Personal data when you buy: they cannot require it to complete the sale

It is a consumer privacy law. Its statement of motives describes precisely the scene it set out to stop: when a transaction is carried out to acquire goods and paid by card, the consumer is often required to write personal information on the receipt — phone number, driver’s licence number or other private information — so that a receipt document ends up carrying not only the card information but the citizen’s private and personal information, left unguarded and liable to be handled by many people with no administrative control. The law starts from Article II, Section 8 of the Puerto Rico Constitution, which protects against abusive attacks on honor, reputation and private or family life.

Any consumer in Puerto Rico. The obligation falls on the commercial establishment, which the law defines broadly: **any natural or legal person offering for sale, rental, exchange or transfer any kind of goods or services in the commerce of persons**. There is no prior procedure or registration requirement to invoke this protection.

• Carrying out a commercial transaction at an establishment doing business in Puerto Rico, where the personal information is asked of you as a **requirement to complete** that transaction. That is the trigger of the prohibition.Verified against the official source
• The prohibition applies independently of the payment method chosen. You need not have paid by card to invoke it.Verified against the official source

• The receipt, and any form you were asked to fill in. The statement of motives describes the receipt as the place where personal information ends up recorded, so it is the natural evidence of the practice.

1. 1

   Step 1: The rule and its reach

   Article 1 begins: **every commercial establishment doing business in Puerto Rico is prohibited from gathering or collecting consumers’ personal information when carrying out a commercial transaction as a requirement to complete the commercial transaction, independently of the payment method the consumer chooses**. Two parts do the work. "As a requirement to complete the transaction" is the trigger: the law does not prohibit their asking, it prohibits their conditioning the sale on your answering. And "independently of the payment method" closes the escape hatch of saying the rule applies only to cards: it applies however you pay.

2. 2

   Step 2: The ID yes, the data no

   The second sentence of Article 1 is the one to cite at the counter: **in the case of electronic payments by debit or credit card, the merchant may ask the consumer for an identification card only for the purpose of verifying their identity in order to complete the transaction**. The word setting the limit is "only": the ID is requested **to verify you are who the card says**, and showing it suffices for that. In that sentence the law does not authorize copying, recording or keeping that ID’s data, and Article 2 expressly places the driver’s licence number and the passport number among the information subject to the limitation.

3. 3

   Step 3: The list of what is protected

   Article 2 lists which consumer information falls under the Article 1 limitation: **social security number, the citizen’s physical characteristics or descriptions, postal or residential address, phone number, passport number, driver’s licence number, electoral ID number or any other personal or official information**. The list ends open — "any other personal or official information" — so it is not a closed enumeration. And Article 3 attaches the legal label: **non-compliance with the provisions of Articles 1 and 2 of this Act shall constitute an unlawful practice**.

4. 4

   Step 4: The three exceptions, and what they share

   Article 4 says the prohibition **does not include** actions of commercial establishments exclusively aimed at: **(a)** evaluating the citizen **when they voluntarily provide it** for purposes of obtaining advantages, commercial offers and economic benefits otherwise unavailable; **(b)** when the specific personal information **is necessary and convenient to complete some errand**, such as the residential address and phone number for delivery of the purchased products, or the consumer’s physical description for a specific element of the product or service purchased; and **(c)** to qualify or pre-qualify a consumer **when they voluntarily provide it** for the purpose of a transaction aimed at acquiring goods or services. Two of the three turn on the word "voluntarily", and the third on the data being necessary for the specific errand. Article 1 itself adds a fourth outlet along the same line: the limitation **shall not apply to information voluntarily provided by the consumer for the purpose of taking up commercial offers or receiving periodic newsletters**. Translated into the real scene: if they are delivering a piece of furniture to your home, the address is necessary; if you are carrying it out yourself, it is not.

5. 5

   Step 5: Who enforces and what remains yours

   Article 5 designates the forum: **the Department of Consumer Affairs shall oversee this statute’s proper implementation and to that end may impose fines under its Organic Act, Act No. 5 of April 23, 1973**, and shall adopt or amend the pertinent regulations to put the law into effect. **We publish no fine amounts**: this law sets none, referring them to DACO’s Organic Act, which we did not read for this guide. And Article 6 clarifies something worth knowing before deciding what to do: **the power to impose administrative sanctions does not affect the right of any citizen with standing to bring such civil or administrative actions as they deem proper** by reason of a violation of this Act or of any other legal provision. That is, the DACO complaint is not the only route and does not cancel the others.

Before the Department of Consumer Affairs, which Article 5 expressly designates to oversee this law’s implementation and which may impose fines under its Organic Act. Article 6 further preserves the right of any citizen with standing to bring the civil or administrative actions they deem proper. What we do not publish: the complaint form, address, phone, resolution deadline or fine amounts, because Act 38-2016 does not set them — it refers fines to Act 5-1973, which we did not read here. That is why processing time stays unverified.

• Believing the rule applies only when you pay by card: the law says "independently of the payment method the consumer chooses".
• Confusing showing ID with handing over its data: the law allows asking for it only to verify your identity and complete the transaction.
• Giving your driver’s licence number without thinking: it is expressly on the Article 2 list.
• Thinking the Article 2 list is closed: it ends in "any other personal or official information".
• Refusing the address when there is home delivery: Article 4(b) excepts data necessary and convenient to complete the errand.
• Assuming a DACO complaint cancels other actions: Article 6 expressly preserves the citizen’s civil or administrative actions.
• Believing the law prohibits their asking: it prohibits their conditioning the sale on your answering.

These are the government pages this guide is based on.

• Departamento de Asuntos del Consumidor (DACO)

  DACO

  bvirtualogp.pr.gov

• Department of Consumer Affairs (DACO)

  DACO

  www.daco.pr.gov