Case Summary and Outcome

The Constitutional Court of Colombia held that the National Protection Unit (Unidad Nacional de Protección, or UNP) violated Claudia Duque’s right to habeas data by not delivering information that had been collected through a GPS installed in a bulletproof vehicle it provided for her security, and by refusing to delete her personal data from their records. Duque, a journalist, and human rights defender, benefited from protective measures ordered by both the Constitutional Court and the Inter-American Commission on Human Rights due to the harassment she suffered. However, she claimed that the armored car the UNP gave her had a GPS that tracked her movements without her consent and put her in danger since the information was used to illegally spy on her. She asked for the removal of the GPS and requested all the information that had been collected on her and its subsequent destruction. The UNP claimed that the GPS was part of the protective measures, refused to delete Duque’s information from its databases, and delivered the collected data partially. Considering her rights had been violated, Duque filed a tutela action. On appeal, the Court considered that the UNP did not violate Duque’s rights by installing a GPS in the bulletproof car, although it ruled that there had been a violation of the right to habeas data, which entails the right to know which personal information is being stored in public databases, to authorize the content’s processing, deletion, or the possibility of adding additional information. The Court ordered the UNP to deliver the requested information in full and to destroy the data that was not strictly necessary to guarantee Duque’s protection, or to comply with the unit’s transparency and accountability obligations.

---

Facts

Claudia Julieta Duque Orrego is a Colombian journalist, and human rights defender, who has suffered harassment and persecution from Colombian authorities, specifically from the now-extinct Administrative Department of Security (Departamento Administrativo de Seguridad, or DAS). The Constitutional Court of Colombia and the Inter-American Commission on Human Rights had both ordered protective measures to ensure her security. Since 2008, the protection was limited to the provision of bulletproof vehicles, delivered by the National Protection Unit (Unidad Nacional de Protección, or UNP), an organism that inherited some of the tasks and personnel from the DAS.

On March 5, 2020, Duque filed a criminal complaint before the Attorney General’s Office after being informed by four different sources that a criminal action against her was being planned, based on data collected from the GPS installed in the armored cars she used. Duque claimed that she was not aware that her bulletproof vehicles were being monitored and held that she never gave her consent for that.

On August 10, 2021, Duque requested from the National Protection Unit: (i) a copy of all the reports about her movements and the information obtained from the tracking of all the vehicles that the UNP had assigned to her; (ii) a copy of the informed consent that she had supposedly signed to authorize the monitoring; (iii) the names of the persons within the UNP in charge of carrying out the monitoring, and (iv) the information of the persons or entities with whom the collected data had been shared, and a copy of such distributed data. She also requested the information be destroyed in her presence, after it was delivered to her.

On September 29, 2021, the National Protection Unit partially responded to the request. It only provided data regarding one of the vehicles, during the period between February and August 2021. The UNP refused to destroy any documents or data.

On November 16, 2021, Duque insisted on her request and demanded the GPS be removed from her assigned car or that she be assigned an unmonitored vehicle. On December 23, 2021, the National Protection Unit refused to remove the GPS arguing that it was part of the protective measures.

On February 22, 2022, Duque returned her assigned bulletproof vehicle and claimed that she had never authorized the tracking device, which was illegally and arbitrarily tracking her movements, thus invading her privacy. She also filed an acción de tutela (or amparo action) to protect her rights to intimacy, habeas data, freedom of expression, human dignity, and security. In her claim, she requested the UNP provide her with a new armored car with no GPS and to deliver the previously requested information in full.

On March 7, 2022, the 19^th Criminal Court of Bogotá rejected the claim because it considered that the UNP had provided adequate protective measures. The court also held that the information collected through the GPS was classified and did not include personal data. Duque appealed arguing that the information included personal data, and insisted that she never consented to the collection of that information.

On April 21, 2022, the Superior Tribunal of Bogotá upheld the first instance court’s decision. It considered too that the GPS was part of the protective measures and that, by accepting these measures, Duque had consented to the conditions established by the UNP, which may include proportional restrictions to her right to privacy. Duque appealed this decision.

On September 13, 2022, the Constitutional Court of Colombia admitted the case. On December 9, 2022, Duque informed that she had requested the UNP to reinstate the protective measures because she was being threatened and harassed. However, Duque explained that the UNP only offered her a new armored car with GPS or security agents. She rejected both options because she considered that the information collected by the GPS and the UNP personnel would be used to illegally spy on her.

---

Decision Overview

Jorge Enrique Ibáñez Najar delivered the opinion for the Constitutional Court of Colombia. The main issue before the Court was whether the National Protection Unit violated Duque’s fundamental rights by i) assigning her an armored vehicle with a GPS, ii) refusing to deliver to her the data collected by such systems, and iii) imposing limitations on the access and destruction of such data.

The petitioner claimed that the installation of a GPS in her bulletproof vehicle, and the subsequent refusal to remove it, was a mechanism of control and espionage against her. She argued that the same people who were in charge of her protection put her in danger and lied about the true motivations for monitoring her vehicle. Furthermore, she said she recognized the names of public officers at the National Protection Unit who had previously worked for the Administrative Department of Security, the public entity accused of harassing her in the first place.

Additionally, Duque claimed that journalists—to properly conduct their work—required a reinforced degree of privacy so they can carry out their investigations, protect their sources, and gather necessary information. She warned that such activities are restricted when the movements of a person are being monitored. Lastly, she argued that she did not receive the information she requested from the UNP and that she had the right to ask for its destruction. Thus, she considered that her rights to intimacy, habeas data, freedom of expression, security, and human dignity were violated.

For its part, the National Protection Unit said that it monitored every vehicle it provided (i) to ensure that the people who receive protection comply with their responsibilities, and (ii) to have a better ability to react in cases where the protected person is at risk. It also claimed that it was not possible to destroy the data requested by Duque because such files dealt with human rights, historical memory, and armed conflict issues. Finally, it held that the collected information did not include Duque’s personal data. Consequently, the UNP held that it did not violate Duque’s rights.

At the outset of its analysis, the Court explained that the right to habeas data entails the right to know which personal information is being stored in private or public databases, and to authorize the processing of the content, its deletion, or the possibility of adding information. In other words, the right to habeas data allows every person to control their information, and to know how it is being used. The Court also held that, in principle, every person should explicitly consent to the processing of their personal data and be informed about its purposes.

Regarding the protection of journalists and the right to freedom of expression, the Court recalled its own jurisprudence (judgments T-1037/2008 and T-199/2019) to argue that “threats to the security of journalists are generally linked to intimidations in light of their work, which is why, in addition to affecting their peace of mind and personal integrity, they unduly affect their rights to freedom of expression and information.” [para. 132] Considering this, the Court held that the government, in these cases, has a reinforced obligation to prevent these risks and afford protection. Furthermore, it considered that protective measures must “take into account the needs of the communicator’s profession” and “be carried out under a gender perspective, which must consider both the particular forms of violence suffered by women and the specific ways in which protective measures, that may be necessary or appropriate for women journalists, are implemented.” [para. 133]

The Court also held that the protection of journalists cannot be limited to the adoption of measures after a threat has materialized. Rather, it should also include preventive measures and policies to fight impunity. Additionally, the Court highlighted that protective measures should avoid collateral restrictions and be compatible with the rights to intimacy, to gather information, and to protect sources’ confidentiality, which are crucial for the work of every journalist. The journalist’s personal profile, their context, and the type of information they usually publish, the Court said, are some of the factors to be considered when assessing risks, and offering appropriate protective measures.

Regarding the security and intelligence activities deployed on journalists—and the protection of their personal data—the Court clarified that the UNP focused only on the design, implementation, and execution of protective measures, in favor of persons who are at an extraordinary or extreme risk of harm. For the Court, this entailed “a substantial difference in its objectives with the former DAS, which in addition to providing protection services, was also in charge of intelligence and counterintelligence tasks.” [para. 153] Thus, the Court considered that the collection of data carried out by the UNP could be justified if it fosters “the proper development of its legal purpose: the design and implementation of protective measures in favor of persons at extraordinary or extreme risk.” [para. 156] Otherwise, the Court held that “any other form of processing or circulation of personal data—such as […] using it to carry out intelligence work— is openly contrary to the legal order.” [para. 156] While the Court acknowledged that the UNP could share information with other State authorities, it held that any data transfer should be confidential and strictly related to the fulfillment of the protective measures.

In the present case, the Court ruled, firstly, that the UNP did not violate Duque’s rights by offering her an armored vehicle equipped with a GPS. In its opinion, the monitoring system was, indeed, part of the protective measures, and was a proportional restriction of Duque’s rights to intimacy and work. According to the Tribunal, it would be almost impossible to protect someone who could not be potentially localized.

While the Court recognized that the UNP collected personal data (since the location could be associated with a specific individual) and that this would generally require explicit consent, it concluded that this rule had an exception under Law 1581/2012—when the information is needed by a public authority to exercise its legal duties. In the Court’s opinion, the data collection carried out by the UNP, in this case, was necessary to exercise its mandate to protect Duque, so no consent was required from her. Furthermore, the Court found no clear evidence that the information was being used to illegally spy on Duque. Nevertheless, it ordered the competent authorities to conduct a proper investigation of her claims, especially considering the risks she faced. The Court also said that the UNP had an obligation to keep Duque’s data classified.

Regarding Duque’s work as a journalist, the Court considered that even if the GPS could potentially affect it and jeopardize the protection of her sources, the UNP’s monitoring was essential to the fulfillment of a constitutionally legitimate aim (to protect Duque’s life and personal integrity). For the Court, there were no alternative measures that could similarly guarantee Duque’s security. Hence, it considered that the installation of a GPS was strictly proportional—especially when taking into account that Duque previously rejected other complementary protective measures. Lastly, the Court stated that Duque failed to prove any specific violations of her rights to exercise journalism or to protect her sources that stemmed from the collection of information.

Regarding the right to habeas data, the Court found that the UNP violated Duque’s rights by storing the information for longer than needed to adequately comply with its duties. The Court explained that every person has the right to request the deletion of personal information from a database as long as there are no legal obligations imposing a duty to keep it. Here, the Tribunal referred to Law 594/2000, which regulates public archives and orders the storing of certain files that could be useful for government oversight, and for the sake of transparency and accountability. In the words of the Constitutional Court, “archives are an indispensable tool for the administrative, economic, political and cultural management of the State.” [para. 208]

Hence, the Court ruled that Duque’s right to request the elimination of her personal data should partially prevail. Thus, it ordered the UNP to keep only the information that would be necessary for the unit’s oversight and auditing. The Court further noted that the UNP should inform Duque which data it will keep, and why it cannot delete it. Consequently, the Court said that all the information that is no longer relevant to protect Duque should be regularly destroyed. Finally, the Court also found that the UNP violated Duque’s right to habeas data by not adequately stating which data it had collected from her. Thus, it ordered the UNP to properly deliver the requested information.

---