Colombia - AI Facial Recognition Pilot

Overview

The Bogotá TransMilenio AI Facial Recognition Pilot was a public safety trial program launched on October 1, 2023, by the Bogotá Metropolitan Police in partnership with TransMilenio S.A. The program deployed 786 biometric cameras integrated with AI facial recognition across 20 rapid transit stations to detect wanted individuals by comparing live footage against a database of over 5,000 active judicial warrants. The trial period concluded at the end of December 2023.

Definitions

While the pilot program itself does not explicitly define terms in a formal legal text, key concepts are understood in the context of Colombian data protection law:

• Facial Recognition: A technology capable of identifying or verifying a person from a digital image or a video frame by analyzing and comparing patterns based on the person's facial features. This constitutes the processing of biometric data.
• Biometric Data: As defined under Statutory Law 1581 of 2012, biometric data falls under the category of 'sensitive data' due to its unique and immutable nature, capable of identifying an individual. This includes fingerprints, facial recognition, and DNA, requiring special protection and strict conditions for processing.
• Personal Data: Any information linked or linkable to one or several determined or determinable natural persons.
• Data Controller (Responsable del Tratamiento): The natural or legal person, public or private, who decides on the database and/or the processing of the data. In the context of this pilot, the Bogotá Metropolitan Police and TransMilenio would act as data controllers.
• Data Processor (Encargado del Tratamiento): The natural or legal person, public or private, who by itself or in association with others, performs the processing of personal data on behalf of the Data Controller.
• Proof of Concept (POC): A realization of a certain method or idea to demonstrate its feasibility, or a demonstration in principle, usually small and/or incomplete. In this case, a short-term, limited deployment to test the facial recognition system's effectiveness.

Governance and Institutional Framework

The Bogotá TransMilenio AI Facial Recognition Pilot was a collaborative effort primarily led by the Bogotá Metropolitan Police, specifically the Commander of Mass Transportation Service, Lieutenant Colonel Jader Llerena. TransMilenio, the city's bus rapid transit system, served as the operational environment for the deployment of the biometric cameras and the integration of the facial recognition software. The initiative was framed within the 'Operación Bogotá' program, indicating broader governmental support for security enhancements in the capital. The technology provider for a specific 30-day proof of concept within this pilot was Corsight AI, with NewSat acting as a specialist integrator. Oversight for data protection compliance in Colombia falls under the Superintendence of Industry and Commerce (SIC), which serves as the national data protection authority.

Key Focus Areas

• Public Safety and Crime Prevention: The paramount goal of the pilot was to enhance security in the TransMilenio system, a critical public space, by deterring criminal activity and facilitating the apprehension of individuals with active arrest warrants.
• Biometric Identification: The core technological focus was the use of AI-powered facial recognition to identify individuals in real-time by comparing their facial biometrics against a database of wanted persons.
• AI in Surveillance: The pilot represented a significant application of artificial intelligence in public surveillance, utilizing algorithms to process video data for identification purposes.
• Data Matching Against Criminal Databases: A key operational aspect involved linking the facial recognition system to existing databases maintained by law enforcement agencies containing records of over 5,000 individuals with judicial requirements.
• Operational Effectiveness: The pilot aimed to assess the practical effectiveness of facial recognition technology in a dynamic urban transit environment for law enforcement purposes.

Implementation Framework

The pilot commenced on October 1, 2023, and was publicly announced by the Bogotá government on October 19, 2023. It involved the deployment of 786 biometric cameras strategically positioned across 20 stations within the TransMilenio network. These cameras were integrated with advanced facial recognition software designed to analyze facial features in real-time. The system's functionality involved capturing images, processing facial data, and instantaneously cross-referencing it with a database of over 5,000 individuals who had active court orders or judicial requirements in Bogotá. Upon a successful match, an alert would be generated and transmitted to police officers in the vicinity, enabling immediate intervention and apprehension. The pilot was planned to run until December 2023, allowing for a comprehensive evaluation of its performance and identification of areas for improvement before considering broader or permanent deployment. A specific 30-day Proof of Concept (POC) using Corsight AI technology with 20 cameras was also conducted as part of this broader initiative.

Monitoring and Evaluation

The pilot program's effectiveness was monitored through its operational results, specifically the number of successful identifications and subsequent apprehensions of wanted individuals. Within the first two weeks of the pilot's launch, the system led to the capture of six individuals: one suspected of homicide and five for theft, as reported by the Bogotá Metropolitan Police. These initial results were considered a significant indicator of the technology's potential to enhance public safety. The pilot was scheduled to conclude in December 2023, at which point a more comprehensive evaluation of its performance, accuracy, and impact on crime rates and public perception of security was expected to be undertaken. The evaluation would also likely consider technical performance, false positive rates, and compliance with data protection principles, although specific metrics for these were not detailed in the official announcement of the pilot. The intent was to identify flaws and improvements for definitive implementation.

Penalties, Liability, and Appeals

As a pilot program, specific penalties or liability frameworks directly stemming from the pilot's operational guidelines are not defined. However, any processing of personal data, especially sensitive biometric data, within the pilot's scope is subject to Colombia's comprehensive data protection regime, primarily Statutory Law 1581 of 2012. Non-compliance with this law can lead to significant sanctions. The Superintendence of Industry and Commerce (SIC) has the authority to impose fines up to 2,000 times the minimum monthly wage (approximately COP 2 billion or ~$500,000 USD), order temporary or permanent suspension of data processing activities, and even initiate criminal liability procedures for unauthorized disclosure of sensitive data. Data subjects have the right to lodge complaints with the SIC and to seek judicial redress for violations of their data protection rights. Recent SIC rulings have emphasized that mandatory biometric data collection without explicit consent and alternative options is a violation of fundamental rights, even in private residential contexts, underscoring the strict interpretation of Law 1581 regarding sensitive data.

Relationship to Other Instruments

The Bogotá TransMilenio AI Facial Recognition Pilot operates within the broader legal framework of Colombia, particularly concerning fundamental rights and data protection:

• Colombian Constitution: Articles 15 and 20 explicitly recognize the fundamental rights to privacy and to know, update, and rectify information collected about oneself (habeas data). Any facial recognition system must respect these constitutional guarantees.
• Statutory Law 1581 of 2012 (Ley de Protección de Datos Personales): This is the primary legal instrument governing personal data processing in Colombia. It establishes general provisions for data protection, defines sensitive data (including biometric data), and sets out obligations for data controllers and processors, as well as rights for data subjects. The law requires prior, express, and informed consent for processing sensitive data, with limited exceptions.
• Decree 1377 of 2013: This decree partially regulates Law 1581, detailing aspects such as the requirements for obtaining data subject consent, policies for data processing, and data transfers.
• Circulars from the Superintendence of Industry and Commerce (SIC): The SIC issues circulars and rulings that provide interpretation and guidance on data protection obligations, particularly concerning sensitive data like biometrics. Recent rulings by the SIC have emphasized the need for explicit consent and alternative authentication methods when using facial recognition.
• Law 1273 of 2009: This law added provisions to the Colombian Penal Code regarding the protection of information and data, establishing criminal penalties for unauthorized data access or misuse.

International Alignment

Colombia's data protection framework, particularly Law 1581 of 2012, shares many principles with international standards for privacy and data protection, such as those found in the European Union's General Data Protection Regulation (GDPR), albeit with a more streamlined approach. The emphasis on explicit consent for sensitive data, data subject rights (access, rectification, deletion), and accountability for data controllers aligns with global best practices. However, specific regulations for the use of biometric data in public spaces for surveillance purposes are still evolving in many jurisdictions, including Latin America. The SIC's active enforcement regarding biometric data highlights an alignment with the principle that such data requires heightened protection, consistent with international human rights standards concerning privacy and the right to freedom from unwarranted surveillance.

Implementation Timeline

2012-10-17: Enactment of Statutory Law 1581 of 2012, Colombia's primary data protection law.
2023-10-01: Bogotá TransMilenio AI Facial Recognition Pilot officially begins operation.
2023-10-19: Official announcement by the Bogotá Mayor's Office detailing the pilot.
2023-11-02: Reports detail successful 30-day proof-of-concept phase.
2023-12-31: Conclusion of the scheduled pilot testing period.

Sources and References