Transparency, personal data and the proposed reform in Mexico.

29.08.2024

Mexico's approach to personal data protection operates through distinct frameworks for the public and private sectors. The Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP ), established in 2010, governs private entities without reform to date. The public sector is regulated by the General Law on Protection of Personal Data Held by Obligated Subjects (LGPDPPSO1), in effect since 2017. The National Institute of Transparency, Access to Information, and Personal Data Protection (INAI1) ensures compliance in the private sector, while state-level bodies, constitutionally autonomous, guarantee enforcement in the public sector.

However, ongoing discussions emphasize the need to reform and possibly unify these frameworks to create a more streamlined and coherent regulatory environment for personal data protection. The potential dissolution of the INAI, as proposed in a constitutional reform, raises concerns. Such a move could disrupt efforts to modernize and harmonize data protection laws, creating uncertainty about the future of transparency and data protection in Mexico.

Guarantor Bodies in Mexico

Mexico’s personal data protection and access to information are overseen by two key bodies: the National Institute for Transparency, Access to Information, and Personal Data Protection (INAI) and Constitutionally Autonomous State Public Bodies. The INAI primarily regulates the private sector under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), while the state bodies oversee compliance within the public sector under the General Law on Protection of Personal Data Held by Obligated Subjects (LGPDPPSO). Together, these institutions ensure adherence to data protection laws and provide a system for appeals and oversight.

Normative Frameworks in Data Protection

Mexico employs distinct legal frameworks for the private and public sectors regarding data protection. The LFPDPPP, established in 2010, governs the private sector, detailing the rights of data subjects and the obligations of data controllers. The INAI supplements this law with regulations and guidelines. The public sector, on the other hand, is regulated by the LGPDPPSO, enacted in 2017, with its enforcement guided by state autonomous bodies. There is an ongoing discussion about reforming or unifying these frameworks into a single national law to simplify regulatory obligations. Such a reform could harmonize Mexico’s data protection standards with international benchmarks like the EU’s GDPR, potentially enhancing its appeal for foreign investment by offering a stable and robust regulatory environment.

Initiative of "Extinction of Bodies with Duplication of Functions"

On February 5, 2024, a significant reform proposal aimed at streamlining the government’s administrative structure was presented and approved. Titled "Extinction of Bodies with Duplication of Functions," this initiative proposes the dissolution of several autonomous bodies, including the INAI, arguing that their functions are redundant. The proposal suggests transferring the INAI’s responsibilities to existing government departments, aiming to enhance operational efficiency and reduce costs. However, this centralization raises concerns about the potential impact on the independent oversight of transparency and data protection, which are crucial for maintaining public trust and regulatory integrity.

Impact of this Reform

The reform has substantial implications across social, economic, and business domains. Socially, the INAI has played a pivotal role in safeguarding citizens’ rights to access information and protect personal data. Its dissolution could undermine public trust in governmental institutions by limiting individuals’ ability to monitor the handling of public information and data protection. Economically, the absence of an independent body like the INAI could create regulatory instability, discouraging foreign investment due to uncertainties about Mexico’s commitment to upholding international data protection standards. As personal data becomes an increasingly valuable asset in the global economy, the centralization of oversight functions may be perceived as a risk, potentially leading to reduced investment or the relocation of operations. The reform could also negatively impact Mexico’s business climate, as transparency and accountability are critical factors for investors concerned about corruption and governance risks.

Expectations

The elimination of the INAI represents a significant institutional shift that could impact trust among citizens and investors. Given the potential consequences, it is plausible that future administrations may revisit this reform. Regardless of the immediate outcomes, there is an expectation that Mexico will eventually need to modernize its data protection framework to align with international standards and meet the demands of the digital era. Maintaining a strong culture of transparency, accountability, and privacy protection remains essential, as these are fundamental rights that should be preserved and reinforced..

Article provided by INPLP members: José Antonio Arochi, Verónica Siten and Montserrat Landaverde (Arochi & Lindner, Mexico)

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)

What is the INPLP?

INPLP is a not-for-profit international network of qualified professionals providing expert counsel on legal and compliance issues relating to data privacy and associated matters. INPLP provides targeted and concise guidance, multi-jurisdictional views and practical information to address the ever-increasing and intensifying field of data protection challenges. INPLP fulfils its mission by sharing know-how, conducting joint research into data processing practices and engaging proactively in international cooperation in both the private and public sectors.