New ¿Where Is My Data? Report: Five Years of Holding ISPs Accountable in Colombia

Five years have passed since Colombian digital rights NGO Fundación Karisma launched its first annual ¿Dónde Están Mis Datos? assessing telecommunication companies’ commitment to transparency and user privacy. Since then, we’ve seen major telecom companies providing more transparency about how and when they divulge their users’ data to the government. This project is part of a region-wide initiative akin to EFF’s Who Has Your Back? by Latin American and Spanish NGOs. So far, nine countries have joined this project kicked off in 2015 with Karisma’s first report.

When Karisma started the reports in 2015, none of the ISPs published any transparency report or any aggregate data about the number of data requests they received from governments. Five years later, the country’s main ISPs, such as Telefónica-Movistar and Claro, periodically disclose government transparency reports. This is a big win for transparency and users’ rights. Companies' privacy policies have also shown progress over the years, with more useful information being better provided to users on data retention, collection, and processing.

This year’s fifth edition featured six ISPs. Telefónica-Movistar shows the best rating, followed by Millicom-Tigo and Claro. Telefónica-Movistar and Claro improved their scores from the previous edition, with notable improvements in providing information about content blocking. The former also stands out in digital security. Poorly rated in this category in 2018, Telefónica-Movistar is the only company to earn the full score this year. Millicom-Tigo, however, disappointed for not publishing an updated transparency report with specific data from Colombia. ETB and DirecTV show an intermediate position, rating slightly less than the last edition, while EMCALI remains behind.

Throughout the annual editions of this report, the public-private shares company ETB has led significant shifts, showing openness to change and to uphold users’ rights. However, this year’s edition shows the ISP has to double down on its commitments if it wants to catch up with the two best-ranked companies.

An Outline of the 2019 Edition of ¿Where Is My Data?

The new report evaluates the same companies of the previous one with the exception of Telebucaramanga, a local ISP acquired by Telefónica-Movistar in 2018. It has also toughened some of the assessment criteria. For example, regarding transparency reports, companies should not only publish them periodically, but also include more detailed information on government data and content blocking requests. New parameters in the privacy category also require ISPs' policies to provide greater detail about personal data collection, processing, and retention obligations and practices. Moreover, ISPs’ internal procedures to hand over users’ data to investigation authorities should contain human rights safeguards in addition to being publicly available.

The report’s main findings are below. The full study with a detailed evaluation for each company is available in Spanish.

Each ISP was assessed in the following four categories: political commitments, privacy, freedom of expression, and digital security.

In the political commitment category, the report assesses, among other things, if the ISPs publish transparency reports with detailed information about government data and content blocking demands. In this category, Telefónica-Movistar and Claro meet all the parameters. ETB is right behind, but still doesn’t provide clear and detailed information about traffic and subscriber data, communications interception, and content blocking requests. Millicom-Tigo, DirecTV, and EMCALI fall short in this category, receiving the lowest score.

AT&T, Di