On September, 2011 the “LAW FOR PROTECTION OF PEOPLE FOR THE HANDLING OF THEIR PERSONAL INFORMATION” came into force. The objective of this Law is to protect people’s personal information, regardless of their nationality, residency status or the address they possess.

This Law also created “The Agency For Data Protection Of the People” (PRODHAB), which has the main role of communicating what is stipulated under this Law, spreading knowledge of the populations rights regarding the treatment, storage, transferring and use of their personal data.

Collecting personal data via a public or private register, is a common practice that can result in abuse and violation of fundamental rights regarding the privacy of costa rican citizens. A perfect example of this are the tedious phone calls regarding payments, selling of credit services, etc.

It is important to clarify that the tendency of having this information does not mean the transgression of the Law itself, because in order for that to happen, whoever (usually an entity) is handling this data needs to incur in one of the typified conducts that are signaled in articles 29, 30, and 31 of the present Law, in which if the entity does indeed violate the Law, they can constitute a mild, serious, or very serious infraction respectively. Some of this infractions are:

▪ Collecting personal information without widely informing the interested person, and transmitting this information using unsafe mechanisms.
▪ Storing personal information or data without consent.
▪ Unjustifiably refusing to delete or correct someone’s personal information.
▪ Revealing registered information in a database which is under a secret that must be kept by Law.

The complaints for illicit management of private information must be presented before “PRODHAB”, which must then resolve under the period of one month (starting once the complaint is accepted), and whoever is accused is exposed to the penalties Article 28 of the Law, which are:

A. For mild infractions, a fine up to five base salaries of a Judicial Assistant I, according to the Budget Law of the Republic.
B. For serious infractions, a fine ranging from five to twenty base salaries of a Judicial Assistant I, according to the Budget Law of the Republic.
C. For very serious infractions, a fine ranging from fifteen to thirty base salaries of a Judicial Assistant I, according to the Budget Law of the Republic, and the suspension of the functioning of the file from one to six months.

Databases rightfully subscribed can be found on PRODHAB’s online site , which are regulated by the Protection of Personal Data current legislation.

PRODHAB’S web page also contains several types of forms that include: Appointment Setting Form, Database Inscription and Requisites Form, Form to File a Complaint: Form to Exercise the Right of Access to Personal Data: and also with the list of requirements, the Form to Exercise the Right of Rectification and/or Suspension of Personal Data, and the frequently asked questions section.

if someone wishes to request any personal information (to an entity that owns a database), or the due rectification of their personal information, they must download the respective form on the web page, and present it to whoever is responsible for handling the database, and must hand in the respective information required in a timelapse of a maximum of five business days, and in case of unjustifiably denial, one can file the complaint before PRODHAB.

The Law 8968 is very wide, in which case if you consider any of your rights to be vulnerated, you can contact us at info@erplawyers.com, where we will gladly help you with the legal advice needed.