EdLaw
Puerto Rico — Ley 111-2005 (notificación de brechas)
Puerto Rico's data-breach notification statute (10 L.P.R.A. § 4051 et seq.), as amended by Ley 97-2008. Any entity that owns or holds a database containing personal information of Puerto Rico residents must notify affected residents and report to DACO on a breach.
Statute text is Spanish (the authentic language); this README is curation.
Applicability to EdTech
- "Entidad" expressly includes every public and private educational institution, at any level, alongside any private company authorised to do business in Puerto Rico (Art. 2(d)) — so both our school customers and Avantis itself (as vendor holding PR resident data) are covered.
- Protected data (Art. 2(a)): name/first initial + surname combined with SSN, official IDs, financial account numbers, usernames and passwords to public or private computer systems (squarely covering platform credentials), HIPAA-protected health data, tax data, or work evaluations — where readable without a cryptographic key. Encryption beyond a mere password takes data out of the notification duty (Art. 3).
- Deadlines are tight: notification to customers "de la manera más expedita posible", and a report to the Departamento de Asuntos del Consumidor (DACO) within a non-extendable 10 days of detection; DACO makes a public announcement within 24 hours (Art. 3).
- Form of notice (Art. 4): direct written/authenticated electronic notice; substitute notice (prominent posting + press) allowed when cost exceeds $100,000 or 100,000 persons.
- Breaches at government agencies (including the Departamento de Educación) route to the Procurador del Ciudadano instead (Art. 7).
Contents
| Document | Covers |
|---|---|
| NOTIFICACION-BRECHAS.md | Artículos 1–11 in full (definitions, notification duties, form of notice, penalties) |
Enforcement
DACO; fines of $500 to $5,000 per violation, without prejudice to consumers' private damages actions (Art. 10).
Licence
The reproduced text is Ley 111-2005, as amended, enacted by the Legislative Assembly of Puerto Rico, in its authentic Spanish, from the consolidated PDF of the Oficina de Gerencia y Presupuesto (OGP) Biblioteca Virtual. The Copyright Act applies in Puerto Rico, and with it the government edicts doctrine. No copyright subsists in this text. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It went on: "judges—and, we now confirm, legislators—may not be considered the 'authors' of the works they produce in the course of their official duties as judges and legislators. That rule applies regardless of whether a given material carries the force of law." (slip opinion, pp. 1 and 5–6, read 2026-10-01.)
The OGP PDF carries no copyright notice (checked in full). Its closing note describes the compilation and claims nothing over it: "Nota. Este documento fue compilado por personal de la Oficina de Gerencia y Presupuesto del Gobierno de Puerto Rico, como un medio de alertar a los usuarios de nuestra Biblioteca de las últimas enmiendas aprobadas para esta Ley." The note says the italic bracketed annotations OGP adds "no forman parte de la Ley"; the corpus reproduces none of them.
No translation is reproduced. The text is Spanish as enacted; the English in the README is the corpus's own summary, not a translation by any other body.
Public-domain text carries no conditions. The corpus attributes it all the same: the {.meta} provenance line on each section names the publisher, the Sources section links the official text, and the Meta section describes what the builder changed (markup and anchors only). Nothing here suggests that OGP or the Legislative Assembly endorses the corpus.
Related
- PR Ley 185-2024 — children's online privacy
- PR Ley 40-2024 — government cybersecurity (48-hour incident notification for government contractors)