Law / United States / 
Puerto Rico
Código Penal de Puerto Rico, delitos contra el derecho a la intimidad (unauthorized use and disclosure of personal data records)
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Departamento de Justicia de Puerto Rico (public prosecution under the Penal Code)
- Obligation class
- Security, Disclosure
- Audit expectation
- none
What it requires
- Do not access, use, modify, or disclose another person's or another company's reserved personal or family data without authorization; doing so is a felony under Puerto Rico's Penal Code, independent of any separate civil privacy duty.
- Expect an enhanced penalty (eight years' imprisonment, and a fine of up to $30,000 for a convicted legal person) where the conduct is committed for profit by someone responsible for the records, or by a public official or employee acting in the course of their duties.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 172 (33 L.P.R.A. § 5238) punishes unauthorized appropriation, use, or alteration of another's reserved personal or family data held in a file or registry with three years' imprisonment for a natural person.
Penalty structure
Fine for a convicted legal person under Article 172; a natural person instead faces three years' imprisonment. Article 175 raises this to a $30,000 fine (and eight years' imprisonment for a natural person) where the offense is committed for profit by the person responsible for the records, or by a public official or employee in the course of duty.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 10,000
What it makes you log
Logging duty
Articles 172 to 175 are offences. Article 172 punishes a person who, without authorization, appropriates, uses, modifies or alters another person's reserved personal or family data held in computer or electronic files or in any public or private file or registry; Article 173 punishes disclosing, publishing or transferring such data, or setting up a business to distribute or give access to data obtained in violation; Article 174 extends them to a legal person's reserved data; Article 175 raises the penalty where the offence is committed for profit by the persons in charge of the files or by officials or employees in the course of their duties. English: 'Any person who, without authorization, appropriates, uses, modifies or alters another's reserved personal or family data recorded in computer or electronic disks or files, or in any other public or private file or registry.' A criminal prohibition names no log, register or record the person must keep, sets no retention period, and gives no reader of a record; the person responsible for the files in Article 175 is an aggravating status and not a record-keeper under a duty. Article 167, outside this row, punishes a public employee who without legal authority keeps files of names and data of persons. The Code's general territorial rules are in other articles that these provisions do not invoke, so no territorial hook is recorded.
- Kind
- None
- As of
What this law does
Under the Penal Code's section on crimes against the right to privacy, Article 172 makes it a felony, punishable by three years' imprisonment, to appropriate, use, modify, or alter without authorization another person's or family's reserved personal data held in a computerized or other file or registry; a convicted legal person is instead fined up to $10,000.
Article 173 applies the same penalty to disseminating, publishing, revealing, or transferring such data to a third party, or to distributing or accessing data known to have been obtained through such a violation. Article 174 extends Articles 171 through 173 to protect a legal person's (a company's) reserved data on the same terms.
Article 175 raises the penalty to eight years' imprisonment, and a convicted legal person's fine to $30,000, where the violation is committed for profit by the person responsible for the records, or by a public official or employee acting in the course of their duties.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .