🇲🇽 Mexico

Informations

Extracts :

Extract :

Their is not evidence that Mexico has a clear definition of Data Subject, that applies to all the sectors, regarding for regulating personal data privacy.

2021

Reference :

Data protection during employment | DataGuidance

Information on data protection during employment - MEX

Extracts :

Extract :

Their is not evidence that Mexico has a clear definition of Data Subject, that applies to all the sectors, regarding for regulating personal data privacy.

2021

Reference :

Data protection during employment | DataGuidance

Information on data protection during employment - MEX

Extracts :

Extract :

Their is not evidence that Mexico has a clear definition of Data Subject, that applies to all the sectors, regarding for regulating personal data privacy.

2021

Reference :

Data protection during employment | DataGuidance

Information on data protection during employment - MEX

Extracts :

Extract :

"In general terms, and unlike the GDPR, the Federal Law does not apply extraterritorially, nor does it ex- plicitly regulate goods and services or monitoring from abroad. The Federal Law does, however, specify that it applies to corporate bodies incorporated outside of Mexico."

2021

Reference :

GDPR vs countries' comparison | DataGuidance

Comparison of GDPR vs countries' data protection laws, definitions etc. - MEX

Extracts :

Extract :

"2.2. Territorial scope The Regulation establishes the territorial scope of application, by stating that the Regulation applies to all processing of personal data that: • is carried out in a data controller's establishment located in Mexico; • is carried out by a data processor, regardless of location, on behalf of a data controller estab-lished in Mexico; • is carried out when the data controller is not established in Mexico, but is subject to Mexican laws under a contractual agreement or due to international law; and • is carried out by a data controller that is not established in Mexico but uses means located in Mexico, unless such means are used only for transit purposes."

2021

Reference :

Mexico Data protection overview | DataGuidance

(Data Protection Overview 2021)/ DataGuidance reports

Extracts :

Extract :

“Data controller: The 'responsible party' is defined as the natural or legal private person that decides on the processing of personal data. (Article 3, XIV, of the Law). Data processor: The 'person in charge' is the individual or legal entity that, alone or jointly with others, processes personal data on behalf of the data controller (Article. 3, IX, of the Law).”

2021

Reference :

Mexico Data protection overview | DataGuidance

(Data Protection Overview 2021)/ DataGuidance reports

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

Global Data Security Handbook

BakerMckenzie

Name	Short name	Classification	Jurisdiction	Year of creation
Federal Economic Competition Commission (Comisión Federal de Competencia Económica, or COFECE)		Regulator	Under the government authority	1993
Federal Telecommunications Institute (Instituto Federal de Telecomunicaciones, or IFT)		Regulator	Independant agency	2013
National Institute of Transparency, Access to Information and Protection of Personal Data (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales, or INAI)	INAI	Regulator	Independant agency	2014
Ministry of Economy (Secretaría de Economía, or SE)		Regulator	Ministry	1917
Mexican Central Bank (Banco de México)		Regulator	Under the government authority	1925

🇲🇽 Mexico

Data subject classification

Citizens outside their jurisdiction are considered as data subjects : No

Persons within their jurisdiction are considered as data subjects : No

Legal entities are considered as data subjects : No

Data controller definition and responsibilities

Organizations located outside the jurisdiction processing regulated subjects data are considered as data controllers within the personal data legislation : No

Organizations with economic activities within the jurisdiction are considered as data controllers within the personal data legislation : Yes

Differentiation between how data controller and data processor are defined : Yes

Organizations located outside the jurisdiction monitoring regulated subjects data are considered as data controllers within the personal data legislation : No

Special/sensitive personal data definition

Definition of personal data that are "special" or "sensitive": biometric data : No

Definition of personal data that are "special" or "sensitive": financial data : No

Definition of personal data that are "special" or "sensitive": genetic data : Yes

Definition of personal data that are "special" or "sensitive": medical/health data : Yes

Definition of personal data that are "special" or "sensitive": criminal records data : Yes

Definition of personal data that are "special" or "sensitive": racial/ethnic origin : Yes

Definition of personal data that are "special" or "sensitive": political opinions : Yes

Definition of personal data that are "special" or "sensitive": religious/philosophical beliefs : Yes

Definition of personal data that are "special" or "sensitive": trade union membership : Yes

Definition of personal data that are "special" or "sensitive": geo-location data : No

Legal bases for data processing

Potential legal bases for processing personal data: appropriate notice has been provided to or made available to the data subject : Yes

Potential legal bases for processing personal data: the data subject has provided consent to the processing for the identified purposes : Yes

Potential legal bases for processing personal data: the personal data is necessary to perform a contract with the data subject : Yes

Potential legal bases for processing personal data: the personal data is necessary to comply with a legal obligation : Yes

Potential legal bases for processing personal data: the personal data is necessary to protect the vital interests of a natural person : Yes

Potential legal bases for processing personal data: the personal data is necessary for a public interest : No

Potential legal bases for processing personal data: the personal data is necessary to fulfil a legitimate interest of the controller or third party : No

Enforcement and penalties

Provision of administrative penalties by laws : Yes

Max value of monetary penalties for violations (in euros) : 193920

Consideration of turnover rates for penalties? : No

Provision of criminal penalties - fines : Yes

Subject private remedies - presence of individual personal actions? : Yes

Subject private remedies - representative actions? : Yes

Subject private remedies - class actions? : Yes

Subject private remedies - file complaints with Data Protection Authorities? : Yes

Provision of criminal penalties - imprisonment : Yes

Data processing and security controls

Audit or supervise Data Processors : No

Requirement of a DPIA : Yes

Ensuring encryption/pseudonymisation as a security control : No

Requirement for Controller to notify subjects of a data breach : Yes

Requirement for Controller to notify DPA of a data breach : No

Requirement for Processor to notify controller of data breach : No

Requirement for Processor to notify DPA of data breach : No

Requirement for Processor to notify subjects of data breach : No

Obligation to maintain information security control to protect personal data from unauthorized access or processing: general technical/physical/organizational security controls : Yes

Rights of data subjects

Right to object data use or/opt out : Yes

Right to data portability : No

Right against automated decision making : No

Right to be informed : Yes

Consent required for processing children's data : Yes

Right to access information : Yes

Right to rectification : Yes

Right to erase : Yes

Right to withdraw consent : Yes

Right to restrict data processing : Yes

International data transfer and data localization

Legal basis for international data transfer: approved jurisdictions : No

Legal basis for international data transfer: approved standard contractual clauses : No

Legal basis for international data transfer: derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims : No

Legal basis for international data transfer: binding corporate rules : No

Data localisation requirements: retention of personal data in local jurisdiction : Yes

Data localisation requirements: tax or financial record laws : No

Legal basis for international data transfer: EU/EEA adequacy : No

Legal basis for international data transfer: Convention 108 : Yes

Data localisation requirements: national security laws : Yes

Legal basis for international data transfer: APEC CBPRs : Yes

Data localisation requirements (such data is part of another type of record or dataset): retention or storage of personal data in the local jurisdiction or otherwise prohibit the transfer or disclosure of the personal data outside of the local jurisdiction : No

Data localisation requirements: anti-investigatory/blocking statutes that restrict any activity on local territory that aids a foreign government investigation : No

Data localisation requirements: other data localization regulations (export control laws/medical laws/employment laws etc.) : Yes

Data protection officer (DPO) requirements

Consulting the supervisory authority (DPA) before data processing : Yes

Mandatory appointment of a DPO : No

Requirement of professional/legal qualification/expert knowledge for DPO : Yes

Clear DPO role specification : No

Group appointments: a group of undertakings to appoint a single DPO : No