The right to self-determination or right to data protection allows anyone to control the flow of their personal information and decide how they want it to be used, for what purposes, who can access it and how it can be shared.

This is not a new right in Costa Rica, the Constitutional Court had recognized and protected it since the 90s.

Protecting citizens' data

The Law and the Data Protection Regulation guarantee to all people, regardless of their nationality, residence or domicile, respect for their fundamental rights, that is, their right to self-determination in relation to their life or private activity and other personality rights, as well as the defense of their freedom.

The law applies in Costa Rica for personal data contained in automated or manual databases, from public or private organizations.

There are some terms covered by the law, which give us a better understanding of the regulation:

  • Personal data of unrestricted access: contained in public databases of general access.
  • Personal data of restricted access: those that even forming part of registries of public access, are not of unrestricted access for being of interest only for its holder.
  • Sensitive data: personal or private information about the person, such as religion, sexual preference and marital status.

Collecting personal data

The law and regulations establish that when a person is asked for personal data, it is necessary to inform him/her different aspects, so the person is aware of the use that will be given to that information:

  • The purposes for which the data is collected
  • The treatment that the data will receive
  • The destination of the data

In an upcoming article, we will talk about the amendments to the Regulation of the Personal Data Protection Law which addresses topics related to internal databases and data transfers, among other aspects.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.