Page 1

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________

LAW OF PROTECTION OF THE PERSON AGAINST THE
TREATMENT OF YOUR PERSONAL DATA
Law No. 8968

Published in La Gaceta No. 170 of September 05, 2011
_________________________________________________

THE LEGISLATIVE ASSEMBLY OF THE REPUBLIC OF COSTA RICA
DECREE:

PROTECTION OF THE PERSON AGAINST THE TREATMENT OF THEIR
PERSONAL INFORMATION

CHAPTER I
GENERAL DISPOSITION
UNIQUE SECTION

ARTICLE 1.- Objective and purpose
This law is of public order and its objective is to guarantee to any
person, regardless of their nationality, residence or domicile, the
respect for their fundamental rights, specifically, their right to
informative self-determination in relation to your life or private activity and
other personality rights, as well as the defense of their freedom and
equality with respect to automated or manual data processing
corresponding to your person or property.

ARTICLE 2.- Scope of application
_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

1

Page 2

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
This law will be applicable to personal data that appear in databases
automated or manual data, from public or private organizations, and
any modality of subsequent use of this data.
The personal data protection regime established
this law will not apply to databases maintained by
natural or legal persons for exclusively internal, personal or
domestic, as long as these are not sold or any other
commercialized way.

ARTICLE 3.- Definitions
For the purposes of this law, the following is defined:
a) Database: any file, file, record or other set
structured personal data, which are subject to treatment or
processing, automated or manual, whatever the modality
of its elaboration, organization or access.
b) Personal data: any data related to a natural person
identified or identifiable.
c) Personal data with unrestricted access: the contents in databases
public data of general access, according to special laws and
compliance with the purpose for which these data were collected.
d) Personal data with restricted access: those that, even forming part
of public access records, they are not unrestricted because they are of
interest only for its holder or for the Public Administration.
e) Sensitive data: information related to the intimate jurisdiction of the person,
such as those that reveal racial origin, political opinions,
religious or spiritual convictions, socioeconomic status,
biomedical or genetic information, life and sexual orientation, among others.
f) Duty of confidentiality: obligation of those responsible for databases
data, staff under their charge and the staff of the Protection Agency of
Data of the Inhabitants (Prodhab), to keep confidentiality with
occasion of the exercise of the powers given by this law, mainly
when accessing information on personal and sensitive data. Is

_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

two

Page 3

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
The obligation will persist even after the relationship with the base of
data.
g) Interested party: natural person, owner of the data that is the subject of the
automated or manual processing.
h) Responsible for the database: natural or legal person who
administer, manage or take care of the database, whether it is a
public or private entity, competent, in accordance with the law, to decide
what is the purpose of the database, what categories of data from
personal character must be registered and what type of treatment
will apply.
i) Processing of personal data: any operation or set of
operations, carried out through automated procedures or
manuals and applied to personal data, such as the collection, the
registration, organization, preservation, modification, extraction,
consultation, use, communication by transmission, broadcast or
any other way that facilitates access to these, the collation or the
interconnection, as well as its blocking, deletion or destruction, among others.

CHAPTER II
BASIC PRINCIPLES AND RIGHTS FOR
PERSONAL DATA PROTECTION
SECTION I
BASIC PRINCIPLES AND RIGHTS

ARTICLE 4.- Informative self-determination
Everyone has the right to informational self-determination, which
covers the set of principles and guarantees regarding the legitimate treatment
of your personal data recognized in this section.
Informational self-determination is also recognized as a right
fundamental, in order to control the flow of information that

_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

3

Page 4

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
concern each person, derived from the right to privacy, avoiding
that discriminatory actions are encouraged.
ARTICLE 5.- Principle of informed consent
1.- Obligation to inform
When personal data is requested, it will be necessary to inform
prior to the owners or their representatives, expressly,
precise and unequivocal:
a) The existence of a personal data base.
b) Of the purposes pursued with the collection of these data.
c) Of the recipients of the information, as well as who may
consult it.
d) The mandatory or optional nature of their responses to the
questions that are asked during data collection.
e) Of the treatment that will be given to the requested data.
F)

Of the consequences of the refusal to supply the data.

g)

Of the possibility of exercising the rights that assist you.

h)

Of the identity and address of the person responsible for the database.

When questionnaires or other means are used for data collection
These warnings will appear clearly legible.
two.-

Granting of consent

Whoever collects personal data must obtain express consent
of the person who owns the data or their representative. This consent
must be in writing, either in a physical or electronic document, the
which may be revoked in the same way, without retroactive effect.
Express consent will not be necessary when:
a) There is a well-founded order, issued by a judicial authority
competent authority or resolution adopted by a special commission of
investigation of the Legislative Assembly in the exercise of its position.
_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

4

Page 5

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
b) In the case of personal data with unrestricted access, obtained from
general public access sources.
c) The data must be delivered by constitutional provision or
legal.
The collection of data without the informed consent of the person is prohibited,
or, acquired by fraudulent, unfair or illegal means.

ARTICLE 6.- Principle of information quality
Only personal data may be collected, stored or used.
personal for automated or manual processing, when such data
are current, truthful, exact and adequate to the purpose for which they were
collected.
1.- News
Personal data must be current. The person in charge of the
database will delete data that is no longer relevant or
necessary, by reason of the purpose for which they were received and
registered. In no case, will the personal data that
may affect, in any way, its owner, after ten
years from the date of occurrence of the recorded events, except
special normative provision that provides otherwise. In case it is
necessary their conservation, beyond the stipulated period, must be
disassociated from its owner.
2. Truthfulness
Personal data must be truthful.
The person responsible for the database is obliged to modify or
delete the data that is untrue. In the same way, it will ensure
that the data be treated fairly and lawfully.
3.- Accuracy
Personal data must be accurate. The responsible person
of the database will take the necessary measures so that the data
inaccurate or incomplete, with respect to the purposes for which they were
_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

5

Page 6

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
collected or for which they were subsequently processed, are deleted or
rectified.
If the personal data registered turns out to be inaccurate in all or
in part, or incomplete, will be eliminated or replaced ex officio by the
person responsible for the database, for the corresponding data
rectified, updated or supplemented. Likewise, they will be eliminated
If informed consent is not mediated or its collection is prohibited.
4.- Suitability to the end
Personal data will be collected for specific purposes,
explicit and legitimate, and will not be subsequently treated in a
incompatible with said purposes.
The subsequent processing of data for the purposes of
historical, statistical or scientific, as long as the
timely guarantees to safeguard the rights contemplated in this
law.
The databases cannot have purposes contrary to the law or the
public morals.

ARTICLE 7.- Rights that assist the person
The right of everyone to access their personal data is guaranteed,
rectification or deletion of these and to consent to the transfer of your data.
The person responsible for the database must comply with what is requested by the
person, free of charge, and resolve in the sense that corresponds in the
within five business days, counted from the receipt of the request.
1.- Access to information
The information must be stored in such a way as to guarantee
fully the right of access by the person concerned.
The right of access to personal information guarantees the following
Faculties of the interested party:
a) Obtain at reasonable intervals, as provided by
regulation, without delay and gratuitously, the confirmation or not of the
_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

6

Page 7

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
existence of your data in files or databases. In case of
If your data does exist, these must be communicated to the
interested person in a precise and understandable way.
b) Receive the information related to your person, as well as the purpose
with which they were collected and the use that has been given to their data
personal. The report must be complete, clear and free of
encodings. It must be accompanied by an explanation of the
technical terms used.
c) Be informed in writing in a broad way, by physical means or
electronic, on the entire record belonging to the owner, even
when the request only includes one aspect of the data
personal. This report may in no case reveal data
belonging to third parties, even when they are linked to the person
interested, except when with them it is intended to configure a crime
penal.
d) Have knowledge, where appropriate, of the system, program, method or
process used in the processing of your personal data.
The exercise of the right to which this article refers, in the case of data from
deceased persons, it will correspond to their successors or heirs.
2.- Right of rectification
The right to obtain, if necessary, the rectification of the
personal data and its updating or deletion when it is
have dealt with infringement of the provisions of this law, in
particular due to the incomplete or inaccurate nature of the data, or have
been collected without the authorization of the owner.
Any owner can request and obtain from the person responsible for the database
data, rectification, updating, cancellation or elimination and the
compliance with the guarantee of confidentiality regarding your data
personal.
The exercise of the right to which this article refers, in the case of data from
deceased persons, it will correspond to their successors or heirs.

_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

7

Page 8

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
ARTICLE 8.- Exceptions to the informative self-determination of the
citizen
The principles, rights and guarantees established herein may be
limited fairly, reasonably and in accordance with the principle of
administrative transparency, when the following purposes are pursued:
a) State security.
b) Security and the exercise of public authority.
c) The prevention, prosecution, investigation, detention and repression of
criminal offenses, or breaches of deontology in the
Professions.
d) The operation of databases that are used for purposes
statistical, historical or scientific research, when there is no
risk of people being identified.
e) The adequate provision of public services.
f) The effective ordinary activity of the Administration, on the part of the
official authorities.

SECTION II
SPECIAL CATEGORIES OF
DATA PROCESSING

ARTICLE 9.- Particular categories of data
In addition to the general rules established in this law, for the treatment
of personal data, the particular categories of data that are
mentioned, they will be governed by the following provisions:
1.-

Sensitive data

_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

8

Page 9

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
No person will be obliged to supply sensitive data. The
processing of personal data that reveal racial origin or
ethnic, political opinions, religious, spiritual or philosophical convictions,
as well as those related to health, life and sexual orientation, among others.
This prohibition will not apply when:
a) The data processing is necessary to safeguard the
vital interest of the interested party or of another person, in the event that the
interested person is physically or legally incapable of giving his
consent.
b) The processing of the data is carried out in the course of their
legitimate activities and with the due guarantees by a foundation,
an association or any other body, whose purpose is political,
philosophical, religious or union, as long as it refers exclusively to
its members or persons who maintain regular contact with
the foundation, the association or the body, by reason of its purpose and
provided that the data is not communicated to third parties without the
consent of the interested persons.
c) The treatment refers to data that the interested person has
made public voluntarily or are necessary for the
recognition, exercise or defense of a right in a
Judicial procedement.
d) The processing of the data is necessary for the prevention or
for medical diagnosis, provision of healthcare or
medical treatment, or the management of health services, provided that
said data processing is carried out by an official or
official in the health area, subject to professional or proprietary secrecy
of his function, or by another person subject, likewise, to an obligation
equivalent of secret.
2.- Personal data with restricted access
Personal data with restricted access are those that, even forming part of
public access records, they are not of unrestricted access because they are of interest
only for its owner or for the Public Administration. Your treatment will be
allowed only for public purposes or if you have the
express consent of the owner.

_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

9

Page 10

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
3.- Personal data with unrestricted access
Personal data with unrestricted access are those contained in databases
general access public laws, as provided by special laws and
compliance with the purpose for which these data were collected.
The following will not be considered included in this category: the exact address of the
residence, except if its use is the result of a mandate, subpoena or
administrative or judicial notification, or, of a banking operation or
financial, photography, private telephone numbers and others of the same
nature whose treatment may affect the rights and interests of the
titular person.
4.- Data regarding credit behavior
The data referring to credit behavior will be governed by the rules
that regulate the National Financial System, so that they allow
guarantee an acceptable degree of risk on the part of the entities
without impeding the full exercise of the right to self-determination
informative nor exceed the limits of this law.

SECTION III
SECURITY AND CONFIDENTIALITY
DATA PROCESSING

ARTICLE 10.- Data security
The person responsible for the database must adopt measures of the nature
technical and organizational necessary to guarantee the safety of the
personal data and avoid its alteration, accidental destruction or
illegal, loss, treatment or unauthorized access, as well as any other
action contrary to this law.
These measures must include, at least, the security mechanisms
more appropriate physics and logic according to current technological development,
to ensure the protection of stored information.

_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

10

Page 11

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
Personal data will not be recorded in databases that do not meet the
conditions that fully guarantee your safety and integrity, as well as
that of treatment centers, equipment, systems and programs.
By way of regulation, the requirements and conditions that
should gather the automated and manual databases, and the
people involved in the collection, storage and use of the data.

ARTICLE 11.- Duty of confidentiality
The person responsible and those involved in any phase of the
processing of personal data are bound by professional secrecy or
functional, even after its relationship with the database has ended. The
obliged person may be relieved of the duty of secrecy by decision
judicial in what is strictly necessary and within the cause known.

ARTICLE 12.- Action protocols
Individuals and legal entities, public and private, who have among their
functions the collection, storage and use of personal data,
may issue an action protocol in which they will establish the steps
that should be followed in the collection, storage and handling of the
personal data, in accordance with the rules provided in this law.
To be valid, the action protocols must be registered, as well as
as its later modifications, before the Prodhab. The Prodhab may
verify, at any time, that the database is complying
fully with the terms of your protocol.
The manipulation of data based on an action protocol registered before
the Prodhab will presume, "iuris tantum", the fulfillment of the
provisions contained in this law, for the purposes of authorizing the transfer
of the data contained in a database.

ARTICLE 13.- Effective guarantees

_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

eleven

Page 12

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
Every interested person has the right to an administrative procedure
simple and fast before the Prodhab, in order to be protected against acts that
violate their fundamental rights recognized by this law. The above without
prejudice to the general or specific jurisdictional guarantees that the law
establish for this same purpose.

CHAPTER III
TRANSFER OF PERSONAL DATA
UNIQUE SECTION

ARTICLE 14.- Transfer of personal data, general rule
Those responsible for the databases, public or private, may only
transfer data contained in them when the right holder has
expressly and validly authorized such transfer and is made without violating the
principles and rights recognized in this law.

CHAPTER IV
DATA PROTECTION AGENCY
OF THE INHABITANTS
SECTION I
GENERAL DISPOSITION

ARTICLE 15.- Agency for the Protection of Data of the inhabitants
(Prodhab)
Create a maximum deconcentration body attached to the Ministry of
Justice and Peace called Agency for the Protection of Data of the inhabitants
(Prodhab). It will have its own instrumental legal personality in the performance
_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

12

Page 13

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
of the functions assigned by this law, in addition to the administration of its
resources and budget, as well as to sign contracts and agreements
that it requires for the fulfillment of its functions. The Agency will enjoy
independence of judgment.

ARTICLE 16.- Powers
They are attributions of the Prodhab, in addition to the others imposed by this u
other standards, the following:
a) Ensure compliance with the regulations on protection
of data, both by private individuals or legal entities, as well as by
by public entities and bodies.
b) Keep a record of the databases regulated by this law.
c) Require, from those who administer databases, the information
necessary for the exercise of their position, among them, the protocols
used.
d) Access the databases regulated by this law, for the purposes of
effectively enforce data protection regulations
personal. This attribution will be applied for specific cases
presented to the Agency and, exceptionally, when there is
evidence of widespread mismanagement of the database or
information system.
e) Resolve on claims for infringement of the rules on
Protection of personal data.
f) Order, ex officio or at the request of a party, the deletion, rectification,
addition or restriction on the circulation of the information contained
in files and databases, when these contravene the
rules on the protection of personal data.
g) Impose the sanctions established in article 28 of this law, to
individuals or legal entities, public or private, who violate the
rules on the protection of personal data, and transfer to the
Public Ministry of those that may constitute a crime.

_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

13

Page 14

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
h) Promote and contribute to the drafting of regulations aimed at
implement the rules on the protection of personal data.
i) Issue the necessary guidelines, which must be published
in the official newspaper La Gaceta, so that public institutions
implement the appropriate procedures regarding the handling of
personal data, respecting the various degrees of autonomy
administrative and functional independence.
j) Encourage knowledge of rights among the inhabitants
concerning the collection, storage, transfer and use
of your personal data.
In the exercise of its powers, the Prodhab must employ
automated procedures, according to the best tools
technology at your fingertips.

ARTICLE 17.- Agency Management
The Directorate of the Prodhab will be in charge of a director or a director
national, who must have, at least, the academic degree of
degree in a subject related to the purpose of their function and be recognized
professional and moral solvency.
Whoever is the owner may not be appointed director or national director,
shareholder, member of the board of directors, manager, advisor, representative
legal or employee of a company dedicated to the collection or
storage of personal data. Said prohibition shall persist for up to
two years after having ceased their functions or business relationship.
Anyone who is a spouse or relative will be equally disabled until the third
degree of consanguinity or affinity of a person who is in any of
the assumptions mentioned above.

ARTICLE 18.- Agency Personnel
Prodhab will have the technical and administrative staff necessary for the
good exercise of their functions, designated by means of a competition for suitability,
according to the Civil Service Statute or as provided
regulations. The staff is obliged to keep professional secrecy
_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

14

Page 15

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
and duty of confidentiality of the personal data that it knows in
the exercise of their functions.
ARTICLE 19.- Prohibitions
All employees of Prodhab have the following
prohibitions:
a) Provide services to people or companies that are dedicated to
collection, storage or handling of personal data. Bliss
The prohibition will persist for up to two years after its
functions.
b) Taking an interest, personally and unduly, in matters of knowledge
from the agency.
c) Reveal or in any way disseminate the personal data to which you have
had access on the occasion of his position. This prohibition will persist
indefinitely even after leaving office.
d) In the case of officials appointed in
professional positions, exercise their profession externally. The above
The exception is the exercise of teaching activity in educational centers.
higher education or liberal practice in favor of relatives by
consanguinity or affinity up to the third degree, provided that no
is faced with the assumption of subsection a).
The non-observance of any of the previous prohibitions will be
considered a very serious offense, for the purposes of applying the regime
disciplinary, without prejudice to the other forms of responsibility that such
behaviors could lead to.

ARTICLE 20.- Budget
The Prodhab budget will be made up of the following:
a) The royalties, fees and rights obtained in the exercise of
its functions.
b) Transfers made by the State in favor of the Agency.

_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

fifteen

Page 16

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
c) Donations and grants from other states,
national public institutions or international organizations, always
that do not compromise the independence, transparency and autonomy of
the agency.
d) What is generated by its financial resources.
The amounts from the collection of the fines indicated in this law will be
destined to the update of equipment and programs of the Prodhab.
The Agency will be subject to compliance with the principles and regime of
responsibility established in titles II and X of Law No. 8131,
Financial Administration of the Republic and Public Budgets, of 18
September 2001. In addition, you must provide the required information
by the Ministry of Finance for their studies. In the rest, the exception is
the Agency of the scopes and the application of that law. In the audit, the
Agency will be subject, solely, to the provisions of the Comptroller's Office
General of the Republic.

SECTION II
INTERNAL STRUCTURE

ARTICLE 21.- Registry of files and databases
Any database, public or private, managed for the purposes of
distribution, dissemination or commercialization, must be registered in the registry that
effect enable the Prodhab. Registration does not imply transfer or
data transfer.
You must enter any other information than the rank standards
imposed on it and the action protocols referred to in the
Article 12 and paragraph c) of Article 16 of this law.

ARTICLE 22.- Disclosure
Prodhab will develop and execute a communication strategy aimed at
allow the administered ones to know the rights derived from the management
_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

16

Page 17

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
of your personal data, as well as the mechanisms that the ordering
provides for the defense of such prerogatives. You must coordinate with the
local governments and with the Ombudsman's Office of the Republic the
periodic performance of outreach activities among the inhabitants of
the cantons.
Likewise, it will promote among the people and companies that collect,
store or manipulate personal data, the adoption of practices and
protocols of action in accordance with the protection of said information.

CHAPTER V
PROCEDURES
SECTION I
COMMON PROVISIONS

ARTICLE 23.-Supplementary application
In matters not expressly provided for by this law and as long as they are compatible with
its purpose, the provisions of Book II of
the General Law of Public Administration.

SECTION II
INTERVENTION IN FILES AND DATABASES

ARTICLE 24.- Denunciation
Any person who has a subjective right or a legitimate interest
You can report, to the Prodhab, that a public or private database
acts in contravention of the rules or basic principles for the
data protection and informational self-determination established in
this law.

_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

17

Page 18

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
ARTICLE 25.- Processing of complaints
Once the complaint has been received, the person responsible for the database will be granted a
period of three business days for it to rule on the veracity of
such charges. The person denounced must send the means of proof
supporting their claims together with a report, which will be deemed
given under oath. Failure to render the report within the stipulated period
it will cause the accused facts to be taken for granted.
At any time, the Prodhab may order the person denounced to
presentation of the necessary information. Likewise, you can make
on-site inspections of your files or databases. To safeguard the
rights of the person concerned, may dictate, by means of a founded act, the
Precautionary measures to ensure the effective result of the procedure.
No later than one month after filing the complaint, the Prodhab
must dictate the final act. Against his decision there will be an appeal of
reconsideration within the third day, which must be resolved within the term
eight days after receipt.

ARTICLE 26.- Effects of the estimatory resolution
If it is determined that the information of the interested party is false, incomplete,
inaccurate, or that in accordance with the rules on data protection
personal it was improperly collected, stored or disseminated,
its immediate deletion, rectification, addition or clarification must be ordered,
or, impediment regarding its transfer or diffusion. If the person
denounced does not fully comply with what was ordered, it will be subject to the
penalties provided for in this and other laws.

ARTICLE 27.- Penalty procedure
Ex officio or at the request of a party, the Prodhab may initiate a procedure
aimed at demonstrating whether a database regulated by this law is being
employed in accordance with its principles; For this, the
procedures provided for in the General Law of Public Administration for the
ordinary procedure. Against the final act there will be an appeal of
reconsideration within the third day, which must be resolved within the term
eight days after receipt.
_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

18

Page 19

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________

ARTICLE 28.- Sanctions
If any of the offenses typified in this law has been incurred, you must
impose any of the following sanctions, without prejudice to the sanctions
corresponding penalties:
a) For minor absences, a fine of up to five base salaries of the
position of judicial assistant I, according to the Budget Law of the
Republic.
b) For serious offenses, a fine of five to twenty base salaries of the
position of judicial assistant I, according to the Budget Law of the
Republic.
c) For very serious offenses, a fine of fifteen to thirty wages
basis of the position of judicial assistant I, according to the Budget Law of the
Republic, and the suspension for the operation of the file from one to
six months.

ARTICLE 29.- Minor offenses
They will be considered minor offenses, for the purposes of this law:
a) Collect personal data for use in a database without
sufficient and extensive information is given to the interested person,
in accordance with the specifications of article 5, section I.
b) Collect, store and transmit personal data of third parties by
through unsafe mechanisms or that in any way do not guarantee
the security and inalterability of the data.

ARTICLE 30.- Serious offenses
For the purposes of this law, the following will be considered serious offenses:
a) Collect, store, transmit or in any other way use
personal data without the informed and express consent of the owner
of the data, in accordance with the provisions of this law.
_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

19

Page 20

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
b) Transfer personal data to other people or companies in
contravention of the rules established in chapter III of this law.
c) Collect, store, transmit or in any other way use
personal data for a purpose other than that authorized by the
owner of the information.
d) Refusing unjustifiably to give an interested party access to the
data contained in files and databases, in order to verify their
quality, collection, storage and use in accordance with this law.
e) Refusing unjustifiably to delete or rectify the data of a
person who has requested it by clear and unequivocal means.

ARTICLE 31.- Very serious offenses
The following will be considered very serious offenses, for the purposes of this law:
a) Collect, store, transmit or in any other way
use, by private individuals or legal entities, data
sensitive, according to the definition provided in article 3 of this law.
b) Obtain, from the owners or third parties, personal data of a
person by means of deception, violence or threat.
c) Reveal information registered in a personal database
whose secret he is obliged to keep according to the law.
d) Provide a third party with false or different information contained in
a data file, with knowledge of it.
e) Carry out personal data processing without being
duly registered with the Prodhab, in the case of those responsible
of databases covered by article 21 of this law.
f) Transfer, to the databases of third countries, information from
personal character of Costa Ricans or foreigners living
in the country, without the consent of their owners.

SECTION III
_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

twenty

Page 21

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
INTERNAL PROCEDURES

ARTICLE 32.- Penalty regime for public databases
When the person responsible for a public database commits any
of the previous offenses, the Prodhab will issue a resolution establishing the
measures to be taken to cease or correct the effects of the
lack. This resolution will be notified to the person responsible for the
data, to the body on which it depends hierarchically and to those affected, if the
there are. The resolution may be issued ex officio or at the request of a party. The above
without prejudice to the criminal liability incurred.

CHAPTER VI
CANONS
ARTICLE 33.- Canon for regulation and administration of bases of
data
The persons responsible for databases who must register with the
Prodhab, in accordance with article 21 of this law, will be subject to a
canon of regulation and administration of databases that must be
paid annually, in the amount of two hundred dollars ($ 200), currency
legal tender of the United States of America. The procedure for
to collect this fee will be detailed in the regulations that
the effects must be issued by the Prodhab.

ARTICLE 34.- Fee for commercialization of consultation
The person responsible for the database must cancel the Prodhab a
canon for each sale of the file data defined in subsection b) of the
Article 3 of this law, of individually registered persons
legitimately and provided that it is marketed for profit, which
It will range from twenty-five cents ($ 0.25) to one dollar ($ 1),
legal tender of the United States of America, an amount that may
be set within said range via regulation. In case of contracts
global low, medium and high consumption of consultations, or modalities
_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

twenty-one

Page 22

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
contractual online service by number of applications, will be the
regulation of the law that fixes the detail of the collection of the canon that will not be able to
be higher than ten percent (10%) of the contract price.

TRANSIENT
TRANSITORY I.Individuals or legal entities, public or private, who are currently
owners or administrators of the databases object of this law,
must adapt their procedures and rules of action, as well as the
content of its databases to the provisions of this law, in a
maximum term of one year from the creation of the Prodhab.
TRANSITORY II.As of the effective date of this law, the process will begin
of conformation and integration of the Prodhab; for this, there will be a
maximum term of six months.
TRANSITORY III.The Executive Power will issue the regulations of this law within a maximum period
six months after the formation of the Prodhab, collecting the
technical recommendations provided by the Agency.

It governs from its publication.

LEGISLATIVE ASSEMBLY. Approved on the twenty-seventh day of June
of two thousand eleven.

COMMUNICATE TO THE EXECUTIVE BRANCH
Juan Carlos Mendoza Garcia
_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

22

Page 23

SUPREME COURT OF ELECTIONS
NORMATIVE
www.tse.go.cr
____________________________________________
PRESIDENT
Jose Roberto Rodriguez Quesada

Martin Alcides Monestel Contreras

FIRST SECRETARY

SECOND SECRETARY

Given in the Presidency of the Republic. — San José, on the seventh day of the month
July of the year two thousand eleven.
Run and get published.
LAURA CHINCHILLA MIRANDA. — The Minister of Justice and Peace, Hernando Paris
Rodriguez.

_____________________________________________________________
PROTECTION OF THE PERSON AGAINST TREATMENT
OF YOUR PERSONAL DATA

2. 3

