Draft bill 193.

Summary.

The draft bill amends the title of Law 83 of 2012 to expressly cover the use of electronic and digital means in government and private transactions. It also replaces Article 3 with definitions of identity verification, tokenization, and encryption. Identity verification is framed as a process for authenticating a person without intruding on the privacy of their personal data. Tokenization replaces sensitive data with nonsensitive equivalents, while encryption uses mathematical algorithms to protect information and limit access to authorized persons.

The proposed Article 7-A would require all private companies and public institutions to implement identity verification mechanisms meeting security and privacy standards similar to those of the National Institute of Standards and Technology (Instituto Nacional de Estándares y Tecnología) and the Federal Information Processing Standard (FIPS). The text identifies NIST SP 800-63 for digital identity, FIPS 140-2 for cryptographic security, and FIPS 201-2 for personal identity verification. It also calls for avoiding the use and storage of sensitive biometric data and for using tokenization and encryption to protect personal data during verification.

Under the proposed Article 7-B, the Electoral Tribunal (Tribunal Electoral), in coordination with the National Authority for Government Innovation (Autoridad Nacional para la Innovación Gubernamental) and the National Authority for Transparency and Access to Information (Autoridad Nacional de Transparencia y Acceso a la Información), would oversee and certify the verification mechanisms implemented by entities. This oversight would address compliance with security and privacy standards. To validate identities, entities would have to enter into contracts or agreements with the Electoral Tribunal, as well as information use and confidentiality agreements.

The proposed Article 7-C would give citizens access to a record of all identity verification requests made by public and private entities. It would also give them access to a user portal provided by the entities concerned, through which they could view and manage those requests and exercise control over their data.

The amendment to Article 9 would assign the Electoral Tribunal and the National Authority for Government Innovation responsibility for defining technical documentation standards for identity verification, while addressing communications security and protection of transmitted data. The amendment to Article 14 would require public entities to use information technology in their dealings with other entities and users through a secure digital identity verification platform meeting standards similar to NIST and FIPS. The draft bill provides for the law to take effect on the day following its promulgation.

The provisions concern the Electoral Tribunal, the National Authority for Government Innovation, and the National Authority for Transparency and Access to Information. They would affect public institutions, private companies that verify identities, and citizens whose data are used in those processes.