Members of EFF and Fundación Karisma during the launch of the project.

EFF has joined forces with digital rights groups in Colombia, Mexico, Brazil, Paraguay, and Peru to provide support to each country in releasing its own (or similar) “Where is My Data?” report—a report akin to EFF’s Who Has Your Back?, which has, since 2011, incentivized companies to adopt best practices, be transparent about how data flows to the government, and to take a stand for their users’ privacy.

Fundación Karisma, a leading digital rights organization in the region, released the first Latin American report on May 20, which featured Colombia. The report assesses whether Internet service providers (ISPs) in the country are willing to publicly commit to defending their customers against government demands for user data.

After more than eight months of requesting and researching the privacy policies and terms of use for the five most important ISPs in Colombia, the results of the Colombian "Where is My Data?" report indicate that the ISPs have vague and unclear policies on privacy protection and lack transparency about the role they play in delivering personal information to the Colombian government.

The assessed ISPs, which included Claro, Movistar/Telefonica, ETB, Une, and DirecTV, make up 91% of Internet users according to a report by the Ministry of Information and Communication Technologies in Colombia. This year, DirecTV was the only ISP that received a full star for publishing its data protection policy in a clear and accessible manner.

Unfortunately, the results of the "Where is My Data?" report show that this is the exception to the rule. Current privacy policies are hard to find on the official websites of the ISPs; when located, they are ambiguous and often contain exaggerated provisions, for example, the retention of personal data even after a contract ends.

The report also revealed that the ISPs lack company transparency reports, which are used to evaluate if (and how often) companies transfer data to the government when requested to do so. Transparency reports offer customers information about the scope and extent of government data requests in the context of surveillance.

The goal of "Where is My Data?" is much like EFF’s annual Who Has Your Back? report— to promote competition between companies by creating a "race to the top of the mountain" that defends the privacy of its users whenever possible do so.

EFF was in Bogota for the release of the project where International Rights Director, Katitza Rodríguez spoke saying, "The project is designed to encourage ISPs to adopt best practices in the management of our data, that ISPs issue transparency reports about how our information flows to the government, and encourage them to take sides to protect the privacy of their users whenever possible.”

Although companies are not legally required to publish transparency reports, "publishing these documents is a good practice and shows that companies care about their customers," said Carolina Botero, executive director of Fundación Karisma and co-author of the report.

Transparency is essential in any country, particularly in the context of surveillance activities. Transparency is vital for accountability, upholding fundamental rights, and defending democratic values. But the Colombian legal framework, in some concrete cases, grants excessive surveillance powers to the government by compelling ISPs to retain metadata of innocent Colombians for a period of five years—the longest term that exists in the world.

At the same time, the press echoed the concerns raised by the report (see here, here, here and here), as did independent journalists, Internet users, academics, and community activists involved through social networks and blog posts.

Colombians have a right to know how the government is using surveillance technologies  and what personal information of theirs is being accessed. We hope that Colombian ISPs start to publish transparency reports, defend their users’ data against overreaching government requests, and that future "Where is My Data?" reports reflect these positive changes.

The Mexican report will be launched on 16 June 2015. Brazil, Paraguay, and Peru plan to be released in the coming months.