Costa Rica’s data protection framework, principally established under Law No. 8968, the Law on the Protection of Persons against the Processing of their Personal Data, recognizes a series of rights concerning the access, correction, and updating of information contained in databases. Although these rights are fundamentally designed to protect individuals and their personal information, an interesting practical question arises as to whether a legal entity may also request the access, correction, or updating of information concerning the company, which is kept in a third-party’s database.
The statutory framework generally defines personal data by reference to information concerning an identified or identifiable individual. Accordingly, information relating exclusively to a company or other legal entity would not, strictly speaking, constitute “personal data” in the conventional sense contemplated by the legislation. Nevertheless, there are circumstances in which information concerning a legal entity is collected, stored, processed and/or disseminated/commercialized by private databases, and subsequently used by third parties in making decisions that may have significant consequences for the company, its employees, or its commercial relationships.
A recent case illustrates this issue. A company discovered that its employees were having their credit applications rejected because a database consulted by financial institutions incorrectly reported that the company employing them was not registered with the Mercantile Section of Costa Rica’s National Registry. A review of the relevant registry records and entries confirmed that the company was, in fact, duly registered.
Based on a certification issued by the Mercantile Registry, the company contacted the operator responsible for the database and requested the correction of the inaccurate information. The database operator accepted the formal request based on the supporting documentation and proceeded to rectify the company’s information. In addition, relying on the right to access information, a request was made for a complete copy of the information maintained within the database concerning the company. The database operator also provided that information, notwithstanding the fact that the company was a legal entity rather than an individual.
This case is particularly relevant because it illustrates a practical application that may extend beyond the strict definition of personal data. While Law No. 8968 and its regulations primarily address information relating to individuals, this case demonstrates that companies may, at least under certain circumstances, obtain the practical benefit of rights traditionally associated with personal data protection.
From a compliance and risk-management perspective, this also highlights the importance for companies of monitoring third-party databases that collect or disseminate corporate information. Inaccurate information regarding a company’s legal existence, registration status, ownership, corporate ID, domicile, or other corporate data, may affect its employees, customers, suppliers, financing opportunities, and commercial relationships.
Accordingly, even where the statutory characterization of corporate information as “personal data” may be subject to discussion, a company whose information is inaccurately or incorrectly maintained or processed by a third-party database may have reasonable grounds to request access to such information, and seek its correction or updating, particularly when the database operator uses that information for purposes that may affect the company or third parties. The recent case described above provides a useful practical example of how these principles and rights can operate in Costa Rica.