This English translation is provided for general information and has not been legally verified. Consult the Spanish original for legal interpretation. The article reflects its original publication date, not subsequent changes in the law.
The SIC’s fine against Mercado Libre over biometric data
The SIC fined Mercado Libre for requiring fingerprints and facial recognition when they were unnecessary. The decision addresses the limits of biometric data processing in Colombia.
The SIC fined Mercado Libre for requesting users’ biometric data
The Superintendence of Industry and Commerce (SIC) imposed a fine of approximately COP 214 million on Mercado Libre Colombia LTDA. for breaching the personal data protection regime. The decision followed a finding by the authority’s Personal Data Protection Investigations Directorate that the company required biometric information, specifically facial recognition, as a condition for users to access their accounts.
The SIC found that Mercado Libre not only collected this sensitive data without express legal authorisation but also refused to delete it from its databases, disregarding users’ habeas data rights. Consequently, the Superintendence ordered the company to remove any requirement to provide biometric data to create or access an account, and to offer authentication alternatives that respect users’ privacy.
In its decision, the SIC reiterated that processing sensitive personal data, such as biometric data, is prohibited except in cases expressly authorised by law. It also reminded companies that they must ensure the data collected is limited to what is necessary to provide the service, and that users must be properly informed about processing purposes and their rights over their personal information.