Ley No. 172-13 sobre Protección Integral de los Datos Personales, supervision, administrative sanctions, and offences

Article 29 places the archives, registers, and databanks that provide credit reports under the inspection and oversight of the Superintendencia de Bancos as the law's control body, empowering it to assist and advise individuals about their rights and to impose the administrative sanctions the law allows.

Article 81 makes the Superintendencia de Bancos the competent body to sanction a Sociedad de Información Crediticia for administrative infractions, listed as including a prohibited disclosure in a credit report, refusing a data subject access to their credit information, unreasonably denying a review or rectification request, or refusing to modify or cancel information after a favorable ruling for the data subject, punishable by a fine of ten to one hundred times the minimum wage or, for failing to begin operations within six months of authorization, revocation of the bureau's operating permit.

Article 84 fines with ten to fifty times the minimum wage a person who knowingly inserts false data into a file, knowingly supplies false information to a third party, accesses a personal databank unlawfully or by breaching its confidentiality and security systems, or discloses information they were legally bound to keep secret, without prejudice to the person's right to recover damages for the violation of their privacy right under ordinary civil law.

Article 16 separately gives anyone harmed by a violation of the law the right to be indemnified under ordinary civil law. Article 88 punishes any violation of the law's provisions, and the unauthorized disclosure, publication, reproduction, transmission, or recording of a credit report, with six months to two years of correctional imprisonment and a fine of one hundred to one hundred fifty times the minimum wage.

Article 86 punishes fraudulently consulting a consumer's personal information without their authorization with a fine of ten to fifty times the minimum wage, rising to correctional imprisonment of six months to two years where the access served to commit an offence, and article 87 punishes fraudulently accessing a Sociedad de Información Crediticia's database using credentials that are not the offender's own with a fine of twenty to one hundred times the minimum wage, similarly rising to imprisonment where the access served to commit an offence.