On May 3, 2016, Governor Alejandro García Padilla enacted Act Number 38-2016 (the “Act”). The Act prohibits all commercial establishments operating in Puerto Rico from requesting or collecting consumers’ personal information as a requirement to complete a commercial transaction.

This prohibition is applicable to all methods of payment. For transactions to be completed with debit or credit cards, however, the merchant may request an identification card only to confirm such person’s identity. The Act does not contain a similar exception for payments by check.

The Act defines “commercial establishment” as any natural or juridical person that offers for sale, lease, exchange or transfer any type of commercial goods or services.

The information that cannot be requested or collected includes a consumer’s: (1) social security number, (2) physical characteristics or description, (3) postal and/or residential address, (4) telephone number, (5) passport, driver’s license or electoral identification number, or (6) any other personal or official information. Currently, many merchants request some of this information from consumers.

The prohibition on requesting consumers’ information excludes acts by a commercial establishment directed at: (1) sending periodic offers or shoppers to the consumer when the latter has voluntarily provided information to receive the same, (2) evaluating the consumer when they voluntarily provide information in order to obtain advantages, commercial offers or economic benefits that would otherwise be unavailable, (3) when the specific personal information is necessary and convenient in order to complete a procedure (for example, requesting the consumer’s residential address and telephone number in order to arrange for the delivery of products or a consumer’s physical description for a specific element of the acquired product or service), or (4) for purposes of qualifying or prequalifying a consumer when they voluntarily provide the information as part of a transaction to acquire goods or services.

The Act will be administered by the Department of Consumer Affairs (“DACO”, for its Spanish acronym), which shall adopt regulations in order to enforce the provisions of the Act. DACO may impose penalties of up to $10,000 per violation as allowed under DACO’s Organic Act. Nonetheless, citizens may still bring forward civil or administrative suits if they understand the Act has been violated. Considering that the Act has immediate effect, commercial establishments should take note of these new requirements/prohibitions and adapt their policies accordingly.
For further information about this new Law, or should you need assistance in revising your policies, please contact any of the attorneys of the O’Neill & Borges’ Consumer and Retail Law Practice Group.