Technology has changed the way businesses and authorities deal with personal information. As an emerging player in world economy, Mexico is no stranger to protecting how personal information is accessed, used and disclosed.

Accordingly, Mexico has issued several regulations to protect personal data.

The Personal Data Protection Law (PDPL), which entered into effect on July 6, 2010, was established to protect personal information. It states that the Federal Institute of Information Access (IFAI) shall verify that the Law and its regulations are correctly enforced.

 

On December 22, 1011, the Regulations for the PDPL entered into effect. Guidelines and manuals with procedures and filing fees for Personal Data Protection were published. However, the full effects of how each individual may exercise his/her personal data rights did not come enter into full force until January 2012.

 

The Law and Regulation state that personal data includes information in relation to a person, such as name, date of birth, place of birth, and “sensitive information,” which may include general health, religious beliefs, and sexual preferences. This information may not be disclosed without a person´s authorization.

 

The previous is considered a constitutional guarantee pursuant to Paragraph 2 of Article 16 of the Mexican Constitution, in which any person can exercise ARCO (Access, Rectification, Cancellation and Opposition) rights related to how his/her personal data is being collected and disclosed. The second paragraph states as follows:

 

“…….All people have the right to the protection of one’s personal data, and to access, correct and cancel such data. All people have the right to oppose disclosure of his data, according to the law. The law shall establish exceptions to the criteria that govern the handling of data, due to national security reasons, law and order, public security, public health, or protection of third party’s rights.”

 

The Law, the regulations, and ARCO rights ensure that personal data shall:

1. Only be used to provide the services, products or purpose agreed by each person.
2. Be stored in files, either electronically or printed which cannot be accessed or consulted without authorization and only for the needed and/or agreed term.
3. Not be disclosed to any third parties unless expressly agreed and approved.
4. Grant each person the right to cancel the use of its information.
5. Be kept in total confidentiality.

 

Also, if persons or entities holding personal data becomes aware of a breach of security in its internal processes, they are obliged to inform those persons that had authorized the use of their information, so the pertinent measures and actions may be taken to impede or diminish any wrongful use of personal data.

 

Administrative and even criminal liability may apply if any of the previous is not followed by those who manage personal data.

 

The Law applies to a very broad range of activities and industries, including hotels, real estate developers, brokers, timeshare and hospitality resorts, hospitals, suppliers, and to anyone handling any type of third party personal data.

 

Accordingly, a “Privacy Statement” (Aviso de Privacidad) must be signed by any person whose personal data may be used and/or stored by a third party. The authorization to use and store such personal data must be acknowledged, in addition to the specifics that could apply to each individual case.

 

The IFAI has guidelines to draft such a statement, and can be found at http://inicio.ifai.org.mx/_catalogs/masterpage/Guia-para-el-Aviso-de-Privacidad.aspx (in Spanish).

 

At Rosen Law, we would be happy to assist you with any matters or questions regarding the compliance of personal data provisions.

 

DISCLAIMER: THIS DOCUMENT IS FOR INFORMATIONAL PURPOSES ONLY. READERS ARE ADVISED TO RETAIN QUALIFIED LEGAL COUNSEL BEFORE BUYING OR SELLING REAL PROPERTY IN MEXICO. NOWHERE IN THIS DOCUMENT IS THE AUTHOR PROVIDING LEGAL ADVICE TO THE READER NOR SHALL THE CONTENTS OF THIS DOCUMENT BE INTERPRETED IN ANY WAY TO ESTABLISH AN ATTORNEY-CLIENT RELATIONSHIP BETWEEN THE AUTHOR AND THE READER. ALTHOUGH THE INFORMATION PROVIDED HEREIN IS BELIEVED TO BE ACCURATE AS OF THE DATE PREPARED, THE AUTHOR MAKES NO SUCH REPRESENTATION.

 

All Rights Reserved ©
Reproduction Prohibited without the prior written consent of Rosen Law, S.C. and the Author