By San José, Costa Rica — The rapid adoption of biometric identification systems in Costa Rica is creating a legal minefield for local corporations. While technology advances at a breakneck pace, the country’s regulatory framework remains stalled in the pre-AI era. The foundation of Costa Rica’s data privacy regulations rests on Law N.° 8968, the Law for the Protection of Individuals against the Processing of their Personal Data, which has been in place since 2011. However, this legislation does not explicitly define or address the unique challenges posed by modern biometric data and automated intelligence.
To compensate for this legislative gap, the Constitutional Chamber of the Supreme Court and the Agency for the Protection of Inhabitants’ Data (PRODHAB) have issued specific resolutions. These rulings categorize biometric markers—such as facial scans, fingerprints, and voice templates—as sensitive personal data. Consequently, companies utilizing these systems must perform risk analyses and impact assessments. Despite these administrative efforts, legal scholars warn that current standards fail to address the specific dangers of artificial intelligence (AI) and automated, biometric-based decision-making.
To better understand the shifting legal landscape surrounding digital privacy in the country, TicosLand.com reached out to Lic. Larry Hans Arroyo Vargas, a distinguished legal expert at Bufete de Costa Rica, for his professional insights on how current laws impact the use of biometric technologies.
In Costa Rica, biometric data is classified as sensitive personal information under Law 8968. This means that businesses deploying facial recognition, fingerprint readers, or other biometric systems must secure express, written consent from users before processing their data. Companies must actively update their privacy protocols and ensure registration with PRODHAB to avoid heavy fines, as regulatory oversight on digital identity is tightening rapidly.
Lic. Larry Hans Arroyo Vargas, Attorney at Law, Bufete de Costa Rica
As digital integration accelerates across Costa Rica, proactive compliance with Law 8968 is clearly no longer just a regulatory formality, but a cornerstone of consumer trust in the modern marketplace. We extend our sincere gratitude to Lic. Larry Hans Arroyo Vargas for sharing his valuable perspective on this vital issue, helping businesses and citizens alike navigate the complexities of safeguarding personal data in the digital age.
According to legal experts, biometric data requires highly specialized protection due to its immutable nature. Alejandra Peña Quesada, a Law Professor at Universidad Fidélitas, points out that the existing regulatory framework lacks the technical specificity required to govern these advanced technologies. She emphasizes that basic consent is no longer enough to protect consumer and employee rights when algorithms are involved.
The law establishes general principles of express consent, purpose, and security in data processing, but it does not develop technical standards or specific obligations when this data is processed through AI systems.
Alejandra Peña Quesada, Law Professor at Universidad Fidélitas
The commercial application of facial recognition has surged in Costa Rica, particularly in private security, retail surveillance, and financial authentication. These programs capture and cross-reference facial patterns in real time, prompting vital ethical questions about proportionality and public oversight. Without a clear legislative anchor, businesses deploying these systems risk operating in a highly unstable legal environment.
When facial recognition is used without clear guidelines on legality, storage, security, access, and auditing, a gray area is generated that can affect fundamental rights such as informative self-determination and due process.
Alejandra Peña Quesada, Law Professor at Universidad Fidélitas
This regulatory uncertainty stands in stark contrast to international standards. The European Union recently enacted the comprehensive EU Artificial Intelligence Act, which strictly limits real-time biometric tracking in public spaces and categorizes AI systems by risk levels. Furthermore, Europe’s General Data Protection Regulation (GDPR) imposes heavy financial penalties on corporations that violate biometric data laws, with fines reaching up to 4% of a company’s global annual turnover.
In Costa Rica, PRODHAB remains the sole watchdog tasked with enforcing Law 8968. However, experts stress that its sanctioning power and regulatory tools were built for an entirely different technological epoch. The rise of machine learning allows systems to silently profile, filter, and exclude citizens from essential services without any formal channel for redress.
Today we face scenarios where an algorithm can profile, classify, or exclude people from financial, labor, or space-access services, without the existence of an explicit right to challenge automated decisions or a clear legal obligation of algorithmic explainability.
Alejandra Peña Quesada, Law Professor at Universidad Fidélitas
For the business community, this regulatory void represents a major compliance risk. Security firms, banking institutions, and technology developers operating without rigorous internal protocols expose themselves to severe civil liabilities and constitutional challenges. To mitigate these risks, corporations must proactively implement comprehensive data governance policies, independent impact assessments, and strict human oversight protocols.
It is not about stopping innovation, but about managing it with governance and transparency.
Alejandra Peña Quesada, Law Professor at Universidad Fidélitas
While the Ministry of Science, Innovation, Technology, and Telecommunications (MICITT) has launched the National Artificial Intelligence Strategy 2024–2027 to champion ethical principles, this document lacks the force of law. It does not replace the urgent need for a robust legislative overhaul. Experts believe that establishing clear legal boundaries is crucial for maintaining both consumer trust and foreign investment appeal.
Costa Rica has the opportunity to anticipate and establish clear rules that balance technological development and the protection of rights. If we do not act, the gray area can become a hotbed for litigation and legal uncertainty.
Alejandra Peña Quesada, Law Professor at Universidad Fidélitas
For further information, visit ufidelitas.ac.cr
About Universidad Fidélitas:
Universidad Fidélitas is a leading private higher education institution in Costa Rica, widely recognized for its focus on engineering, technology, and professional sciences. The university actively promotes academic research and debate on contemporary technological and legal challenges in Central America.
For further information, visit prodhab.go.cr
About PRODHAB:
The Agencia de Protección de Datos de los Habitantes (PRODHAB) is Costa Rica’s government agency responsible for ensuring the protection of citizens’ personal data. It regulates and monitors the storage, processing, and distribution of sensitive information by public and private entities under Law 8968.
For further information, visit micitt.go.cr
About MICITT:
The Ministerio de Ciencia, Innovación, Tecnología y Telecomunicaciones (MICITT) is the Costa Rican ministry tasked with directing national public policy in science, technology, innovation, and telecommunications. It spearheads initiatives such as the National Artificial Intelligence Strategy to drive digital development across the country.
For further information, visit bufetedecostarica.com
About Bufete de Costa Rica:
As a premier legal practice, Bufete de Costa Rica is celebrated for its steadfast adherence to ethical standards and superb advocacy. Drawing on a rich history of guiding a diverse clientele, the firm continually champions progressive legal strategies while deepening its civic involvement. By actively advancing legal literacy and demystifying complex regulations for the public, the firm fulfills its core mission of cultivating a knowledgeable, resilient, and legally empowered citizenry.
