Guatemala

Decreto 57-2008 is principally a freedom-of-information statute, but article 9 defines datos personales as any information concerning an identified or identifiable natural person and datos sensibles as data touching a person's racial or ethnic origin, political ideology, religious belief, health, sexual life, or other intimate matters.

Article 31 bars an obligated entity from disseminating, distributing, or commercializing personal data held in its information systems without the data subject's express written consent, and expressly and absolutely prohibits commercializing sensitive data by any means.

Article 32 lists narrow exceptions to the consent requirement, including statistical, scientific, or general-interest purposes where the data cannot be linked back to the individual, and transmission between obligated public entities for the exercise of their duties.

Article 64 makes it a crime, punishable by five to eight years' imprisonment and a fine of fifty thousand to one hundred thousand quetzales, for anyone to commercialize or distribute personal data or sensitive personal data protected by the law without the titleholder's express written authorization, where the data does not come from public registries, without prejudice to civil liability for resulting damages.

Article 65 similarly punishes unauthorized alteration or destruction of personal data held in a public institution's files or electronic records with the same penalty range.

Article 31 gives every person the right to know what information state files, records, or any other form of state registry holds about them, the purpose for which that information is used, and the right to its correction, rectification, and updating. The article separately bars records or files of political affiliation, except those the electoral authorities and political parties themselves keep.

The right reaches only archivos and registros estatales, the state's own records, so it does not on its own terms bind a private-sector data controller.

Articles 274 'A' through 274 'G' were added to the Código Penal by Decreto 33-96 and punish seven distinct computer-related acts. Article 274 'A' punishes destroying, erasing, or otherwise rendering useless computer records, with the penalty raised by a third when the information is necessary for a public service or is an official record. Article 274 'B' punishes altering, erasing, or rendering useless the instructions or programs computers use.

Article 274 'C' punishes copying or reproducing computer instructions or programs without the author's authorization. Article 274 'D' punishes creating a data bank or computerized record with data that could affect a person's privacy. Article 274 'E' punishes using computerized records or programs to hide, alter, or distort information required for a commercial activity, a duty to the State, or a person's financial statements.

Article 274 'F', the provision closest to a general unauthorized-access offense, punishes using another's computerized records without authorization, or entering, by any means, their data bank or electronic archives without authorization; it does not on its own terms require defeating a technical security measure. Article 274 'G' punishes distributing or circulating destructive programs or instructions capable of harming computerized records, programs, or equipment.

Article 16(b) protects anthologies, dictionaries, compilations, databases and similar works as derivative works, without prejudice to the copyright in the underlying original works, where the selection or arrangement of the material is itself an original creation.

Article 35 confirms that compilations or databases, whether machine-readable or in any other form, are protected as collections of works under the statute, but that protection does not extend to the data or material contained in the compilation, and does not prejudge any copyright existing in that material.

Articles 133 quinquies and 133 sexties, added by Decreto 11-2006, prohibit circumventing an effective technological measure that controls access to a protected work and manufacturing or trafficking in circumvention devices or services, subject to enumerated lawful exceptions.

Article 25 states that copyright protection does not apply to the informational content of current news published by any medium, but does apply to the text and the graphic representations in which that news appears.

Article 66 permits, without the rightsholder's authorization or payment, but with an obligation to name the source and the author if indicated, reproducing and distributing, by press, broadcast, or cable, newspaper or periodical articles on current economic, political, or religious topics that carry no specific reservation of rights.

The same article also permits reproducing and making available to the public, on the occasion of reporting a current event, fragments of works seen or heard in the course of that event, to the extent the informational purpose justifies, and permits communicating to the public, for informational purposes about current events, political or judicial speeches and similar works delivered publicly, while the speaker keeps the exclusive right to publish them for other purposes.

It further permits including fragments of another's already-divulged written, sound, audiovisual, or plastic-arts work in one's own work by way of citation or for analysis, for teaching or research purposes.