Striking a Balance: IP and Data Protection in Puerto Rico's Digital Economy by Eugenio J. Torres-Oyola

Striking a Balance: IP and Data Protection in Puerto Rico's Digital Economy by Eugenio J. Torres-Oyola

In The Caribbean IP Annual 2025, Eugenio J. Torres-Oyola, Managing Partner & Co-Chair of Intellectual Property at Ferraiuoli, Puerto Rico, explores how Puerto Rico is redefining its digital economy through stronger intellectual property (IP) protection and new data privacy legislation. As emerging industries expand, businesses must now navigate a growing framework of compliance and consumer rights.

The Dual Role of IP and Privacy in Puerto Rico

IP remains at the centre of innovation, driving creativity and economic growth. Yet, as technology advances, new challenges arise: piracy, counterfeiting, unauthorised use of content, and the vast collection of personal data. Puerto Rico's growth in digital commerce and technology industries has triggered the need to address these concerns head-on.

The Cybersecurity Act: A Government-Wide Overhaul

Signed into law on January 21, 2024, Puerto Rico's Cybersecurity Act (Act No. 40 of 2024) imposes comprehensive security obligations for both government bodies and private companies working with public funds.

Key provisions include:

• Mandatory internet traffic filtering and inappropriate content blocking

• Encryption of confidential data based on NIST standards

• Multi-factor authentication and VPN usage for secure remote access

• Strict credit card payment security protocols (PCI-DSS compliance)

• Deployment of automatic threat detection systems

The Act sets out strict compliance requirements, penalties for violations, and a six-month window for full government implementation.

Bill No. 1548: Expanding Consumer Data Rights

Puerto Rico’s legislative branch also passed Bill No. 1548, which enhances consumer rights regarding personal data used for commercial purposes. The bill:

• Requires clear, informed consent for data collection and commercial use

• Grants consumers the right to request data deletion (with limited exceptions)

• Prohibits discriminatory treatment of consumers exercising their data rights

• Imposes strict limits on data retention (no longer than 24 months, with some exceptions)

• Mandates businesses to offer multiple channels for consumer complaints and requests

While pending the Governor’s signature, Bill No. 1548 signals a major shift towards stronger privacy protections for Puerto Rican consumers.

Conclusion As Puerto Rico’s digital economy accelerates, the balance between IP enforcement and data privacy has never been more crucial. The new legislative measures call for businesses to review, adjust, and modernise their data handling and IP protection strategies. As Eugenio J. Torres-Oyola highlights, companies operating in Puerto Rico must now embrace compliance not only as a legal obligation but as a foundation for sustainable growth in a rapidly evolving digital marketplace.

Read the full article in The Caribbean IP Annual 2025 to explore how these reforms are reshaping Puerto Rico’s IP and data protection landscape.

READ THE FULL ARTICLE NOW!