building, for a value of $78.124.200, since it was not complying with the personal data collection regulations imposed by Law 1581 of 2012. According to Semana Magazine, several irregularities were found among them, the building did not have a data processing policy for people who entered the building, collected personal data such as photo images and video surveillance recordings without their authorization, and did not inform the visitors to the building about their rights, purposes and other requirements of article 12 of law 1581.

It is necessary to emphasize that the administrator of the horizontal property is the main responsible for the "Data Processing" and therefore the custody and its protection, without neglecting that the collaborators and third parties who have access to this information are also responsible. such as the people who make up the board of directors, the statutory auditor, the coexistence committee and the contractors in question, among others. For this reason, it is important for the administrator to identify the types of data, give it the appropriate treatment and take the respective measures with each of its collaborators and contractors.  

At Logity we have selected some important tips to take into account when implementing the data processing policy in the building or complex that you manage, in order to avoid having bad times or surprising situations and even worse when it comes to a visit from inspection by the SIC with the corresponding sanctions.

1. When you begin to implement the personal data policy, keep in mind Decree 1074 of the year 2015,  Where a series of specific provisions are established on how the personal data policy is drawn up. In a didactic way, the Superintendency of Industry and Commerce has taken care through its web page to implement resources such as tutorial videos of some norms that are printed about keeping a guide so that the different co-owners comply with these regulations. You find it here: https://www.sic.gov.co/videos-tutorial-rnbd.

2. Inform the owner and request the express authorization of data handling. It is the responsibility of the administrator to communicate to the owner of the data, in our case the co-owners, residents and even visitors and households, about the handling of the data to be processed and also request their express authorization depending on the type of data. Keep in mind that data processing means any activity that is carried out with personal information, for example: collecting, storing, consulting, updating, sharing it with third parties, and/or deleting it. All this in accordance with the purposes that the horizontal property decides.

We recommend that you place a clear, express and visible notice or billboard at each entrance to the building, intended for any person, whether residents, co-owners, visitors or householders, who access or walk through the building and who are monitored by the CCTV or of whom it is required to collect personal data for the access control system or even to fill out a simple log written by the surveillance personnel.

In these notices or billboards you must determine, among other information, the purpose of the collection of personal data, for example, to guarantee the safety of the people who live in the building or to monitor the route of the visitor or home, etc. and based on this build the Data Processing policy.

If you need to collect information for a purpose other than the security issue, for example, email, telephone or cell phone, you must also determine the use, function or purpose that you will give to that data and again establish the Data Treatment policy. necessary.

Remember that all kinds of personal or sensitive data information that we collect or capture requires a "Data Processing" policy that not only extends to the issue of video surveillance cameras and access control systems, but also goes beyond to issues such as the same assemblies of co-owners, whether face-to-face or virtual.

3. Keep a copy of the authorization as evidence before any claim.Apart from requesting the express authorization of the owner of the data, you must keep a copy of it, such as a written format, a copy of the email where you requested the information, the web form, etc., which you must keep as evidence that that co-owner or resident authorized you to use data in accordance with the purpose that you previously stated.

4. Establish mechanisms for Attention to User Requirements and attend to them in a clear and timely manner. In your notices, billboards or requests for information or data collection, establish communication channels such as web forms, mailboxes, email or telephone lines for receiving requirements and requests from users of personal data, such as consultation, update, rectification, correction, deletion or any request, complaint or claim.

5. Build an inventory of the different databases you are managing. In this part, identify the types of databases and the category of data they contain, whether they are private, semi-private, public or sensitive, in order to have the exact knowledge of what, and how much data you are needing, for the development of the different activities in the co-ownership and take the pertinent measures in each case.

6. Trains all the collaborative staff of the horizontal property of the building. It is important that everyone knows the correct use of personal data processing to avoid violating the fundamental rights of the owner of the data, whether owner, resident, visitor or domiciliary, and to make clear the importance of the message and the use of these data to issues purely of security and development of co-ownership.

7. Take advantage of the free courses offered by the Superintendency of Industry and Commerce, such as tutorial training and others. Remember to save the reports of each training so that you can demonstrate the management of this issue before any investigation or inspection imposed on the co-ownership.

8. Lean on some process automation and data management tool. Remember the importance of technological implementation for your management and data processing, this in order to guarantee an optimal and effective response to any type of request or claim by the owners or before the different control entities that supervise this guild, like the SIC.

In conclusion, the horizontal property must comply with the provision against the Habeas Data law provided for in Law 1581 of the year 2012 and its decrees 1377 of the year 2013 and 1074 of the year 2015. For this reason, one of the fundamental advantages that characterizes our Logity's intelligent video door phone product, unlike any other system, is that the resident user or owner does not have to provide their personal data. Our system assigns a unique and particular QR code for each home.

The process of collecting income data from people outside the complex, such as visitors and homes, is carried out roughly like any private or state building, but always within the spirit and proper interpretation of Law 1581 of 2012. Logity stores said information for a period up to three months.

Finally, the management of the information compiled for the module of the web admin, exclusive use tool for the administrator, it is automatically encrypted and fragmented by the Logity system. Therefore, the collection and storage carried out by the building administrators in compliance with the internal policies of the complex or building in terms of Data Processing is optional.

We were born to help you, so follow these tips, download the template and you will have a proper handling of the Habeas Data law for the benefit of your property.

Please share this information of interest with your colleagues and friends.