Informed Consent is a legal requirement included within the Costa Rican Data Protection Law Number 8968 (denominated “Law for the Protection of People Against the Treatment of their Personal Data”) when collecting and/or processing personal data. In order to be able to collect, and/or processing or treating personal data in Costa Rica, the data subject’s informed consent needs to be previously obtained.

In all cases, the collected or processed personal data belongs to the data subject. For such reason, an informed consent must be obtained and granted in order to protect the person’s right to informative self-determination, i.e. a person’s right to be ensured that its personal data is being treated legitimately, for the authorized purposes, and also to acknowledge and control the use and transfer of their personal data. Obtaining the informed consent from the data subject implies acquiring the express, written and previous consent and authorization from the data subject for the use and processing of their personal data.

When the informed consent from the data subject is duly obtained, they are not only granting their express consent for the use and treatment of their personal data, but also acknowledge and confirm of being formally, fully, expressly, precisely and unequivocally informed according to applicable law, of the rights and information directly related with their data being collected or processed. For example, as part of the informed consent, the data subject has to be informed of the existence of a database, the existence of personal data rights that by law protect them as a data subject, the treatment and use to be given to their collected data and for which specific purposes, who is collecting or processing their personal data and the contact information of such individual/entity, etc.

Obtaining the informed consent from data subjects requires to comply with certain procedures following specific formalities, contents, details and requirements as established by applicable Costa Rican law. For example, informed consent may be granted either through a physical document or electronic media, as an independent and separate instrument.

There are certain specific cases in which obtaining an informed consent is not necessary. For example, consent is not required when data is obtained from publicly available sources of unrestricted access, such as any public registry or public agency. Notwithstanding the above, it is always necessary to be absolutely positive that the informed consent is not necessary for each specific case of data collection or processing. The breach of the requirement to obtain the data subject’s informed consent, when applicable, will be considered as a major breach to the above indicated law.

Let our experienced Costa Rican attorneys guide in the evaluation of the specific consents needed and the established of informed concerned requirement for full compliance of Costa Rican law.