In December 2016, an amendment to the Regulation of the Law on the Protection of the Person from the Treatment of Personal Data was published in the Official Gazette, whose objective is to improve the protection of information and the rights of the person against use. improper use of your personal data.

This law applies to personal information stored in automated or manual databases of either public or private organizations or companies.

Amendments to the Regulation of the Law for the Protection of Personal Data

The amendments to the Regulation of the Law for the Protection of Personal Data seek to better specify the application of Law No. 8968 regarding internal databases, data transfers, outsourcing of the service provider or technology intermediary and financial entities.

Among the most important modifications to the regulation are:

• Any file, record or other structured set of restricted or unrestricted personal data, maintained by a person, is considered as a personal or domestic database, as long as the database or their contents are not commercialized, distributed or diffused.
• Any file, record or other structured set of restricted or unrestricted personal data, maintained by public or private corporations, is considered as an internal database, as long as the database or their contents are not commercialized, distributed or diffused.
• The preservation of personal data that may affect its owner should not exceed 10 years from the ending date of the object for using the data, unless a special disposition that establishes it.
• The transfer (of data) will always require the unequivocal consent of the holder. The transfer implies the cession of personal data only and exclusively by the person who transfers to the recipient of the personal data.
• El consent to give access to the information can now also be granted using a digital media, which expedites many procedures.
• Article 3 was modified, establishing that the databases of financial entities subject to regulation by the Superintendence of Financial Entities (Sugef in Spanish) do not need to register before the Data Protection Agency. Of course, the agency will maintain control of the Data Protection Act (No. 8968) and may exercise the actions allowed by law regarding the databases.
• The “super user” figured in database management was suppressed.

If you want to verify other legal concepts related to the Protection of Personal information, or improve the way you handle the personal data of your workers, contact ERP Lawyers & Associates, Costa Rica’s most recognized boutique law firm.