On October 29, 2021, the Colombian President sanctioned the expected Law 2157 of 2021, or the "Clean Slate" law (Ley de Borrón y Cuenta Nueva), which modifies the Statutory Law 1266 of 2008 regarding the habeas data rights of Colombian citizens. The main purpose of this law is to modify the provisions related to the reporting of negative information in credit databases, as well as their retention period in these data banks.
Specifically, the law introduces the following changes:
- Positive information will remain in the credit databases for an indefinite period of time. However, information of a negative nature will be governed by a retention period equivalent to twice the time for which the obligation was in default, with a maximum term of 4 years from the date on which the overdue installments are paid, or the obligation is extinguished. In any case, any negative data must be eliminated after 8 years from the time the obligation was in default.
- In the event that the obligation in default is equal to or less than 15% of 1 minimum legal monthly salary, it may only be reported after the creditor has sent 2 communications to the debtor, both on different days and the last one at least 20 calendar days prior to the report. Penalties are established in case of failure to comply with this notification obligation.
- Negative information may be reported up to 18 months after the obligation has become overdue.
- Entities supervised by the Superintendence of Finance may not deny a loan based solely on the applicant's negative information report. If the credit application is denied, the entity must send the applicant a written communication stating the objective reasons for such denial.
- The temporary limitation to the consultation of information free of charge is eliminated. Meaning that the new law established that such consultation shall be free of charge on any occasion, as well as that the continuous consultation by the data holder may not affect his/her credit rating.
- The requests of data holders related to cases of identity theft must be answered within a maximum period of 10 working days.
- All requests and/or claims of the data holders must be resolved within a maximum period of 15 working days following their receipt, extendable for an additional 8 days if necessary. However, in case this period has passed, and no response has been given to the data holder, the silence will be understood as that the request and/or petition was accepted.
- Data Controllers must report, at least once a month, any news and/or updates regarding the data that it being processed.
- The Principle of Accountability is introduced, under which operators, sources and users of databases must implement appropriate, effective and verifiable measures to comply with the Law. In the same sense, the obligation to implement effective Internal Policies to comply with this Principle is included.
- A transition regime is created that allows data holders to be removed from the credit databases under the following conditions:
- The holders of the information that extinguish their obligations within the 12 months following the entry into force of the law, will remain with such negative information in the databases for a maximum term of 6 months counted from the date of extinguishment of such obligations;
- The owners of the information, who upon the entry into force of the law had extinguished their obligations subject to report, and whose negative information has remained in the databases for at least 6 months, shall be beneficiaries of the immediate expiration of the negative information;
- The holders that extinguish their obligations, and whose negative information has not remained in the databases for at least 6 months, after the extinguishment of the obligations, will remain with such negative information for the time needed to fulfill the 6 months period;
- In the event that the obligations are in default for less than 6 months, the negative information will remain for the same period of default, counted from the extinction of the obligations.
- Those obligations that are subject to negative reporting, originated during the beginning of the pandemic and until December 31, 2020, will not be reported in the databases in this same period, provided that the holders of the obligation have approached their respective financial entities, seeking a restructuring of the obligation.
- Negative information of (i) small agricultural producers, (ii) victims of the armed conflict, (iii) rural youth and women who have agricultural loans with FINAGRO, (iv) students and co-debtors who have debts with ICETEX, (v) persons classified as MSMEs, tourism sector, or small agricultural producers and (vi) natural persons who develop commercial or independent activities, who have paid their debts within 12 months following the entry into force of the law, will be immediately eliminated from the credit databases.
The full law is available here.