Are My Personal Data in the Credit Bureaus?

#### By: Dr. Luz Eneida Saldaña, Attorney (Universidad del Rosario), specialist in Administrative Law and Financial Law


Discover your company's risk of a penalty for violating Habeas Data rules by clicking here and filling out our test!

Datacrédito? CIFIN? TransUnion? COVINOC? Many Colombians fear these names, yet they are only operators, credit bureaus (Centrales de Riesgo) to which our information, both positive and negative, is reported, serving as a source for third parties who want to know our risk profile when contracting with us. It is important not only to manage our credit profile properly but also to know our rights and duties as users.

If you have been reported to a credit bureau and need help, Contact us by clicking here

Many people are not clear on how these entities handle their data or that they have the right to request updating or correction of their information. In this article we explain how to proceed in these cases.

Updating or correcting information reported to a credit bureau

If you believe the published data is inaccurate, incomplete, outdated, or unverifiable, you may go to the source (that is, the entity that makes the report to the credit bureau) or directly to the credit bureau, explaining why you believe it should be corrected, updated, or deleted.

If you believe the response to your claim is not sufficient, or if it is not answered within the legal deadlines, you may go to the Personal Data Protection Delegation of the Superintendency of Industry and Commerce so that your claim is processed.

How can your personal data be reported to or consulted with credit bureaus?

The entity reporting personal information must obtain, before the report, authorization from the person to be reported, failing which the information must be deleted immediately. That is, the authorization must be given before the report, freely and expressly, without pressure, and there must be a record of it. Of course, this does not prevent reporting again once compliance with the legal requirements is shown.

Now, financial information such as credit history is one thing, and a negative report for default or non-payment is another; even so, in both cases prior, express, and verifiable authorization is required. Before negative information is reported to a credit bureau, the source must send you a communication so that you can prove or make payment of the obligation or dispute it. Only when twenty (20) calendar days have passed since the communication was sent may the source make the report to the credit bureau.

If the source did not send you the prior communication, the information must be deleted immediately, without prejudice to reporting again once that requirement is met.

Who can consult your credit information?

The data subject, the persons they have authorized, and their successors. Also users of the information (financial institutions, telecommunications companies, and credit entities) when you apply for products or services and, of course, judicial authorities under a court order, executive-branch public entities in the performance of their duties, oversight bodies and disciplinary, fiscal, or administrative investigators, and other data operators (when the data subject has given authorization).

To whom can you complain about improper reports so that data in credit bureaus is corrected, updated, or deleted?

In the first instance, through a petition-claim (derecho de petición), to the credit bureau or to the source (the person, entity, or organization that reports the information to the operator). They have a maximum period of fifteen (15) business days to answer your claim.

If they do not respond within that period or the response is unsatisfactory, you may go to the Superintendency of Industry and Commerce in the case of non-financial entities; but if the entity is supervised by the Financial Superintendency of Colombia, you must bring your claim directly before that entity.

To bring the claim, you must show that you filed a prior claim with the operator or the source and that it was not resolved within the legal period or was unfavorable or unsatisfactory. To that end, you must provide a copy of the claim with proof of filing, a copy of the response if there was one, or a statement that it was not answered on time or was answered unfavorably, stating the grounds for your dissatisfaction.

Additionally, you may submit inquiries to the information operators to find out what information is held in the data banks. Since these are information requests, they must be answered within ten (10) business days of receipt.

After a negative report and payment of the debt, how long does the negative information stay in the credit bureau?

The report stays in the databases for twice the length of the delinquency, counted from the extinguishment of the obligation by any means. For example, if you were in default for 6 months, the negative information will remain for 12 more months, counted from the moment the debt is paid. If the delinquency lasted more than 24 months, the negative report will remain for 48 months, or 4 years.

When these retention periods are not respected, whether because the source did not report the payment of the obligation on time or because the operator did not remove the negative report within the set period, you may assert your Habeas Data right before the respective Superintendency by filing a properly supported claim.

At Consejurídico #WeWantToBeThere

El asistente jurídico digital de Jurídiconline analiza tu situación específica. La revisión inicial es gratuita.