Costa Rica Data Protection & Privacy Regulation

Lawful Processing & Special Data

Prodhab's Resolution No. 029-2026-RF is reported to have found that biometric data generated by the Supreme Electoral Tribunal's Identity Verification System qualifies as sensitive data under Law No. 8968, notwithstanding that biometric data is not expressly enumerated as a sensitive category within the statute's own text. The ruling is further reported to have found that commercial exploitation of that biometric data beyond its original electoral purpose breaches the purpose-limitation principle embedded in the lawful-processing framework. The Electoral Tribunal has filed a reconsideration appeal against the resolution, and the outcome remains unresolved.

The significance of this development lies in its interpretive method rather than in any legislative change: Law No. 8968 does not itself name biometric data among its enumerated special categories, so the resolution extends the statute's special-category protection by regulatory interpretation of the term sensitive data rather than by amendment. This is reported to be understood as a notable precedent for how special-category data is construed under Costa Rican law, though its durability is uncertain while the Electoral Tribunal's appeal is pending. Should the appeal succeed, the sensitive-data classification applied to this category of biometric data could be narrowed or reversed; should it fail, the interpretive extension stands as governing precedent for future assessments of what counts as sensitive data under the statute.

Outlook

The Electoral Tribunal's reconsideration appeal against Resolution 029-2026-RF is the central unresolved question for this area, with an expected resolution window reported in the second half of 2026, though the specific timing carries meaningful uncertainty. Organisations processing biometric data of Costa Rican data subjects outside the specific electoral context at issue in the ruling should treat the current sensitive-data classification as provisional pending the appeal's outcome, rather than as fully settled interpretive law.

Algorithmic, Biometric & Surveillance Governance

The dominant development in this area remains Prodhab's Resolution No. 029-2026-RF, which found that biometric data generated by the Supreme Electoral Tribunal's Identity Verification System is sensitive data under Law No. 8968 and that its commercial exploitation beyond the electoral purpose for which it was collected breaches the purpose-limitation principle. Prodhab is reported to have ordered the Electoral Tribunal to cease commercialising the biometric data and to cancel the Civil Registry database's Prodhab inscription. The Tribunal has filed a reconsideration appeal, and the outcome remains unresolved. This is understood to be a significant precedent for biometric surveillance governance in Costa Rica, though its durability is uncertain pending the appeal.

Separately, a private, non-governmental legislative proposal from an organisation referred to as CBIAT, put forward on 27 September 2026, is reported to comprise eight bills addressing artificial intelligence, blockchain, and digital-asset governance, including identity and privacy protections alongside AI risk-governance provisions. This proposal has no confirmed legislative sponsor and has not yet been introduced before the Legislative Assembly, so it should be treated as a forward-looking and currently speculative development rather than as an active legislative process. Its relevance to algorithmic and surveillance governance lies in its reported inclusion of AI risk-assessment provisions, though the proposal's non-governmental and unsponsored status means it carries materially lower weight than the Prodhab ruling discussed above.

Outlook

The Electoral Tribunal's reconsideration appeal against Resolution 029-2026-RF remains the primary matter to watch, with resolution anticipated within the second half of 2026 on current indications, carrying meaningful timing uncertainty. Separately, whether the CBIAT proposal attracts a legislative sponsor and advances toward formal introduction in the Legislative Assembly is a secondary signal worth monitoring, though it remains speculative at this stage and should not be treated as an active or binding development.

Algorithmic, Biometric & Surveillance Governance

Costa Rica's first significant biometric-governance precedent has emerged from a dispute between its data-protection authority and its electoral tribunal. Prodhab's Resolution 029-2026-RF found that the Tribunal Supremo de Elecciones' VID biometric-identification system processed fingerprint and photograph data unlawfully, absent express consent, and ordered cancellation of the Civil Registry database's Prodhab registration as a consequence. This is, on the record available, the first instance of Prodhab classifying biometric data as sensitive and taking a cancellation-level enforcement action against a major public-sector data holder over the practice.

The TSE has not accepted this finding. It has announced a recurso de revocatoria, a reconsideration appeal, against the resolution, and has separately asserted, citing a 2008 Constitutional Chamber ruling (vote 2008-16852), that data available through its civil-registry web query are of a public nature with unrestricted access. This is a direct doctrinal confrontation: Prodhab's 2026 position treats TSE-held biometric identifiers as sensitive data requiring consent, while the TSE's 2008-grounded constitutional position treats the same category of civil-registry data as inherently public. The TSE has also warned of possible effects on public services arising from the resolution, suggesting the practical stakes extend beyond the immediate biometric-classification question into the operational function of Costa Rica's civil-registry and electoral-identification infrastructure.

Separately, and on a smaller scale, a private draft bill associated with CBIAT proposes algorithmic-governance requirements for AI and robotic systems operating in Costa Rica, including a minimum "Estándar de Dignidad" score of 7.0 out of 10.0 with no individual criterion below 5.0 out of 10.0, and is reported to include a human-operable kill-switch requirement. As a private, unsponsored draft not yet introduced as a numbered legislative expediente, its path to enactment is uncertain and should not be read as an imminent regulatory development.

Outlook

The resolution of the TSE's appeal against Resolution 029-2026-RF will be the central determinant of Costa Rica's practical approach to biometric data governance going forward, given the direct conflict between Prodhab's sensitive-data finding and the TSE's public-data position. Until that appeal resolves, the registration-cancellation sanction's practical effect, and the broader question of whether biometric identifiers are treated as sensitive data across the Costa Rican public sector, remain open. The CBIAT draft bill remains unfiled and its prospects for formal introduction into the Legislative Assembly are unconfirmed.

Enforcement & Redress

Two enforcement threads are active before Prodhab, and neither has reached resolution. The first concerns Resolution No. 029-2026-RF, under which Prodhab is reported to have ordered the Supreme Electoral Tribunal to cease commercialising biometric data from its Identity Verification System and to cancel the Civil Registry database's Prodhab inscription; the Tribunal has filed a reconsideration appeal, and the outcome is unresolved. The second concerns three open investigative files, reported to have been opened in September 2026, into an alleged dark-web exposure of Costa Ricans' personal data, with no resolution reported to date.

On the question of available sanctions, Prodhab is reported, via secondary commentary, to be empowered to impose graduated fines of up to thirty base salaries, equivalent to roughly USD 30,500, together with database suspension of between one and six months for the gravest infractions under Law No. 8968. This penalty-scale information rests on secondary reporting rather than on independently re-verified primary statutory text, so the specific figures should be treated as indicative of the regime's general severity rather than as confirmed to the cent. Neither of the two active enforcement matters has yet resulted in a disclosed penalty under this scale; both remain at the investigative or appeal stage.

Outlook

The outcomes of the Electoral Tribunal's appeal and of the three dark-web investigative files are the two matters to watch for actual application of Prodhab's enforcement powers. Should either matter conclude with a formal sanction, that would be the first concrete test of the penalty framework described above as applied to a live case, providing a clearer picture of how Prodhab's stated enforcement powers translate into practice.

Enforcement & Redress

Prodhab opened an ex officio administrative investigation, expediente No. 425-09-2026, on 16 September 2026, following a dark-web claim describing a database containing more than 400 million lines of Costa Rican residents' personal data. Prodhab subsequently confirmed that it holds three related open expedientes connected to this matter. As of the most recent reporting, spanning 7 to 18 October 2026, the investigation remained active and unresolved, and is reportedly being pursued on parallel administrative and criminal tracks, indicating that the exposure is being treated as a matter potentially involving criminal as well as regulatory liability.

This is the most significant enforcement-and-redress development for Costa Rica this cycle, both for its scale, over 400 million lines of data claimed exposed, and for its apparent connection to the credit and financial data sector, since commentary following the leak specifically addressed credit bureaus' registration and breach-notification obligations under Ley 8968. The investigation's eventual outcome, whether it results in sanctions, a public resolution, or a finding of no violation, has not yet been reported and remains open.

As standing context, Ley 8968 tiers infractions into three severity levels, with the most serious, classified as gravisimas, carrying fines of up to 30 base salaries alongside the possible suspension of the offending database's Prodhab registration. This penalty structure predates the current cycle and is unchanged, but it is the framework against which any eventual sanction arising from expediente 425-09-2026 would be assessed, should Prodhab conclude the investigation with a finding of infraction.

Outlook

The outcome of expediente 425-09-2026, and the three related open expedientes Prodhab has confirmed, is the central enforcement item to watch. Given the scale of the alleged exposure and the parallel administrative and criminal tracks reportedly being pursued, any resolution, sanction, or further procedural development would be a significant data-protection enforcement event for Costa Rica. No resolution had been reported as of the most recent information available this cycle, and the matter remains open.

Enforcement & Redress

Prodhab's Resolution N.° 029-2026-RF is the most significant enforcement action identified in Costa Rica this cycle, and arguably one of the more significant in the authority's history given its target. The resolution found the Tribunal Supremo de Elecciones' VID biometric-identification practice unlawful absent express consent, classified fingerprint and photograph data as sensitive personal data, and ordered cancellation of the Civil Registry database's registration with Prodhab. The TSE has announced it will file a recurso de revocatoria against the resolution and has warned of possible effects on public services, meaning the practical enforceability of the sanction, including whether the registration cancellation takes effect, remains unresolved pending that appeal.

This action should be read against the backdrop of Costa Rica's existing redress architecture under Ley 8968. Data subjects exercise rights first against the responsible party directly; only where that party fails to respond, or the data subject remains dissatisfied, does escalation to Prodhab become available as a secondary route. Separately, article 28 of the law vests Prodhab with supervisory, registration, inspection, complaint-resolution, corrective-order and sanctioning powers, the same powers invoked in the TSE resolution. Civil-society commentary, albeit resting on a single, lower-tier source, suggests that Prodhab's broader caseload management is strained: the authority reportedly receives a high volume of complaints and lacks clear control over case-resolution time, with some cases taking over a year to resolve.

The TSE matter is therefore both an enforcement escalation, cancellation of a registration being among Prodhab's more severe available sanctions, and a test of Prodhab's institutional capacity to enforce findings against another constitutionally significant public body that disputes both the factual premise and the legal basis of the finding.

Outlook

The outcome of the TSE's recurso de revocatoria will determine whether Resolution 029-2026-RF stands, is modified, or is overturned, and will be the clearest available indicator of how enforceable Prodhab's sanctioning powers are against a major public-sector counterpart. No confirmed timeline for resolution of the appeal was identified this cycle. Separately, concerns about Prodhab's general case-resolution capacity, while resting on thinner sourcing, suggest that even a favourable outcome for Prodhab in this matter may not translate into swift broader enforcement capacity across its full complaint caseload.