McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
Business Home → Products & Solutions → Data Protection → US & Global Data Protection Laws → Security Breach Notification Laws

Puerto Rico

Citizen Information on Data Banks Security Act
CITATION 10 Laws of Puerto Rico § 4051 et. seq.
ENACTED 2008
SUMMARY The law applies to a ‘violation of the security system’ which means any situation in which it is detected that access has been permitted to unauthorized persons or entities to the data files so that the security, confidentiality or integrity of the information in the data bank has been compromised; or when normally authorized persons or entities have had access and it is known or there is reasonable suspicion that they have violated the professional confidentiality or obtained authorization under false representation with the intention of making illegal use of the information. This includes both access to the data banks through the system and physical access to the recording media that contain the same and any removal or undue retrieval of the recording.
DATA COVERED

The law covers a ‘personal information file’ which contains at least the name or first initial and the surname of a person, together with any of the following data so that an association may be established between certain information with another and in which the information is legible enough so that in order to access it there is no need to use a special cryptographic code:

  1. Social Security number;
  2. Driver’s license number, voter’s identification or other official identification;
  3. Bank or financial account numbers of any type with or without passwords or access code that may have been assigned;
  4. Names of users and passwords or access codes to public or private information systems;
  5. Medical information protected by the HIPAA;
  6. Tax information; and
  7. Work-related evaluations.
INDUSTRY Any state agency or person that owns or licenses computerized data that includes PI or maintains such data for commercial use that includes personal information of citizens who resides in Puerto Rico.
PENALTIES The Attorney General may impose fines from four hundred dollars ($400) up to a maximum of five thousand dollars ($5,000) for each violation.
United States - English