Duty LXD-1079
Processes personal data, in Puerto Rico
Código Penal de Puerto Rico, delitos contra el derecho a la intimidad (unauthorized use and disclosure of personal data records)since 2 lines
Ley Núm. 146 de 30 de julio de 2012, según enmendada (Código Penal de Puerto Rico), Arts. 172-175; 33 L.P.R.A. §§ 5238-5241 · Read the law's page
- Do not access, use, modify, or disclose another person's or another company's reserved personal or family data without authorization; doing so is a felony under Puerto Rico's Penal Code, independent of any separate civil privacy duty.
- Expect an enhanced penalty (eight years' imprisonment, and a fine of up to $30,000 for a convicted legal person) where the conduct is committed for profit by someone responsible for the records, or by a public official or employee acting in the course of their duties.
Ley de Información al Ciudadano sobre la Seguridad de Bancos de Información (data breach notification)in force4 lines
Ley Núm. 111 de 7 de septiembre de 2005, según enmendada; 10 L.P.R.A. §§ 4051-4055 · Read the law's page
- Notify affected Puerto Rico residents of a security breach of an information bank containing their personal information as expeditiously as possible.
- Report the breach to the Department of Consumer Affairs within ten non-extendable days of detecting it.
- Use direct written or authenticated electronic notice unless the cost would exceed $100,000 or 100,000 people are affected, in which case use the substitute-notice procedure (prominent posting plus media notice) instead.
- Route a breach occurring at a government agency or public corporation to the Office of the Procurador del Ciudadano rather than the ordinary consumer notice path.for a public body