MEXICO Law and Practice Contributed by: Luciano Pérez and Allan Pastor, Nader Hayaux & Goebel
• Lawfulness: Processing must be grounded in a valid legal basis and carried out in accordance with the applicable framework. • Purpose: Data may only be collected and used for specific and legitimate purposes. • Loyalty: Processing must be carried out in a man - ner consistent with the individual’s reasonable expectations. • Consent: Processing requires the individual’s con - sent, subject to recognised exceptions. • Quality: Controllers should take reasonable steps to ensure data is accurate, complete and kept up to date. • Proportionality: Only data that is adequate, rele - vant, and necessary for the stated purposes should be processed. • Information: The individual must be informed about the details of the data processing. • Accountability: Controllers must implement and be able to demonstrate compliance through govern - ance measures, confidentiality duties, appropriate security controls, and effective oversight of proces - sors and recipients. Data Subject Rights and Remedies Data subjects have a core set of rights that enable individuals to control and challenge the process - ing of their personal data (“ARCO Rights”), as listed below. In practice, data controllers should treat these rights as operational requirements, supported by clear request channels and internal procedures. • Access: The right to confirm whether a controller processes the individual’s data and, if so, to obtain access and information about the relevant pro - cessing. • Rectification: The right to require correction or com - pletion of personal data. • Cancellation: The right to request deletion of per - sonal data. • Opposition: The right to object to processing in certain circumstances. • Revocation of consent: The right to withdraw con - sent where it is the basis for processing. • Limitation of use or disclosure: The right to request limits on certain uses or disclosures of personal data.
• Complaint and redress: Where the individual is not satisfied with the controller’s response (or receives no response), the framework provides a route to seek review through the competent authority, which may issue binding determinations and trig - ger further oversight actions. Main Compliance “To-Dos” for Companies Though specific requirements for organisations vary depending on their business, operations and capabili - ties, the following workstreams are typically the core building blocks for adequate compliance: • Provide privacy notice: Deliver a fully compliant privacy notice that includes, among other things, the purposes of data processing, the transfers to be carried out, the types of data to be collected, and the rights of the data subjects. • Obtain consent: Collect and process personal data only after obtaining the data subject’s consent (the type of consent will depend on the type of data to be processed). • Data quality: Ensure that the personal data col - lected is accurate, relevant, and up to date for its intended purposes. • Data security: Implement appropriate technical, physical and administrative measures to protect personal data from unauthorised access, loss or damage. • Guarantee ARCO Rights: Allow data subjects to exercise their ARCO Rights and provide mecha - nisms and procedures that comply with the Private DPRs for their handling. • Retention period: Store personal data only for the duration necessary to fulfil the purposes stated in the privacy notice. • Internal procedures: Establish internal policies, pro - cedures and training to ensure compliance with the Private DPRs, including appointing a Data Protec - tion Officer or Department. • Data breach notification: Notify data subjects in compliance with the requirements set forth in the Private DPRs in case the data controllers are sub - ject to a data breach. • Third-party compliance: Verify that any third- party data processor or recipient of personal data adheres to the Private DPRs and aligns with the controller’s privacy notice.
312 CHAMBERS.COM
Powered by FlippingBook