Codigo Penal, articulo 196 bis, Violacion de datos personales
Codigo Penal (Ley No. 4573), art. 196 bis, segun reforma por Ley No. 9048
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force.
An enforcement supervision rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Do not appropriate, copy, transmit, publish, or otherwise give unauthorized treatment to a person's data or images without their authorization, since doing so for one's own or a third party's benefit, to the danger or harm of that person's privacy, is a criminal offense.
- Treat data revealing ideology, religion, health, racial origin, or sexual orientation, and data belonging to a minor, with particular care, since unauthorized handling of those categories carries an aggravated penalty.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Imprisonment of three to six years, rising to four to eight years when committed by a person with system-administration access, when the data are public or in a public database, when the victim is a minor or incapacitated, or when the data reveal ideology, religion, beliefs, health, racial origin, sexual preference, or sex life (Codigo Penal art. 196 bis).
What it reaches
Obligation class
Prohibition
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 196 bis of the Codigo Penal, added by Ley No. 9048, punishes with three to six years of imprisonment a person who, for their own benefit or a third party's, and to the danger or harm of another's privacy, without the data subject's authorization, appropriates, modifies, interferes with, accesses, copies, transmits, publishes, disseminates, compiles, disables, intercepts, retains, sells, buys, diverts to a different purpose than the one for which the data were collected, or otherwise gives unauthorized treatment to the images or data of a natural or legal person stored in a computer or telematic system or in an electronic, optical or magnetic container.
The penalty rises to four to eight years when the conduct is committed by a person who administers or supports the system or has access to it by reason of their duties, when the data are public or held in a public database, when the victim is a minor or an incapacitated person, or when the conduct affects data revealing ideology, religion, beliefs, health, racial origin, sexual preference, or sex life.
The Legislative Assembly approved Ley No. 9048 on 7 June 2012 and the President signed it on 10 July 2012; the pgrweb consolidated text states it takes effect on publication without itself stating that publication date.
When LexLint raises it
crawls_webtrains_modelsautomated_outreach
Read the law
Consolidated Codigo Penal text as reformed by Ley No. 9048
Sistema Costarricense de Informacion Juridica (SCIJ), Procuraduria General de la Republica