They threw out the files with your data: how the law requires destroying them

It is the law regulating how files with consumers’ personal information are destroyed in Puerto Rico (10 L.P.R.A. §§ 4181-4188). It came from a concrete concern the statement of motives describes: the uncertainty about the fate of files with personal information when commercial entities abandon them, whether by ceasing operations or simply no longer needing them, and the identity-theft risk that creates. A "personal information file" is a tangible or intangible record containing a consumer’s personal information, and a "commercial entity" is a natural or juridical person normally or occasionally engaged in commerce.

Any consumer whose personal information is in a commercial entity’s files in Puerto Rico. The law defines "personal information" broadly: any information that identifies, relates to, describes or can be associated with a particular person, including name or first initial and surname; Social Security number; physical characteristics or descriptions; residential or postal address; phone number; passport number; driver’s license or other official identification number; insurance policy number; education; employment; employment history; medical or health policy information; tax information; employment evaluations; biometric data; bank or financial account numbers of any kind, with or without access keys; credit or debit card numbers or other financial information; usernames and passwords to computer systems; and data from motor vehicle "black box" event data recorders. It does not include information disclosed to the general public under any state or federal law.

• That it is a commercial entity: a natural or juridical person normally or occasionally engaged in commerce.Verified against the official source
• That the discarded files contain consumers’ personal information as the law defines it.Verified against the official source

• Evidence of the improper disposal: photos of the documents found, the place and date, and which entity they came from.
• If you are the affected consumer, any record showing your information was in those files.

1. 1

   Step 1: Know the method the law requires

   Throwing the papers out is not enough. Every commercial entity that owns, holds or controls files with personal information must, before discarding them, do so or arrange for their disposal through shredding, deletion or modification so that the personal information cannot be read or deciphered by any method. That last phrase is the standard: unreadable and undecipherable, not merely discarded.

2. 2

   Step 2: Note that digital also counts

   Where consumers’ personal information is in digital rather than printed form, the commercial entity must ensure its disposal meets the parameters set in this law or in any other applicable law or regulation. A discarded hard drive, a sold computer or a decommissioned server falls under the same duty as a paper file.

3. 3

   Step 3: Remember that closing the business does not erase the duty

   The law says it expressly: every commercial entity that ceases operations, merges or consolidates with another commercial entity must comply with this law when disposing of consumers’ personal information. That was precisely the concern that motivated the law — the files abandoned when a company closes.

4. 4

   Step 4: Know the notarial act and who is exempt

   The destruction procedure must be recorded before a notary through a notarial act, and a certified copy of that act must be kept by the commercial entity for inspection for a minimum term of ten (10) years. But there is a size exception: that requirement does not apply to commercial entities with twenty-five (25) employees or fewer and gross income under three (3) million dollars. Mind the "and": those are two conditions at once, not one or the other.

5. 5

   Step 5: Take the complaint to DACO and keep your damages action

   The Department of Consumer Affairs may issue a regulation to carry out this law’s purposes, though its adoption is not jurisdictional: the law has been in force since its approval, regulation or no regulation. The fines the DACO Secretary may impose under Act 5-1973 for each violation of this law or its regulation do not affect consumers’ rights to bring actions or damage claims before a competent court. That is, fining the business does not consume your claim.

The Department of Consumer Affairs is the agency empowered to regulate and fine under this law, relying on the powers of Act 5-1973. The damages route before a competent court remains open in parallel. If, beyond improper disposal, there was a breach with third-party access, that is a different law and a different clock: the breach notification of Act 111-2005, covered in its own guide.

• Believing it is enough to throw out or recycle the documents: the standard is that the information cannot be read or deciphered by any method.
• Thinking it only applies to paper: the law expressly covers information in digital form.
• Assuming the duty disappears when the business closes: ceasing operations, merging or consolidating is expressly covered.
• Reading the notarial exemption as one condition: it is 25 employees or fewer AND under $3 million in gross income.
• Not keeping the certified copy of the act: the minimum is ten (10) years for inspection.
• Believing address or phone do not count: unlike Act 111-2005, here the definition of personal information includes them.
• Thinking DACO’s fine replaces your claim: the law expressly says it does not affect your right to claim damages in court.
• Confusing this law with the breach notification one: one regulates destruction, the other notice after a leak.

These are the government pages this guide is based on.

• Departamento de Asuntos del Consumidor (DACO)

  DACO

  bvirtualogp.pr.gov

• DACO services

  DACO

  www.daco.pr.gov