Colombian ISPs Show Steady Commitments to User Privacy But Key Transparency Gaps Remain

Colombia’s top internet and cell phone companies continued to maintain a high level of transparency about their privacy practices, and continued to implement best practices to protect customer data, free expression, and security in 2021. But they faced challenges from the impacts of COVID-19 and pressure to inform users about government spying on mobile phone communications, according to a new report released today by Fundacion Karisma, Colombia’s leading digital rights organization.

¿Dónde están mis datos?" (“Where Is My Data?”) evaluated seven leading internet and cell phone companies: Claro (América Móvil), Movistar (Telefónica), Tigo (Millicom), ETB, DirecTv, Emcali,  and Avantel. Karisma also included satellite internet companies Hughesnet and Skynet for their role in connecting rural areas.

Today’s report is Karisma’s seventh annual ¿Dónde Estan Mis Datos? for Colombia—an assessment of telecommunication companies’ commitment to transparency and user privacy. As in prior years, Karisma looked at whether companies’ transparency reports provide detailed information about government requests for user data and content blocking, how strong their data protection policies are, and whether they adequately disclose content blocking practices and data breaches.

In these categories, Colombia’s internet and cell phone companies were steady, mostly meeting, or exceeding, levels achieved in the last few years. Movistar was the overall top performer, with 15 out of a possible 16 points, followed by Tigo with 13 points, and Claro and Avantel, each with 10 points. ETB scored 8 points, DirectTV earned 7 points, Hughesnet and Emcali each earned 5 points, while Skynet earned 3.

In new evaluation categories added to assess companies’ policies regarding net neutrality and government interception of communications, the results were mixed.

The COVID-19 pandemic put significant pressure on internet and telecommunications providers, as their network infrastructures were tested by higher traffic from remote work. Also, government demands for data to track and contain the virus tested their commitment to user privacy. What’s more, the Colombian government and the country’s Communications Regulatory Commission decided through emergency regulations to prepare the ground in case it was necessary to suspend net neutrality—a key tenet t of an open internet.

Under net neutrality, internet service providers treat all data that travels over their networks fairly, without improper discrimination in favor of particular apps, sites, or services. While the suspension of net neutrality did not occur, Karisma for the first time added new categories in ¿Dónde Estan Mis Datos? to evaluate companies’ disclosure of their net neutrality practices.

Movistar, Tigo, Avantel and Hughesnet were the standouts in these categories, each earning points for publishing their traffic management practices and publicly committing to protect net neutrality.

Karisma also added new categories to document a highly controversial and constitutionally questionable surveillance practice that has come to light. After analyzing the last few ¿Dónde Estan Mis Datos? reports, Karisma has concluded that Colombian authorities are intercepting users’ mobile phone communications, directly accessing communications without making formal requests or involving telecommunications companies hosting the networks. 

Little is known about how this deeply problematic surveillance practice occurs. To provide users with information and shed light on this troubling practice, ¿Dónde Estan Mis Datos? will, starting with today’s report, evaluate whether companies are clearly disclosing that direct access occurs. 

Main Results

Each company is evaluated in the following categories:

Political commitments: This category looks at whether companies have internal gender equality rules and accessibility policies for users with disabilities, and if they publish annual transparency reports (or the equivalent) for Colombia. New criteria added this year includes whether companies disclosed content blocking requests justified by a national health emergency, and if they have publicly committed to net neutrality.

Movistar continues to lead in the category; it fully reports on all expected criteria and in a disaggregated manner, including blocking events related to states of emergency or other exceptions.

Claro reports on the occurrence of each event, the legal framework in which each order is justified, and the authorities that raise them before the company. But when it comes to providing disaggregated statistics, it only does so