Territory: Mexico

Data Protection Regulations: Federal Law on the protection of personal data held by private parties.

Link: http://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf

Regulatory purpose: The protection of personal data in the possession of individuals, with the aim of regulating their legitimate, controlled and informed processing, in order to guarantee privacy and the right to informational self-determination of individuals.

Parties:

  • Data controller: Yes. Natural or legal person of a private nature who decides on the processing of personal data.
  • Data Processor: Yes, the natural or legal person who alone or jointly with others processes personal data on behalf of the controller.
  • Data Protection Officer: No.
  • Supervisory Authority: Yes. National Institute for Transparency, Access to Information and Protection of Personal Data (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales). (Federal Institute for Access to Information and Data Protection).

Principles: 

  • Lawfulness
  • Consent
  • Information
  • Quality
  • Purpose
  • Loyalty
  • Proportionality
  • Accountability

Obligations:

  • Register of Processing Activities: No.
  • Impact Assessments: Yes.
  • Risk analysis: Yes.
  • Technical and organisational security measures: Yes.
  • Duty to inform: Yes.
  • Data Protection Officer: No.

Data subjects’ rights:

  • Right of Access: Yes.
  • Right of rectification: Yes.
  • Right of Suppression: Yes.
  • Right to limitation: No.
  • Right to portability: Yes.
  • Right to object: Yes.
  • Automated individual decisions, including profiling: No.

International transfers:

International data transfers can only be carried out without the consent of the data subject in the following 7 specific scenarios, but it does not mention the mechanism, or the list of countries considered safe. Assumptions:

  • When it is provided for in a Law or Treaty to which Mexico is a party;
  • When it is necessary for the prevention or medical diagnosis, the provision of health care, medical treatment or the management of health services;
  • When it is carried out to holding companies, subsidiaries or affiliates under common control of the responsible party;
  • Where it is necessary under a contract entered into or to be entered into in the interest of the data subject by the data controller and a third party;
  • Where it is necessary or legally required for the safeguarding of a public interest, or for the administration of justice or the administration of justice;
  • When it is necessary for the recognition, exercise or defence of a right in legal proceedings; and
  • When it is necessary for the maintenance or performance of a legal relationship between the controller and the data subject.

Sanctioning regime:

  • Warning.
  • Fine of 100 to 320,000 days of the Minimum Wage in force in Mexico City.
  • In case of persistent infringements, there will be an additional fine of 100 to 320,000 days of the Minimum Wage in force in Mexico City.

Certification or accreditation of compliance for companies: No.

Other related legislation:

General Law on the protection of personal data held by obliged parties
http://www.diputados.gob.mx/LeyesBiblio/pdf/LGPDPPSO.pdf

Federal Law on transparency and access to public information
http://www.diputados.gob.mx/LeyesBiblio/pdf/LFTAIP_200521.pdf

The regulation of the federal law on the protection of personal data held by individuals
http://www.diputados.gob.mx/LeyesBiblio/regley/Reg_LFPDPPP.pdf

Federal code of civil procedure
http://www.diputados.gob.mx/LeyesBiblio/pdf_mov/Codigo_Federal_de_Procedimientos_Civiles.pdf

Federal administrative procedure law
http://www.diputados.gob.mx/LeyesBiblio/pdf/112_180518.pdf

Mexico