MEXICO Law and Practice Contributed by: Luciano Pérez and Allan Pastor, Nader Hayaux & Goebel
1.3 Special Categories of Personal Data Although the Private DPRs cover multiple categories of personal data, they single out sensitive personal data as particularly important to protect. Sensitive personal data is generally understood as personal data that affects an individual’s most intimate sphere or that, if misused, could give rise to discrimination or entail a serious risk to the individual. Because of its heightened risk profile, sensitive personal data attracts stricter compliance expectations and a higher standard of care throughout the processing life-cycle. In practical terms, controllers should ensure enhanced safeguards, including: • Stricter consent standard: Processing sensitive personal data generally requires express, written consent. • Narrowly defined purposes and minimisation: Pur- poses should be tightly framed and limited to what is genuinely necessary. • Clear outlines: The privacy notice should clearly identify the sensitive categories of data involved and the relevant information about its processing. • Heightened security and confidentiality: Controllers should implement stronger administrative, techni - cal and physical measures. • Stronger vendor and transfer controls: Where pro - cessors or third-party controllers are involved, con - tracts and transfer documentation should reflect the higher sensitivity. For minors, the Private DPRs should be read along - side the overarching standard that the best interests of the child must be the primary consideration when designing and operating data processing, meaning a controller should prioritise a minor’s welfare over com - mercial objectives. In any event, data relating to minors – and, more broadly, data relating to any category of data subject – should be assessed against the applicable definition of personal data to determine the compliance require - ments that follow, since such data may fall within that definition and therefore trigger the obligations set out in the Private DPRs.
1.4 Processing of Personal Data for Research and Development Purposes Processing for research and development purposes is allowed if data controllers comply with the Private DPRs. Furthermore, the Private DPRs recognise the concept of dissociation ( disociación ), defined as a procedure through which personal data cannot be associated with the relevant data subject, nor can it be identified by virtue of its structure, content, or degree of disaggregation. Where dissociation is implemented with that effect, the resulting dataset would no longer qualify as personal data and may therefore be pro - cessed outside the scope of the Private DPRs. Any process that does not exclusively involve dissociated data remains subject to the Private DPRs. 1.5 Processing of Personal Data in the Context of Artificial Intelligence On automated decision-making, the Private DPRs take a more targeted approach than establishing an “AI risk taxonomy”. A data subject may oppose processing where (i) their personal data are used in automated processing that produces undesired legal effects or otherwise significantly affects their interests, rights or freedoms, and (ii) where the processing is intended to evaluate, analyse or predict aspects of the individual without meaningful human intervention. Accordingly, specific and binding AI prohibitions are not features of the Private DPRs themselves; con - straints arise from applying general rules. Specifically, a risk-sensitive compliance expectation is embedded through (i) heightened requirements for sensitive per - sonal data, and (ii) security obligations that should scale with the risk profile of the processing (including foreseeable harm). 1.6 Data Breach Requirement Under the Private DPRs, data controllers are expected to implement safeguards to protect personal data and to respond promptly where a security incident com - promises it. Where a breach occurs, the Private DPRs require controllers to take the following steps: • Immediate containment and mitigation: Take prompt measures to stop the incident and reduce exposure, including technical and organisational remediation.
313 CHAMBERS.COM
Powered by FlippingBook