Law / United States / 
Puerto Rico
Ley de Información al Ciudadano sobre la Seguridad de Bancos de Información (data breach notification)
Ley Núm. 111 de 7 de septiembre de 2005, según enmendada; 10 L.P.R.A. §§ 4051-4055
In force.
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Notify affected Puerto Rico residents of a security breach of an information bank containing their personal information as expeditiously as possible.
- Report the breach to the Department of Consumer Affairs within ten non-extendable days of detecting it.
- Use direct written or authenticated electronic notice unless the cost would exceed $100,000 or 100,000 people are affected, in which case use the substitute-notice procedure (prominent posting plus media notice) instead.
- Route a breach occurring at a government agency or public corporation to the Office of the Procurador del Ciudadano rather than the ordinary consumer notice path.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Civil fine the Secretary of Consumer Affairs may impose per violation; separate from a consumer's own right to sue for damages.
- Rule
- Per violation only
- As of
- Minimum
- 500
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Departamento de Asuntos del Consumidor (DACO); Oficina del Procurador del Ciudadano for a breach at a government agency or public corporation
Settledness
- As of
- Open questions
- Does the $100,000 cost condition in Article 4(2) ("siempre que el costo exceda los cien mil (100,000) dólares") compare the cost of notifying every potentially affected person, or the entity's whole cost of responding to the breach?
- Does the count in Article 4(2) ("el número de personas las cien mil") include only Puerto Rico residents, or every person whose information was in the information bank?
What it reaches
How the hook was established
express
What makes it apply
Operator establishment, Data subject residence
Obligation class
Breach notice, Disclosure, Reporting
Applicability criteria
English: every entity that owns or holds an information bank that includes personal information of citizens resident in Puerto Rico. Article 2(d) defines entity to reach government bodies and every private corporation, partnership, association, company or organization authorized to do business or operate in Puerto Rico; the text sets no size or revenue test.
- As of
- Combinator
- All of
- Criteria
- Toda entidad propietaria o custodia de un banco de información que incluya información personal de ciudadanos residentes en Puerto Rico
What it makes you log
Logging duty
Articles 2 to 4 require an entity that owns or holds a data bank with personal information of citizens resident in Puerto Rico to notify them of any breach of system security (a reseller of access to such banks notifies the owner), to report the breach to the Department of Consumer Affairs within an unextendable ten days, with the Department announcing it publicly within 24 hours, and to give the notice in a clear form by letter, authenticated electronic means, or a posted notice and press release when the cost or number of persons is high. Each is a duty to notify. The Law requires no record of breaches, no register and no retention period, and Article 10 only lets the Secretary impose fines of 500 to 5,000 dollars per violation. English: 'Every entity that owns or holds an information bank that includes personal information of citizens resident in Puerto Rico shall notify those citizens of any breach of system security.' The Law reaches a company or organization authorized to do business or operate in Puerto Rico (Article 2(d)) and protects citizens resident in Puerto Rico (Article 3).
- Kind
- None
- As of
What this law does
Every entity, government or private, that owns or has custody of an information bank containing Puerto Rico residents' personal information must notify affected citizens of a security breach as expeditiously as possible, and must report the breach to the Department of Consumer Affairs within a non-extendable ten days, after which the Department publicly announces the breach within twenty-four hours.
A breach at a government agency or public corporation is instead routed to a specialized Ombudsman within the Office of the Procurador del Ciudadano. Direct written or authenticated electronic notice is required unless the cost would exceed $100,000 or the affected population 100,000 people, in which case substitute notice (prominent posting plus media notice) is permitted.
The Secretary of Consumer Affairs may impose a civil fine of $500 to $5,000 per violation; Article 10 states that these fines do not affect consumers' rights to bring damages actions before a competent court, and the Act grants no cause of action of its own. Article 11 states the Act takes effect one hundred and twenty days after its approval, other than Article 6, which took effect immediately. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .