Costa RicaCódigo Penal, artículo 196 bis, Violación de datos personales
Codigo Penal (Ley No. 4573), art. 196 bis, segun reforma por Ley No. 9048
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Prohibition
- Audit expectation
- none
What it requires
- Do not appropriate, copy, transmit, publish, or otherwise give unauthorized treatment to a person's data or images without their authorization, since doing so for one's own or a third party's benefit, to the danger or harm of that person's privacy, is a criminal offense.
- Treat data revealing ideology, religion, health, racial origin, or sexual orientation, and data belonging to a minor, with particular care, since unauthorized handling of those categories carries an aggravated penalty.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Imprisonment of three to six years, rising to four to eight years when committed by a person with system-administration access, when the data are public or in a public database, when the victim is a minor or incapacitated, or when the data reveal ideology, religion, beliefs, health, racial origin, sexual preference, or sex life (Codigo Penal art. 196 bis).
What it makes you log
Logging duty
Article 196 bis is a criminal offence for unauthorized taking, modification, access, copying, transmission, publication, interception, retention, sale or diversion of the personal data of a natural or legal person kept in a computer or telematic system, with a higher penalty for those who administer or support the system, for public data, for data of a minor and for sensitive data. It requires no one to make, keep or produce a log or record, names no audit, access party or retention period, and carries no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Article 196 bis of the Codigo Penal, as reformed by Ley No. 9048, punishes with three to six years of imprisonment a person who, for their own benefit or a third party's, and to the danger or harm of another's privacy, without the data subject's authorization, appropriates, modifies, interferes with, accesses, copies, transmits, publishes, disseminates, compiles, disables, intercepts, retains, sells, buys, diverts to a different purpose than the one for which the data were collected, or otherwise gives unauthorized treatment to the images or data of a natural or legal person stored in a computer or telematic system or in an electronic, optical or magnetic container.
The penalty rises to four to eight years when the conduct is committed by a person who administers or supports the system or has access to it by reason of their duties, when the data are public or held in a public database, when the victim is a minor or an incapacitated person, or when the conduct affects data revealing ideology, religion, beliefs, health, racial origin, sexual preference, or sex life.
The Legislative Assembly approved Ley No. 9048 on and the President signed it on ; the pgrweb consolidated text states it takes effect on publication.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .