MEXICO Law and Practice Contributed by: Luciano Pérez and Allan Pastor, Nader Hayaux & Goebel
ed by the individual will be categorised as primary, whereas advertising, commercial prospecting and similar activities will generally fall within secondary purposes (subject to a case-by-case assessment). Where marketing or profiling is treated as a second - ary purpose, the data controller must ensure that it is clearly disclosed in the privacy notice and that individuals are given straightforward mechanisms to withhold consent or withdraw consent for those purposes. Individuals may exercise the right of oppo - sition to processing for secondary purposes, which is particularly relevant where profiling or behavioural targeting is involved. Additional sensitivity arises in two scenarios. Firstly, it applies where marketing relies on sensitive personal data. Secondly, where advertising relates to minors, controllers should apply a heightened standard of care and avoid practices that could be seen as undermin - ing a child’s best interests, as discussed in 1.3 Special Categories of Personal Data . 4.3 Employment Privacy Law Mexican data protection rules apply to employers in the same way they apply to any other data control - ler. Accordingly, an employer that collects or uses employee or candidate information must comply with the Private DPRs throughout the employment life- cycle. In practice, this means that workplace monitoring and the use of IT systems should be structured around necessity and proportionality. Although corporate devices and accounts are work tools, employees retain privacy interests, and monitoring should be limited. 4.4 Data Protection in M&A In M&A transactions, the regular data privacy require - ments apply. Personal data often becomes part of the due diligence exercise, the integration planning and – depending on the structure – the assets being acquired. Where that is the case, the parties should also treat data protection as a discrete workstream and implement controls designed to ensure compli - ance with the Private DPRs throughout the deal cycle.
In practice, companies should consider the following steps: • Confirm whether personal data is in scope (and at what sensitivity). (a) Identify whether the transaction involves personal data at all, and whether any sensitive personal data is implicated. (b) Map the categories of data likely to be re - viewed or transferred (eg, employee, customer, supplier, health, financial, geolocation). (c) Confirm that the contemplated uses of the data (diligence, valuation, integration) align with the principles of purpose limitation and proportion - ality. • Define how, when and by whom the data will be accessed. (a) Determine where relevant datasets are stored and how they will be made available (eg, data room, clean teams, extracts, redacted sam - ples). (b) Identify the recipients (deal team, advisers, au - ditors, consultants, potential buyers) and apply need-to-know access controls. (c) Clarify where the data will be held during the process and after closing, including any cross- border elements. • Implement deal-specific safeguards and documen - tation. (a) Put in place appropriate confidentiality and data-handling terms, including restrictions and covenants on processing, onward disclosure, retention and deletion/return. (b) Where the buyer (or advisers) will process data on behalf of the seller, adopt suitable processor-type controls; where disclosure is to an independent recipient, ensure the transfer is properly documented and consistent with the applicable privacy notice and any required consents. (c) Apply stricter controls where sensitive data is involved, including tighter access, segmenta - tion and enhanced security measures. • Assess security posture and breach history. (a) Identify prior security incidents affecting rel - evant datasets and evaluate any open remedia - tion items. (b) Assess foreseeable breach risks at three points
317 CHAMBERS.COM
Powered by FlippingBook