The draft Law for the Protection of Digital Privacy ('the Draft Law') was introduced, on 19 March 2019, to the Puerto Rico Senate. In particular, the Draft Law applies, among other things, to any business that collects the personal information of Puerto Rico residents, determines, alone or in conjunction with others, the purposes and means of processing personal information, and has a gross annual income exceeding $10 million, annually purchases, receives, sells or shares, for commercial purposes the personal information of 10,000 or more consumers, or derives 20% or more of their annual income from the sale of consumers' personal information.

In addition, the Draft Law would provide, among other things, consumers with the right to know what personal information about them is being collected, including biometric data, and with whom it is shared, the right to opt-out of the transfer, sale and sharing of personal data, the right of access, the right to erasure, and the right to rectify or correct inaccurate or incomplete information. Furthermore, the Draft Law stipulates that a person whose data protection rights have been violated shall have the right to bring a civil action against the offender before a court of first instance, subject to certain conditions, and that statutory damages granted to an injured party shall not exceed $5,000 per infraction.

You can read the Draft Law, only available in Spanish, here.