Key amendments to Mexico’s personal data protection law
By Camilia Sirianni and Candela Basilotta
On March 20, amendments to three significant laws were published in Mexico’s Official Gazzette: the General Law on Transparency and Access to Public Information, the General Law on the Protection of Personal Data Held by Obligated Parties, and the Federal Law on the Protection of Personal Data Held by Private Parties. The latter (hereinafter, the “Law”) introduces substantial changes that deserve special attention, despite retaining part of its original wording.
- The concept of data subject
The new Law defines the data subject as the “person to whom the personal data pertains.” At first glance, this could be interpreted as referring exclusively to natural persons. However, since other provisions in the Law expressly distinguish between natural and “legal” persons, it could be understood that legal entities may also qualify as data subjects.
This wording contrasts with the previous version of the Law, which aligned with more modern comparative legislation by limiting the notion of data subject to natural persons only.
In this context, it will be crucial to observe how this provision is interpreted by the new supervisory authority, the Secretariat for Anti-Corruption and Good Governance.
- Exceptions to consent
As regards to exceptions to consent, while the previous regulation allowed data processing when provided for in a law, the new regulation expands this to include any legal provision. Furthermore, instead of requiring a resolution issued by the competent authority, it is now sufficient to have a court order, resolution, or mandate that is duly grounded and justified by such authority.
- Appeals against decisions issued by the authority
Lastly, the Law introduces a significant change in procedural matters. Previously, individuals who wished to challenge decisions issued by the supervisory authority had to initiate a nullity action before the Federal Court of Administrative Justice. The new Law replaces this mechanism with a writ of amparo, which may be filed before district courts or circuit collegiate courts specialized in public access to information and personal data protection, starting in June of this year.
For further information, please contact csirianni@ojambf.com and cbasilotta@ojambf.com.
