All external sources cited across the program — incidents, mandates, research findings, best practices, and legal frameworks for Colombia, USA, and Spain.
| Jurisdiction | Law / Regulation | Relevance |
|---|---|---|
| 🇨🇴 Colombia | Ley 1581/2012 | Ley de Protección de Datos Personales — informed consent, data minimization, purpose limitation for all personal data processing |
| 🇨🇴 Colombia | Decreto 1377/2013 | Implements Ley 1581 — schools must maintain a Política de Tratamiento de Datos and register databases with the SIC |
| 🇨🇴 Colombia | Ley 1098/2006 | Código de la Infancia y la Adolescencia — special protections for minors' data and digital rights |
| 🇨🇴 Colombia | Ley 1273/2009 | Protección de la información y los datos — criminal liability for data crimes including unauthorized access and data theft |
| 🇨🇴 Colombia | Directiva Externa 002/2024 (SIC) | Specific SIC guidance on processing personal data in AI systems — applies to AI tools in educational institutions |
| 🇺🇸 USA | FERPA (20 U.S.C. § 1232g) | Family Educational Rights and Privacy Act — prohibits disclosure of education records; AI vendors must qualify as "school officials" |
| 🇺🇸 USA | COPPA (16 CFR Part 312) | Children's Online Privacy Protection Act — verifiable parental consent required for children under 13; school exception for educational tools |
| 🇺🇸 USA | CIPA | Children's Internet Protection Act — internet filtering and Internet Safety Policy required for E-rate recipients |
| 🇺🇸 USA | SOPIPA (CA) & State Laws | Student Online Personal Information Protection Act (CA) and analogous state laws — prohibit commercialization of student data |
| 🇪🇸 Spain / EU | GDPR / RGPD (EU 2016/679) | General Data Protection Regulation — lawful basis for all AI data processing; special rules for minors (Arts. 6, 7, 8) |
| 🇪🇸 Spain / EU | LOPDGDD (LO 3/2018) Art. 7.2 | Spain's national GDPR implementation — digital consent age set at 14 (below GDPR default of 16) |
| 🇪🇸 Spain / EU | EU AI Act (EU 2024/1689) | First comprehensive AI regulation — AI used for student assessment, emotion recognition, or behavioral monitoring classified as high-risk. Full application August 2026. |
Legal citations are for reference only. Final legal ratification and compliance assessment must be performed by school legal counsel or designated authority for each jurisdiction.