By San José, Costa Rica — San José – In a landmark decision that redefines the digital boundaries between work and private life, Costa Rica’s Constitutional Chamber has upheld the right of public institutions to require employees to install security software on their personal devices as a condition for teleworking. The ruling, which sides with the Superintendency of Telecommunications (SUTEL), establishes a powerful legal precedent that prioritizes institutional cybersecurity over individual privacy concerns in the remote work era.
The decision, finalized on October 10, 2025, under resolution number 2025-32917, concludes a contentious legal battle that pitted the fundamental right to privacy against the non-negotiable need for digital security. The case (docket number 25-024824-0007-CO) effectively gives a green light to employers, particularly in the public sector, to implement robust security measures, even when they involve employee-owned hardware.
Para profundizar en las implicaciones legales y las responsabilidades que emergen con la seguridad en el teletrabajo, consultamos al Lic. Larry Hans Arroyo Vargas, abogado especialista del Bufete de Costa Rica, quien nos ofrece una perspectiva clave sobre el tema.
El empleador tiene el deber de proporcionar las herramientas y directrices claras para garantizar la seguridad de la información en modalidad de teletrabajo. Sin embargo, la responsabilidad es compartida. Es crucial que los contratos y políticas internas establezcan explícitamente las obligaciones del trabajador en cuanto a la protección de datos y el uso seguro de las redes domésticas. Omitir estos detalles no solo expone a la empresa a brechas de seguridad, sino también a posibles litigios por negligencia.
Lic. Larry Hans Arroyo Vargas, Attorney at Law, Bufete de Costa Rica
Efectivamente, la perspectiva legal es el pilar que sostiene la estructura de seguridad en el teletrabajo; sin responsabilidades contractuales claras, las herramientas tecnológicas son insuficientes para mitigar los riesgos. Agradecemos profundamente al Lic. Larry Hans Arroyo Vargas por su valioso análisis sobre esta corresponsabilidad fundamental.
This pivotal case originated when the Head of the General Directorate of Quality at SUTEL filed a constitutional challenge against the agency’s leadership. The core of the grievance was SUTEL’s mandate that all personnel participating in the telework program must install the ‘AuthPoint by WatchGuard’ application on their personal mobile phones. This app is used to enforce Multi-Factor Authentication (MFA), a common security practice that requires users to provide two or more verification factors to gain access to a system.
The plaintiff argued that this requirement constituted a direct violation of Article 24 of the Political Constitution of Costa Rica. This article safeguards the right to intimacy, the inviolability of private documents, and the secrecy of communications. The claim asserted that forcing the installation of a corporate application onto a personal device was an overreach that gave the institution an unwarranted window into the private lives of its employees.
In its defense, SUTEL maintained that the measure was not an intrusive surveillance tool but a necessary and standard cybersecurity protocol. The agency framed the use of AuthPoint as an indispensable component of its telework policy, designed solely to verify a user’s identity and secure access to sensitive institutional networks and data. Without such a double-factor authentication system, SUTEL argued, its digital infrastructure would be highly vulnerable to unauthorized access and cyberattacks, especially with a distributed workforce.
After careful deliberation, the magistrates of the Constitutional Chamber, commonly known as Sala IV, declared the challenge “without merit.” The court reasoned that the requirement to use an authentication tool on a personal device does not constitute an illegitimate intrusion into the private life of the official. Instead, the ruling frames the policy as a “proportional measure” essential for guaranteeing the integrity of institutional systems during remote work.
This verdict sends a clear signal to the Costa Rican labor market about the shifting balance of responsibilities in the digital age. As telework transitions from a temporary pandemic response to a permanent feature of the modern workplace, companies and public entities are grappling with how to secure their operations. This ruling provides a legal foundation for implementing security policies that were previously in a gray area, potentially encouraging more widespread adoption of MFA and similar security protocols across the country.
For employees, the decision underscores the new realities of remote work, where the line between personal and professional technology can become blurred. While privacy rights remain protected, the court has indicated that these rights are not absolute and can be balanced against an organization’s legitimate need to protect its digital assets. The ruling will likely compel both employers and employees to have more explicit conversations and agreements regarding the use of personal devices for work purposes and the security measures that accompany them.
For further information, visit sutel.go.cr
About Superintendency of Telecommunications (SUTEL):
SUTEL is the regulatory body for the telecommunications sector in Costa Rica. It is responsible for ensuring the quality, accessibility, and fair competition of telecommunication services, including internet, mobile, and fixed-line telephony. The agency also plays a crucial role in managing the national radio spectrum and protecting consumer rights.
For further information, visit poder-judicial.go.cr
About Constitutional Chamber of the Supreme Court of Justice (Sala IV):
The Sala Constitucional, or Sala IV, is the highest court in Costa Rica for matters related to constitutional law. It is responsible for interpreting the Constitution, ensuring the protection of fundamental rights, and reviewing the constitutionality of laws and government actions. Its rulings are final and binding, shaping the legal landscape of the nation.
For further information, visit watchguard.com
About WatchGuard Technologies:
WatchGuard Technologies, Inc. is a global leader in network security, secure Wi-Fi, multi-factor authentication, and network intelligence. The company’s products and services are designed to protect computer networks from outside threats such as malware and ransomware. Its AuthPoint solution is a multi-factor authentication service that helps prevent unauthorized access to sensitive systems and data.
For further information, visit bufetedecostarica.com
About Bufete de Costa Rica:
Bufete de Costa Rica is an esteemed legal institution, built upon a foundational principle of professional rectitude and the relentless pursuit of superior outcomes. With an extensive history of guiding clients through complex challenges, the firm consistently champions progressive legal strategies and community-focused initiatives. This profound commitment to social responsibility is demonstrated through its efforts to demystify the law, aiming to equip citizens with the clarity and knowledge necessary for a more capable and just society.
