Colombia: passenger data record

Data protection law and the SIC

Ley Estatutaria 1581 de 2012 was sanctioned on 17 October 2012 and published in Diario Oficial 48.587 on 18 October 2012 ¹. The Constitutional Court reviewed the bill in judgment C-748 of 2011 ¹.

Article 5 lists biometric data as sensitive data ¹. Article 2 excludes databases whose purpose is national security and defence, and intelligence and counterintelligence databases ¹. Article 19 gives supervision to the Superintendencia de Industria y Comercio through a Delegatura para la Protección de Datos Personales ¹.

Fines can reach 2,000 monthly legal minimum wages and can be repeated as long as the breach continues (article 23) ¹. Article 26 bars transfers to countries without adequate protection, with exceptions such as the data subject's express authorisation ¹.

Advance Passenger Information rules

Resolución 3167 of 25 October 2019, published in Diario Oficial 51.158 on 5 December 2019, sets entry, stay and exit rules ². Articles 44 to 46 require aircraft operators, air transport providers and private aircraft owners flying into or out of Colombia to send API in the UN/EDIFACT PAXLST format ².

Regular operators send three messages: 12 hours before scheduled departure, 2 hours before and at flight closure (article 49) ². Non-regular operators send one message between 12 and 2 hours before departure ². Name, document number, date of birth and nationality carry priority accuracy (articles 47 and 48) ². Non-compliance may lead to administrative action under Decree 1067 of 2015 (article 51) ².

Data in Migración Colombia databases is reserved and may be used only for legal and mission purposes (article 34) ². Sharing with other agencies must respect fundamental rights (article 54) ². The texts we opened set no retention period and do not mention PNR ^2,3.

The compiled text notes that Resolución 2772 of 2026 amended a permit table in article 14 ³. An earlier rule, Resolución 0367 of 7 April 2015, required two API transmissions, the first 60 minutes before departure ⁴. Resolución 3167 of 2019 repealed it ⁴.

Check-Mig pre-registration

Resolución 2682 of 5 November 2020 required travellers to complete the Check-Mig form before boarding, during the COVID-19 reopening of air travel ⁷. It barred airlines from boarding passengers who had not completed it ⁷.

Migración Colombia's current Check-Mig page describes it as a free, online service of non-mandatory use ⁵. Travellers can submit data up to 72 hours before travel, or up to one hour before ⁵. It collects flight details, biographic data, contact details, lodging in Colombia, reason for travel and health status ⁵. The page cites no legal basis ⁵.

Biomig biometric gates

Article 41 of Resolución 3167 of 2019 adopts Biomig, with enrolment, data processing, biometric authentication and migration corridors ². Biomig authentication is linked to API to check judicial and administrative records in advance ².

Migración Colombia's Biomig page says the regular service is free, open to Colombians over 12 and based on iris recognition ⁶. Enrolment captures fingerprints and face ⁶. Adult foreign nationals may use it only to leave the country ⁶. It lists El Dorado, José María Córdova, Rafael Núñez, Alfonso Bonilla Aragón, Ernesto Cortissoz and Matecaña airports and the Rumichaca land post ⁶.

Biomig VIP uses face and fingerprint and is valid for two years ⁶. The same page gives two fees: COP 381,000 in its overview and COP 421,000 under Resolución 0559 of 2026 ⁶. It cites Law 1581 of 2012 and the holder's express permission as the basis for processing ⁶.

Contracts and official findings

We found no published contract, supplier, hosting arrangement or funding terms for the API system, Check-Mig or Biomig in the records we opened ^2,6. We found no SIC order, Contraloría finding or court ruling on these systems in those records ¹.

Chronology