Federal Law on Protection of Personal Data Held by Individuals
The Ley Federal de Protección de Datos Personales en Posesión de los Particulares, is a law of Mexico, approved by the Mexican Congress on April 27, 2010. The law aims to regulate the right to informational self-determination. The law was published on July 5, 2010, in the Official Gazette and entered into force on July 6, 2010. Its provisions apply to all natural or legal persons who carry out the processing of personal data in the applicable exercise of their activities. Companies such as banks, insurance companies, hospitals, schools, telecommunications companies, religious organizations, and professionals such as lawyers, doctors, and others, are required to comply with the provisions of this law.
Personal data, according to Article 3 Section V of the Act, is any information that could identify a person.
Regulatory background in Mexico
Before issuing the LFPDPPP in Mexico this right was expressly recognized only by the Federal Law of Transparency and Access to Public Government Information and in the Law on Protection of Personal Data in the State of Colima.Due to the regulatory landscape needed to meet international commitments, it was considered necessary to issue a law on the matter, so there would be a backup in the information.
Constitutional reforms of personal data
Chapter III, of the rights of the holders of personal data
Law takes the contents of the second paragraph of Article 16 of the Constitution and grant holders called "ARCO rights" whose acronym corresponds to:- Access : holders can know if their data is being processed.
- Correction : the right to request that their data be modified.
- Cancellation : holders may request that their data be canceled from the database for good cause.
- Opposition : the right of individuals to prevent use of their information.
Chapter IV Exercise of the rights of access, rectification, cancellation and opposition
Those responsible are obliged to process the requests for access, rectification, cancellation and opposition that made the headlines, for which purpose shall appoint a person or creating a department of personal data, which is responsible for responding to requests within the time prescribed by law. In this chapter the ways in which it can be fulfilled with these rights are also noted, and the reasons why some of them may be denied.Chapter V, the transfer of data
When the responsible party intends to transfer the data holder shall inform this fact in its privacy notice, requiring the consent of the holder, unless you apply any of the exceptions contemplated by this chapter.The amendment of Article 6 of the Constitution
The first record is in the reform in 2007 to Article 6 of the Constitution, in which a second paragraph is adicionaba this paragraph, laying the groundwork regarding the right to information, including the protection of personal data from public institutions, recognizing the rights of access and rectification. 3The amendment to article 16 of the Constitution
In this reform 4 a second paragraph to Article 16 is added, and states that everyone has the right to protection of personal data and to exercise the rights called "ARC".The Constitution also states that right may only be limited for reasons of national security provisions of public policy, public security or public health or to protect the rights of others. The LFPDPPP meanwhile, collects these assumptions within Article 4.
The amendment to article 73 of the Constitution
In this reform in May it empowered the Congress to legislate on the protection of personal data held by individuals, through the addition of the XXIX-O moiety. The justification for granting that power to the Federal Legislature was that personal data are used in various commercial transactions and trade is regulated at the federal level.Contents of the Federal Data Protection Act
Chapter I, General Provisions
Articles 1 and 2 of the LFPDPPP point out that the objectives of it are ensuring the privacy of persons and their right to informational self-determination, and that its provisions apply to non-automated or automated processing of personal information perform individuals or companies, with certain exceptions. In this chapter the central terms of this regulation, among which are fundamental concepts of sensitive personal data, head, head, manager, third and treatment are defined.Model legislation on the protection of personal data
Globally it recognized the existence of two models in terms of protection of personal data : general and sector.The general model is adopted by most countries, especially the European Union and among its features are:
There is only one regulatory body in the field and an authority responsible for compliance.
Provided the consent of the holders for the processing of data is required.
Transfers to countries without an adequate level of protection is prohibited.
For its part, the industry model is applied by the United States and has the following characteristics:
There is no single legal instrument governing the matter, the various agencies can issue regulations as they deem appropriate for their industry.
Various authorities, within the scope of their competence. They are responsible for ensuring the protection of this right.
The consent of the holders for the treatment of the data is presumed unless they express their refusal.
This scheme operates under self-regulation.
Chapter II, of the principles of personal data protection
The law takes the general model of the principles of legality, consent, information, quality, purpose, loyalty, proportionality and accountability.Are important principles of consent, information and purpose, under which managers can only make the processing of personal data if owning them give their consent for the purposes outlined in the privacy notice.