MEXICO Law and Practice Contributed by: Luciano Pérez and Allan Pastor, Nader Hayaux & Goebel
1.9 Enforcement Trends The SABG’s recent communications and enforcement activity suggest the following: • Increased enforcement action: A more assertive response to non-compliance, with investigations used as deterrence, and an explicit narrative linking breach cases to administrative fines and, in serious scenarios, criminal exposure. • Preventive engagement: A parallel push for con - trollers to seek early institutional engagement and compliance support, signalling an emphasis on prevention alongside sanctions. • Execution and collection focus: Increased attention to ensuring that sanctions are executed (including fine collection) and follow-ups on legacy matters previously treated as closed. • Reform-oriented posture: An expressed intention to pursue updates to the federal and general data protection framework, suggesting enforcement may be accompanied by a legislative and policy push. Privacy disputes in Mexico have not yet matured into a robust, standalone litigation stream. The legal system does not generally recognise a direct “private enforce - ment” action whose sole purpose is to vindicate data protection breaches in court. Rather, individuals who consider themselves affected typically need to frame their case as a civil liability claim, seeking damages for the harm allegedly caused by the relevant conduct. This private route operates on a different logic from administrative oversight. Regulatory proceedings are designed to protect the public interest through correc - tive measures and sanctions (notably fines), whereas civil litigation is intended to compensate the claimant. Accordingly, the remedy most frequently pursued is monetary compensation. Assessment is usually case- specific and tied to the proof and seriousness of the alleged impact, rather than to a bespoke statutory tariff for privacy harm. 2. Privacy Litigation 2.1 Privacy Litigation Overview
is expected to implement the ordered measures and report compliance. Conciliation may be promoted at any stage (subject to specific limitations). If the parties reach and com - ply with an agreement, the matter is generally closed without the need for a final decision on the merits. Verification Procedure Once verification is opened, the SABG typically begins with documentary information requests and may, where warranted, escalate to an on-site verifica - tion visit to confirm processing practices and controls. The overall verification stage is subject to a maximum duration of 180 days, with the possibility of an exten - Sanctioning usually follows findings from a rights- protection or verification matter. It starts with formal service of the alleged infringement, after which the alleged infringer is given an opportunity to respond and submit evidence. The authority then closes the evidentiary record, receives final submissions and issues a final resolution. The sanctioning procedure has an overall statutory decision period of 50 days, with the possibility of an extension for justified cause. Potential Sanctions and Remedies Depending on the nature of the breach, exposure may arise on three tracks: • Administrative sanctions: The SABG may issue orders (including warnings requiring corrective action) and impose fines, potentially multiple in a single matter. Where sensitive personal data is involved, the framework allows for fines to be doubled. • Criminal exposure: Certain profit-driven conduct (eg, causing a breach for gains) may trigger crimi - nal liability, with enhanced penalties where sensi - tive data is involved. sion for justified cause. Sanctioning Procedure • Civil liability (damages claims): Affected individuals may pursue damages claims under general civil liability rules, with remedies centred on compensa - tion rather than public sanctions.
315 CHAMBERS.COM
Powered by FlippingBook