Desafíos Jurídicos en la Protección de la Seguridad y Privacidad de los Usuarios de Servicios Fintech en Colombia: hacia un Fortalecimiento Normativo

Abstract

Financial technology has revolutionized the global financial landscape, becoming integrated into everyday life through services such as mobile banking and instant payments. The emergence of digital banks, peer-to-peer lending platforms, and blockchain solutions has democratized access to financial services, offering efficient alternatives to conventional banking systems. Small and medium-sized enterprises (SMEs) have been the primary beneficiaries of this digital transformation, accessing personalized services through online banks, crowdfunding, and P2P platforms. However, this new financial ecosystem presents regulatory challenges that require balancing innovation with effective oversight, as fintech companies continue to expand and reshape the international financial landscape (Cumming et al., 2023).

In Colombia, the fintech sector has experienced exponential growth in recent years, radically transforming how citizens access financial services. According to data from Colombia Fintech (2024b), the industry association, as of July 2024, the country had 369 companies, 269 of which were classified across nine verticals, with digital credit and digital payments representing 65% of them. This growth has brought with it a series of regulatory and legal challenges, particularly regarding the protection of user rights.

The academic literature has addressed the regulatory challenges to the security and privacy of Fintech users from different perspectives. In international cases, Prayuti (2024) highlighted the need to strengthen regulatory frameworks to protect consumers from fraud and data breaches. While not delving into aspects of civil liability for security and privacy violations, he identified weaknesses such as a lack of specificity in regulations, inconsistent oversight, and gaps in the protection of personal data. Similarly, Bongomin & Ntayi (2020) identified challenges applicable to the Colombian context, such as a lack of transparency, insufficient cybersecurity, and operational and technical risks in mobile financial services, emphasizing general aspects of consumer protection such as complaint and compensation mechanisms.

In Colombia, Pertuz (2021) analyzed the regulatory sandbox as a supervisory mechanism, emphasizing its limitations in protecting users, while Arias & Lis (2024) addressed the regulatory challenges of the fintech sector in Colombia more generally, including cybersecurity and data protection aspects. Guzmán (2024) addressed issues such as data security and abusive practices related to consumer protection through supervisory institutions.

For their part, the research by González (2024) and Anaya (2020) established the need to strengthen financial consumer protection in the face of new digital channels in Colombia. The first study emphasized the development of optimization principles and mandates for resolving contractual disputes, while the second delved into the civil liability of financial institutions in cases of electronic fraud, highlighting that banks must bear the burden of proof and demonstrate that they acted with due diligence in cases of security breaches.

The studies by Gutiérrez & Moreno (2023) and Albarracín (2023) converge in identifying that fintech regulation in Colombia, although based on Article 335 of the Constitution and complemented by regulations on data protection (Law 1581 of 2012) and cybercrimes (Law 1273 of 2009), presents substantial limitations. Their main findings highlight the existence of a partial regulatory framework focused on protecting the public interest and managing cybersecurity risks and fraud prevention.

These research trends coincide in the absence of comprehensive legislation specifically for fintech, particularly regarding civil liability for violations of user security and privacy. This research confirms findings in this direction, but delves deeper into the possibilities for regulatory strengthening, considering the emergence of new technologies and their legal implications, the civil liability of fintech companies in cases of violations of user security and privacy, and recommendations based on successful fintech regulation experiences.

While general regulations apply, the lack of a specialized legal framework creates uncertainty regarding the scope and effectiveness of protecting users' rights on these digital financial platforms. Therefore, when lawsuits are filed for contractual and extra-contractual civil liability due to data protection and security breaches, legal uncertainty arises because of the difficulty of resolving these cases through a judge.

In this context, the need arises to analyze how the Colombian legal framework can evolve to effectively protect the rights of fintech service users without hindering the innovation that is transforming the country's financial landscape. This analysis must consider not only existing and proposed legislation, but also international best practices and the specific characteristics of the Colombian market. Thus, this monograph answers the following research question: What are the main legal challenges to protecting the security and privacy of fintech service users, considering the current regulatory framework, the impact of emerging technologies, and international regulatory experiences? The overall objective of this monograph is to analyze the legal challenges in protecting the security and privacy of fintech service users in Colombia, considering the current regulatory framework, emerging technologies, and international experiences, in order to strengthen the existing regulations. This entails four specific objectives, each addressed in the chapters of this work: 1) To identify the gaps and limitations of the current Colombian legal framework regarding the protection of fintech service users; 2) To examine the legal implications of the use of emerging technologies by fintech companies in protecting the data and privacy of fintech users; 3) To evaluate the existing legal mechanisms for determining the civil liability of fintech companies in the event of security incidents; 4) To propose improvements to the Colombian regulatory framework based on an analysis of international experiences in the protection of fintech users.

Methodologically, this research adopts a qualitative, documentary approach, based on the systematic review and analysis of primary sources (current regulations, jurisprudence, and official documents from regulatory entities) and secondary sources (specialized academic literature, technical reports, and comparative analyses). The information processing will follow three phases: a descriptive phase to identify the elements of the current regulatory framework, an analytical phase to critically examine the legal implications and effectiveness of existing regulations, and a propositional phase to develop recommendations that strengthen the protection of fintech users' rights in Colombia.