MEXICO Law and Practice Contributed by: Luciano Pérez and Allan Pastor, Nader Hayaux & Goebel
2.2 Recent Case Law Unlike other jurisdictions, Mexico does not rely on case law to apply data privacy regulation. However, recent resolutions issued by Mexico’s Supreme Court of Justice ( Suprema Corte de Justicia de la Nación ) have addressed modern issues, such as the role of search engines as intermediaries in internet access, their processing of personal data, and the implications for free speech rights. 2.3 Collective Redress Mechanisms Mexican data protection law does not provide for col - lective administrative proceedings. Where a breach causes harm and civil liability arises, data subjects may pursue claims under the civil framework. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation Non-personal data generally falls outside the scope of the Private and Public DPRs, which apply only to the processing of personal data. Information labelled “non-personal” may still be treated as personal data where individuals can reasonably be identified from the dataset itself or by linkage with other data. By con - trast, data that has been robustly dissociated, such that identification is not possible, will typically remain outside the data protection regulations. Mexico does not have a dedicated, cross-sector legal framework governing non-personal data access and sharing (including for IoT or cloud environments). Instead, non-personal data governance is primarily driven by general legal protections (notably confiden - tiality and trade secrets), sector-specific rules (such as financial secrecy and open finance for Mexican financial institutions), cybersecurity expectations, and contractual boundaries among data holders, service providers and data users. 3.2 Interaction of Data Regulation and Data Protection Where a dataset includes both personal and non- personal elements, the approach is essentially cumu - lative: privacy rules govern the personal-data layer, while other legal regimes govern the non-personal
value layer (confidentiality, trade secrets and IP), with contracts typically co-ordinating how these obliga - tions operate in practice. Overall, the interaction is less about statutory “data access rights” and more about layering: the Private DPRs set the compliance perimeter for identifiable information; confidentiality and IP rules protect the commercial value of non-personal datasets, as well as contractual arrangements allocate rights, responsi - bilities and risk among data holders, service providers and data users. 3.3 Rights and Obligations Under Applicable Data Regulation Unless a dataset has been properly dissociated so that individuals are no longer identifiable, the pro - cessing will generally fall within the scope of the data protection regime, and the primary rights available to individuals are the ARCO Rights. 3.4 Regulators and Enforcement Under Mexico’s current framework, non-personal data is not overseen by a single, cross-sector regulator; instead, the applicable rules and enforcement authori - ties vary depending on the nature of the dataset and the sector in which it is used. The Private DPRs require data controllers to inform data subjects when using remote or local electronic, optical or other technologies that automatically and simultaneously collect personal data upon interaction, such as cookies. This notification must be provided at the moment of contact through a visible communica - tion or warning that details the use of such technolo - gies, the data collected, and how to disable them. 4.2 Personalised Advertising and Other Online Marketing Practices Personalised and targeted advertising under the Pri - vate DPRs is regulated in the same way as other data processing. A key aspect is the distinction between primary and secondary purposes: processing that is necessary to provide the product or service request - 4. Sectoral Topics 4.1 Use of Cookies
316 CHAMBERS.COM
Powered by FlippingBook