Draft bill 53.

Summary.

The draft bill would add paragraph 5 to Article 6 of Law 81 of March 26, 2019. The new ground would permit the processing of mobile terminal identification data, including the IMEI number and equivalent technical identifiers defined under applicable telecommunications rules, along with associated geolocation data generated by telecommunications networks. Processing would require a reasoned order from a competent guarantee judge, issued in a criminal investigation formally opened by the Public Prosecutor’s Office (Ministerio Público) under the Criminal Procedure Code (Código Procesal Penal) into suspected robbery, theft, or receipt of stolen mobile devices. The order would have to identify the device or line, distinguish real time location data from historical data, and specify the territorial and technical scope and authorized duration of the measure.

Proposed Article 6-A would make that processing subject to legality, purpose limitation, proportionality, necessity, and data minimization. Only data strictly necessary for the criminal investigation could be collected, and the data could not be used for purposes other than those underlying the judicial authorization. Mass, indiscriminate, or untargeted collection would be prohibited unless strictly necessary to carry out judicially authorized investigative steps and duly justified by necessity, proportionality, and a specific purpose. Proposed Article 6-B would limit the supply of data to thirty (30) calendar days, with one extension for the same period by a duly reasoned judicial decision. The judge would have to verify that the grounds of necessity and proportionality continue to apply before granting the extension. Special time limits established in other laws for special investigative techniques would continue to apply.

Proposed Article 6-C would require competent authorities to ensure the integrity, confidentiality, and traceability of the data obtained. Once the purpose of the authorization has been fulfilled, the data would have to be deleted, erased, or de-identified so that the data subject cannot be identified, in accordance with Law 81 of March 26, 2019 and its implementing regulations, unless retention as evidence in the criminal proceedings is required. Proposed Article 6-D would attach administrative, civil, and criminal liability to improper use, unauthorized access, or processing contrary to that law. It would also assign the National Authority for Transparency and Access to Information (Autoridad Nacional de Transparencia y Acceso a la Información) oversight of telecommunications operators’ and other controllers’ duties concerning personal data protection, security, retention, and confidentiality, without interfering with the direction of the criminal investigation or the powers of the Public Prosecutor’s Office and the courts.

Article 6 identifies the additions to Law 81 of March 26, 2019, and Article 7 provides that the law would take effect upon promulgation. The provisions concern the Public Prosecutor’s Office, guarantee judges, the courts, and the National Authority for Transparency and Access to Information. They could also affect telecommunications operators, other data controllers, and mobile device owners whose data fall within an authorized measure.