Costa Rica

Article 1 makes the law's object guaranteeing any person, regardless of nationality, residence or domicile, their right to informational self-determination over their private life; article 2 applies it to personal data in any automated or manual database of a public or private body, excluding a database kept for exclusively internal, personal or domestic purposes that is never sold or commercialized.

Article 5 requires a data controller to inform a person before collecting their data and to obtain their express, written consent, revocable without retroactive effect, unless the data are publicly accessible or the disclosure is compelled by judicial order or law.

Article 9 prohibits processing data revealing racial or ethnic origin, political opinions, religious or philosophical convictions, health, life, or sexual orientation, subject to narrow exceptions such as the data subject's own public disclosure or vital-interest necessity. Article 10 requires the controller to adopt technical and organizational security measures. Article 14 conditions any transfer of the data on the data subject's express, valid authorization.

The Prodhab, created by article 15 as an agency attached to the Ministry of Justice and Peace, enforces the law through a complaint procedure (arts. 24-27) and a tiered sanction scale of administrative fines set in multiples of the base salary of a first-level judicial aide, running from up to five base salaries for a minor infraction to fifteen to thirty base salaries plus a suspension of the database's operation of one to six months for the most serious infraction.

A public-sector controller instead receives a corrective resolution rather than a fine. The law itself imposes no criminal penalty and refers conduct that may constitute a crime to the Public Prosecutor's Office. A separate Codigo Penal provision, article 196 bis, carries the criminal exposure for the same underlying conduct. The Legislative Assembly signed the law on 7 July 2011, and it enters into force on its publication; the consolidated SCIJ text does not itself state that publication date.

Article 196 bis of the Codigo Penal, added by Ley No. 9048, punishes with three to six years of imprisonment a person who, for their own benefit or a third party's, and to the danger or harm of another's privacy, without the data subject's authorization, appropriates, modifies, interferes with, accesses, copies, transmits, publishes, disseminates, compiles, disables, intercepts, retains, sells, buys, diverts to a different purpose than the one for which the data were collected, or otherwise gives unauthorized treatment to the images or data of a natural or legal person stored in a computer or telematic system or in an electronic, optical or magnetic container.

The penalty rises to four to eight years when the conduct is committed by a person who administers or supports the system or has access to it by reason of their duties, when the data are public or held in a public database, when the victim is a minor or an incapacitated person, or when the conduct affects data revealing ideology, religion, beliefs, health, racial origin, sexual preference, or sex life.

The Legislative Assembly approved Ley No. 9048 on 7 June 2012 and the President signed it on 10 July 2012; the pgrweb consolidated text states it takes effect on publication without itself stating that publication date.

Article 231, added by Ley No. 9048, punishes with three to six years of imprisonment a person who, without the authorization of the owner or the party responsible, and by means of any computerized or technological manipulation, appropriates, transmits, copies, modifies, destroys, uses, blocks, or recycles information of value to the economic traffic of industry and commerce.

The offense's trigger is the absence of authorization from the system's owner or responsible party rather than the circumvention of a specific technical access control, so a plain reading leaves open whether reading a page an operator has made publicly and unauthenticated available is conduct the owner has thereby authorized.

The Legislative Assembly approved Ley No. 9048 on 7 June 2012 and the President signed it on 10 July 2012; the pgrweb consolidated text states it takes effect on publication without itself stating that publication date.

Article 8, as amended by Ley No. 7397 of 3 May 1994, states that databases are protected as compilations.

Costa Rican law therefore gives a database no sui generis right of the kind the EU Database Directive creates for the producer's investment; protection instead follows the ordinary compilation-copyright standard, so only a database whose selection or arrangement is itself an original intellectual creation is protected, and only against reproduction of that original selection or arrangement, not against extraction of the underlying data as such. No text-and-data-mining exception exists in Costa Rican copyright law.

Article 67, in its text as reformed by Ley No. 7979 of 6 January 2000, excludes news of a strictly informational press character from copyright protection outright, though the outlet that reproduces or retransmits it must state the original source. Article 68 separately lets current-events articles published in magazines or newspapers be reproduced, unless expressly prohibited, provided the source is cited in every case.

Article 69 lets speeches given at public assemblies or meetings, and court pleadings, be published in the press, radio, or periodic television without authorization, though not in a separate printed work or a collection without the author's permission.

Article 70 permits quoting an author, transcribing the pertinent passages, provided they are not so numerous and continuous that the quotation could be considered a simulated and substantial reproduction to the detriment of the original work's author.

None of the four provisions caps its reach at a headline-length or short-extract threshold or confines it to the traditional press; whether article 68's reproduction right or article 70's quotation right reaches a systematic aggregator's reproduction of headlines and snippets, as opposed to a single reproduction or a traditional press review, has not been tested in a reported Costa Rican decision.

Costa Rica has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright law, and no located case law on hyperlinking or framed display.