Question 1

Why is communications monitoring a valid antitrust compliance tool in Colombia?

Accepted Answer

The Superintendencia de Industria y Comercio (SIC) has published compliance guidelines that explicitly include "internal monitoring and auditing" as a component of an effective compliance program. The SIC holds a dual role: it is simultaneously the antitrust authority promoting cartel detection and the data protection authority supervising personal information processing.

Question 2

What conduct does vario detect and why is it illegal under the SIC?

Accepted Answer

vario detects strategic information exchange, price fixing, bid manipulation, and market-sharing agreements — all per se illegal under Law 155 of 1958 and CAN Decision 608. The SIC has active enforcement in public procurement, pharmaceutical markets, and transportation.

Question 3

Does antitrust compliance reduce sanctions in Colombia?

Accepted Answer

Yes. The SIC's compliance guidelines recognize compliance as a mitigating factor. Additionally, Law 1778/2019 (Anti-Corruption) establishes compliance programs for companies contracting with the state — vario directly contributes to that requirement by detecting conduct that could constitute corruption in public procurement.

Question 4

What advantage does the SIC's dual role offer to companies deploying vario?

Accepted Answer

Since the same authority regulates both antitrust compliance and data protection, companies that implement vario following SIC guidelines are well positioned on both regulatory dimensions. A well-documented compliance program reduces regulatory risk on the two fronts the SIC supervises simultaneously.

Question 5

Is it legal for an employer to monitor corporate email in Colombia?

Accepted Answer

Yes, if it passes the constitutional proportionality test. The Constitutional Court (T-574/2017) establishes three criteria: suitability (the measure achieves the objective), necessity (no less intrusive alternative exists), and strict proportionality (compliance benefits outweigh the privacy impact). Antitrust compliance meets all three criteria when monitoring is automated and purpose-limited.

Question 6

Does corporate email have the same protection as personal email?

Accepted Answer

No, though the distinction in Colombia is less clear-cut than in Brazil or Mexico. Institutional email carries a reduced privacy expectation when a clear monitoring policy exists. However, access to the content of communications classified as "private" — even in corporate accounts — may require a court order under T-574/2017. vario processes signals, not complete message content.

Question 7

What conditions must a company meet to deploy vario in Colombia?

Accepted Answer

Law 1581/2012 requires prior, express, and informed consent from employees — a stricter standard than Chile or Brazil. The monitoring policy must be included in the Internal Work Regulation, approved by the Ministry of Labor. A privacy notice compliant with Decree 1074/2015 is also required, along with a recommended documented Privacy Impact Assessment (PIA).

Question 8

Which data protection authority applies in Colombia?

Accepted Answer

The Superintendencia de Industria y Comercio (SIC), in its role as national data protection authority under Law 1581/2012. The SIC can investigate complaints, impose administrative fines, and suspend processing activities. vario acts as a data processor under the client's instructions as data controller, and provides consent and PIA templates adapted to Colombia.

Question 9

Can monitoring constitute workplace harassment in Colombia?

Accepted Answer

Only if it is persecutory, selective, or aimed at intimidating the employee (Law 1010/2006). vario does not constitute harassment by design: processing is automated and impersonal — it detects signals by content, not by individual. The essential distinction is between compliance monitoring (legitimate purpose) and surveillance directed at controlling or pressuring a specific person.

Colombia

Antitrust