Mercado Libre fined for requiring facial recognition in Colombia
Colombia's industry regulator fined Mercado Libre 214.4 million Colombian pesos for making facial recognition a mandatory requirement to access user accounts, violating data protection laws that prohibit conditioning service access on biometric data submission. The regulator ordered the company to delete collected biometric data and offer multiple authentication options.
What happened
Mercado Libre conditioned access to user accounts on the submission of facial recognition data, making biometric authentication a mandatory requirement for account access.
Reported impact
The company violated users' right to habeas data by refusing to delete biometric data from user databases. Users were unable to access the platform without providing facial recognition data.
Index analysis
Colombian data protection law prohibits the processing of sensitive personal data, including biometric data, without express authorization from the data subject. The law does not permit conditioning access to services on the provision of biometric data except where specific legal rules exist and respect the principle of proportionality.
Governance controls
The SIC ordered Mercado Libre to eliminate any procedure that conditions account access or creation on the submission of biometric data. The company was ordered to offer multiple authentication mechanism options to users on its mobile application and website.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.