The Superintendence of Industry and Commerce (SIC) imposed a COP 214 million fine (equivalent to USD°51.750 approximately) on a well-known e-commerce platform for requiring sensitive data from its users.
The administrative investigation was launched in 2023 by the SIC’s Data Protection and Investigation Division, following a complaint from a user who stated that, despite having other identity verification methods available -such as phone and email-, the platform forced him to register his face and later refused to delete the biometric data collected.
The Division concluded that the platform was violating the prohibition on requesting sensitive personal data by conditioning the provision of its services on the supply of biometric data. Furthermore, the platform infringed the user’s right to habeas data by refusing to delete their biometric information from its databases.
In addition to the fine for breaching the provisions of Law No. 1582 of 2012, the Division ordered the e-commerce platform to eliminate any biometric data requirements on its mobile app and website, and to offer multiple authentication options.
Link to the SIC’s resolution: https://www.sic.gov.co/sites/default/files/2025016582RE0000000001.pdf.
