Dominican Republic

Article 1 sets the law's object as the comprehensive protection of personal data held in public or private files, registers, databanks or other technical processing media, and separately regulates the constitution, organization and operation of Sociedades de Información Crediticia (SIC), the credit reporting bureaus.

Article 2 applies the law to personal data recorded in any databank susceptible to processing and to every later use of that data in the public and private spheres alike, and article 4 excludes only a narrow, exhaustive list: data an individual keeps for purely personal or domestic activity, files kept by the Dominican Republic's investigative and intelligence bodies for crime prevention and prosecution, data about deceased persons, and data limited to a professional's name, position, and business contact details.

Article 5 states the law's governing principles: files must be lawful and registered, data must be accurate and kept up to date, a data subject must be told the purpose of the processing and who is responsible for the file before consenting, processing requires the data subject's free, express and conscious consent unless an exception applies, the data controller and processor must adopt technical, organizational and security measures against alteration, loss or unauthorized access, everyone who handles the data owes a duty of professional secrecy that survives the end of their relationship with the data subject or the controller, data may not be collected by fraudulent or unlawful means, and data may only be collected for a determined, explicit and legitimate purpose.

Article 42 requires every archive, registry, or databank, public or private, to maintain adequate information policies guaranteeing security and control measures to prevent the improper handling of data subjects' information. Article 43 requires a Sociedad de Información Crediticia to register with the Superintendencia de Bancos once the Junta Monetaria has authorized it to operate, before it may begin operating as a credit bureau.

Article 60 requires a Sociedad de Información Crediticia to use biometric identification techniques, such as matching a consumer's photograph, to make identity theft difficult when a person contracts goods or services from a public or private entity, and article 63 requires it to adopt the security measures necessary to prevent improper handling of the information and to protect the algorithms and technologies it uses under the strictest security and confidentiality.

Article 80 permits the international transfer of personal data to a foreign country or international or supranational organization, where the transfer needs the data subject's consent, only in the nine cases the article lists. The first ground is the data subject's free and conscious authorization of the transfer, or a case the law otherwise permits.

The other listed grounds cover medical data exchange for treatment or epidemiological research or for reasons of public health or hygiene, banking or securities transfers under their own applicable law, a transfer agreed under an international treaty or convention including a free trade agreement the Dominican Republic is party to, cooperation between intelligence agencies against organized crime, terrorism, human trafficking, or drug trafficking, a transfer necessary to perform a contract with the data subject or precontractual measures, a transfer legally required to safeguard the public interest or to recognize, exercise, or defend a right in a judicial proceeding or requested by a tax or customs administration, a transfer to provide or request international judicial assistance, and a transfer made at the request of an international organization with a legitimate interest from a public register.

Article 7 gives every person a judicial right of consultation to learn of and access the data recorded about them in a public or private register or databank, and to demand suspension, rectification, or updating where the data is discriminatory, inaccurate, or erroneous.

Article 8 gives a data subject the right to have their personal data rectified, updated, or, where appropriate, suppressed, and requires the data controller, once it has verified the claim, to carry out the correction, suppression, or update within ten business days of receiving the request or discovering the error, to notify any recipient the data was disclosed to within five business days of the correction, and to make the correction free of charge.

Article 9 makes the rights of access, rectification, cancellation, and opposition independent of one another, so exercising one is never a precondition for exercising another.

Article 10 gives every person the right to access the data about them or their property held in official or private registers, to learn how it is used, and, before a competent judge, to seek its updating, correction, or destruction where it illegitimately affects their rights, and requires a databank user to answer an access request within five business days.

Article 11 gives a data subject the right to request their credit history or credit report from a Sociedad de Información Crediticia free of charge up to four times a year, at intervals of at least three months, unless a legitimate interest justifies more frequent access, and lets them view it at the bureau's offices or request secure access through an internet platform.

Article 12 requires a Sociedad de Información Crediticia to make the requested credit report available to the data subject within five business days of receiving the request.

Articles 17 through 24 give a data subject the judicial habeas data action to learn of, access, correct, suppress, or update personal data held in a public or private archive, register, or databank, set out who may bring and defend the action, fix the competent court as that of the defendant's domicile, and follow the amparo procedure, requiring the defendant archive to state, in answering the claim, its reasons for including the disputed information.

Article 16 gives a person harmed by a violation of the law the right to be indemnified under ordinary civil law.

Article 25 gives a data subject who disputes information in a Sociedad de Información Crediticia report the right to file a claim, requires the bureau to forward it to the data furnisher within ten business days, requires the data furnisher to answer in writing within ten business days, requires the disputed record to carry the legend Registro Impugnado por Habeas Data until the dispute is resolved, and requires a correction to be made within five business days once the furnisher accepts it or a final judgment favors the data subject.

Article 44 gives a data subject listed in a professional directory the free right to have their data excluded from advertising or commercial prospecting, and article 71 gives every data subject the right to request, at any time, that their name be withdrawn or blocked from a databank used for marketing, mailing, advertising, or direct sale.

Article 26 lets a court deny access, rectification, or suppression from an official databank to protect national security, public order and safety, or the rights and interests of third parties, or where disclosure would hinder a pending judicial or administrative investigation into tax compliance, health or environmental oversight, crime, or an administrative infraction.

Article 29 places the archives, registers, and databanks that provide credit reports under the inspection and oversight of the Superintendencia de Bancos as the law's control body, empowering it to assist and advise individuals about their rights and to impose the administrative sanctions the law allows.

Article 81 makes the Superintendencia de Bancos the competent body to sanction a Sociedad de Información Crediticia for administrative infractions, listed as including a prohibited disclosure in a credit report, refusing a data subject access to their credit information, unreasonably denying a review or rectification request, or refusing to modify or cancel information after a favorable ruling for the data subject, punishable by a fine of ten to one hundred times the minimum wage or, for failing to begin operations within six months of authorization, revocation of the bureau's operating permit.

Article 84 fines with ten to fifty times the minimum wage a person who knowingly inserts false data into a file, knowingly supplies false information to a third party, accesses a personal databank unlawfully or by breaching its confidentiality and security systems, or discloses information they were legally bound to keep secret, without prejudice to the person's right to recover damages for the violation of their privacy right under ordinary civil law.

Article 16 separately gives anyone harmed by a violation of the law the right to be indemnified under ordinary civil law. Article 88 punishes any violation of the law's provisions, and the unauthorized disclosure, publication, reproduction, transmission, or recording of a credit report, with six months to two years of correctional imprisonment and a fine of one hundred to one hundred fifty times the minimum wage.

Article 86 punishes fraudulently consulting a consumer's personal information without their authorization with a fine of ten to fifty times the minimum wage, rising to correctional imprisonment of six months to two years where the access served to commit an offence, and article 87 punishes fraudulently accessing a Sociedad de Información Crediticia's database using credentials that are not the offender's own with a fine of twenty to one hundred times the minimum wage, similarly rising to imprisonment where the access served to commit an offence.

Article 6, item 8, defines specially protected data as data revealing racial or ethnic origin, political opinions, religious, philosophical or moral convictions, union affiliation, or health or sex life information, and article 6, item 31, restates the same categories as sensitive data, leaving out racial or ethnic origin and making no reference to biometric or genetic data in either definition.

Article 75 bars anyone from being compelled to provide sensitive data, lets a person provide it only if they freely and consciously choose to, and prohibits forming a file, databank, or register that directly or indirectly reveals sensitive data without the data subject's free, conscious, and voluntary consent, though churches, religious associations, clinics, hospitals, and political or union organizations may still keep a membership register, and sensitive data may otherwise be collected only for reasons of general interest authorized by law or for statistical or scientific purposes where the data subject cannot be identified.

Article 76 requires the data subject's express written consent before processing data revealing political opinions, religious, philosophical or moral convictions, union affiliation, or health or sex life information, except for files kept by political parties, unions, churches, religious communities, and nonprofit associations or foundations about their own members, and even then any disclosure of that data still needs the member's prior consent.

Article 77 allows a person's criminal record data to be included in a file, or communicated to a public register, only once a court has ordered the person to stand trial.

Article 78 lets a public or private health establishment or health professional process a patient's physical or mental health data under the rules of the Dominican Republic's health legislation and the duty of professional secrecy, and lets data on racial origin, health, or sex life be processed where necessary for medical prevention or diagnosis, health care, medical treatment, or managing health services, so long as the person handling it is bound by professional secrecy or an equivalent duty.

Article 66 bars a Sociedad de Información Crediticia from collecting, storing, or using in a credit report a consumer's emotional or affective characteristics, political ideology or opinions, religious beliefs or convictions, or information about their physical or psychological health or their sexual conduct, preference, or orientation, reinforcing the same categories against use in credit reporting specifically.

Article 79 leaves the processing of a minor's data to the Code for the Protection of the Rights of Children and Adolescents, the Criminal Code, and other special laws, so this Act states no independent standard of its own for a minor's data.

Article 56 of Law 53-07 requires service providers to keep traffic, connection and access data, or any other information that may be useful to an investigation, for a minimum period of 90 days. The Dominican Institute of Telecommunications (INDOTEL) was to create a regulation on the procedure for obtaining and preserving data and information from service providers within six months of the Law's promulgation.

Article 54(b) empowers the competent authority to order a natural or legal person to preserve and maintain the integrity of an information system or any of its components for up to 90 days, an order that may be renewed for successive periods. Article 54(d) also empowers the competent authority to order a service provider, including an internet service provider, to supply the data it holds about a user.

Article 53 directs the competent authorities to act with the speed required to preserve data held in an information system or its components, or the system's traffic data, mainly where the data is vulnerable to loss or modification. Article 66 provides that the Law takes effect from the date of its publication. Gaceta Oficial 10416, which publishes the Law, is dated 9 May 2007.

Article 6 (Acceso Ilícito) sanctions accessing an electronic, computer, telematic, or telecommunications system or its components, whether or not using another's identity, or exceeding an authorization, with three months to one year of imprisonment and a fine of one to two hundred times the minimum wage; a first paragraph raises the penalty to one to three years of imprisonment and a fine of two to four hundred times the minimum wage where the illicit access suppresses or modifies data, or discloses confidential data found in the accessed system, and a second paragraph imposes that same one-to-three-year, two-to-four-hundred-times range on exploiting access obtained coincidentally or unintentionally.

Article 5 (Códigos de Acceso) separately sanctions divulging, generating, copying, capturing, using, altering, trafficking, or decoding an access code or similar mechanism used to achieve illicit access, or falsifying an access device, with one to three years of imprisonment and a fine of twenty to one hundred times the minimum wage; a separate paragraph on cloning an access device for resale, distribution, or fraudulent financial transactions raises this to one to ten years of imprisonment and a fine of two to five hundred times the minimum wage, the most severe tier either article carries.

Neither article's text turns on defeating a technical security measure, so a scraper's authorization status, rather than the presence of a technical barrier, is what the statute conditions liability on; no reported Dominican decision applying either article to a scraper reading public pages was located.

Article 30 requires the copyright law's limitations and exceptions to be read restrictively, so as not to conflict with the work's normal exploitation or unjustifiably prejudice the rights holder. Article 31 permits quoting an author by transcribing necessary passages, provided they are not so extensive as to amount to a simulated and substantial reproduction of the work, with the author's name and the work's title cited.

Article 32 permits reprographic reproduction, for teaching or examinations at educational institutions, of lawfully published newspaper or periodical articles or short excerpts of lawfully published works, where the use is not for sale or profit.

Article 2(12) protects a compilation or database's creative selection or arrangement as a literary work, but the same clause expressly withholds that protection from the underlying data or materials themselves, so Dominican law confers a compilation-copyright model rather than a sui generis database right.

Article 1 sets the principles and general guidelines for financial intermediation entities and for the administrators and participants of the Payment and Securities Settlement System (SIPARD). Article 3 applies the Regulation to multiple banks, savings and credit banks, credit corporations, savings and loan associations, public financial intermediation entities, SIPARD administrators and SIPARD participants.

The sole paragraph of article 3 extends the Regulation to the support and related services entities linked to SIPARD by an electronic connection or an exchange of essential information. Article 16 requires the covered entities to implement and maintain a general policy or several policies for the management of cybersecurity and information security and to make them known to their staff.

Article 31 requires the covered entities to establish policies and procedures for the management of cybersecurity and information-security incidents in order to identify, respond to, remediate and document them. Article 41 requires the covered entities to establish internal audit processes to ensure effective supervision of the cybersecurity and information security program.

Article 52 creates, under the administrative dependence of the Banco Central, a Computer Security Incident Response Team for the financial sector. Article 59 provides that financial intermediation entities that infringe the Regulation are liable to the sanctions of the Ley Monetaria y Financiera and the Reglamento de Sanciones.

Article 60 allows the Banco Central to suspend temporarily the participation in SIPARD of an administrator, participant or interconnected support entity that fails to comply with the Regulation. Article 62 gives the covered entities one year from the Regulation's entry into force to adjust to it. The Junta Monetaria issued its Second Resolution of 1 November 2018 on the Regulation.

Article 34 makes lawful the reproduction, distribution, and communication to the public of the news of the day, or other information about newsworthy facts and events, once they have already been publicly disseminated by the press or by broadcasting; a paragraph extends this to reproducing and making available, in connection with reporting on a current event, works seen or heard in the course of that event, to the extent justified by the informational purpose.

Article 33, as replaced by Article 37 of Law No. 424-06, permits the press to reproduce, and broadcasting or transmission by wire to the public to carry, current-affairs articles of economic, political, or religious discussion published in newspapers or periodicals, and broadcast works of the same character, where the reproduction, broadcast, or transmission has not been expressly reserved, and it requires the source always to be clearly indicated.

A paragraph of Article 33 also lets works that are to be seen or heard in the course of a current event be reproduced and made accessible to the public, to the extent the informational purpose justifies, when the event is reported by photography, cinematography, broadcasting, or transmission by wire. Law No. 424-06 took effect together with the Dominican Republic-Central America-United States Free Trade Agreement. That Agreement took effect for the Dominican Republic on 1 March 2007.

Article 35 permits publishing, as current news and without authorization, speeches delivered in deliberative assemblies, judicial debates, or before public authorities, and public conferences, speeches, or sermons whose rights have not been expressly reserved, though such works may not be published in a separate collection without the author's authorization.