The expansion of telecommuting (teletrabajo) in Costa Rica, consolidated by Law No. 9738 to Regulate Telecommuting (Ley para Regular el Teletrabajo), gained significant momentum as a result of the COVID-19 pandemic. This work modality has entailed an increasingly intensive use of digital platforms, remote communication systems, and cybersecurity tools, alongside mechanisms to supervise tasks performed virtually. Furthermore, this new environment has forced a reassessment of the boundaries between the employer's managerial prerogative (poder de dirección) and the fundamental right to data privacy of the working person.

The right to privacy, private life, and the inviolability of communications—enshrined in Article 24 of the Political Constitution—is not extinguished by the existence of a remote work arrangement. Labor subordination, whether under a remote or in-person scheme, does not empower an employer to exercise arbitrary, invasive, or disproportionate controls over the employee's personal sphere. Consequently, the use of technological means for the provision of services does not legitimize an abusive exercise of employer faculties, nor does it allow supervision to extend into the worker's private life.

The Law to Regulate Telecommuting establishes that this modality does not alter the nature of the employment relationship nor the existing rights and obligations between the parties. In this regard, the employer retains the authority to direct their employees so that they execute their tasks with the appropriate intensity, care, and diligence, and in the manner, time, and place agreed upon (pursuant to Article 71 of the Labor Code). The employer is also empowered to establish monitoring and control mechanisms to ensure compliance with their directives (Articles 6(d) and 9(a) of Law No. 9738) and to impose the corresponding sanctions in the event of non-compliance.

Technological control is legitimate when it pursues a specific purpose, such as data protection or workflow management, provided that: (i) it is designed under criteria of reasonableness and transparency, and (ii) the parties expressly consent to the manner in which telecommuting policies will be implemented in general, and those related to monitoring, control, and sanctioning powers in particular.

Precisely, an employee's breach of obligations—such as failing to log in during the established working hours, a circumstance that can be verified through connection to the corporate VPN—empowers the employer to exercise their managerial prerogative and apply the corresponding sanctions for the offenses committed. These actions can even give rise to a termination for cause (despido justificado), as ruled by the Second Chamber in Resolution No. 539-2018.

The Law on the Protection of Individuals against the Processing of their Personal Data (Law No. 8968) imposes strict limits on the processing of information relating to employees. In telecommuting contexts, the employer acts as the data controller (responsable de bases de datos) and may only collect and process data that is necessary, pertinent, and proportional to the employment relationship. This implies that the use of technological tools such as monitoring software, authentication systems, or device management mechanisms must be limited to the control purposes inherent to the provision of the service; therefore, it cannot result in the collection of information or access to sensitive data or aspects intrinsic to the worker's private life.

Regarding this matter, in a case involving the use of multi-factor authentication tools for remote work, the Constitutional Chamber (Sala Constitucional), in its ruling No. 32917-2025, resolved that the installation of technological mechanisms oriented toward protecting access to institutional systems does not, by itself, constitute a violation of the right to privacy, provided that the measure holds a legitimate cybersecurity purpose, is technically justified, and proves to be proportional. Nonetheless, the Chamber was emphatic in pointing out that such tools cannot be used to surveil the worker's private life or to extend control beyond the strictly professional sphere, further highlighting that telecommuting retains its voluntary or optional nature.

In short, telecommuting does not imply that the employer forfeits monitoring and control capabilities, but it must be clear that this authority is not unrestricted either. The importance lies in finding a balance between the utilization of technology and respect for the dignity and private life of working individuals, ensuring that the implemented controls are proportional and protect the interests and rights of both parties.