MEXICO Law and Practice Contributed by: Luciano Pérez, Ana Paula Silva and Allan Pastor, Nader Hayaux & Goebel
In cases of violations relating to the process - ing of sensitive personal data, the Public DPRs provide no specific penalty for their violation. As such, the focus is directed towards the rel - evant authorities and their respective legislation. Therefore, each case must be analysed on an individual basis. The INAI has certain processes at their disposal that can be initiated to supervise compliance with the Mexican DPRs. The regulator may initi - ate inspection visits or verification proceedings at any moment in response to any alleged viola - tions of the Mexican DPRs, which may arise from a complaint by a data subject or from its own investigation. Other authorities can initiate the verification proceedings detailed in the Public DPRs and any other DPRs regulated in their cor - responding state law. During enforcement procedures, data controllers have the burden of proof. Individuals and entities subject to the Mexican DPRs are responsible for providing evidence that supports all their claims, arguments and defences regarding their compli - ance. Therefore, data controllers must maintain appropriate security and record-keeping prac - tices. Since privacy and data protection violations are reviewed and penalised specifically through administrative procedures, there is no civil recourse to enforce privacy or data protection under the Mexican DPRs. However, Mexican legislation allows data subjects to pursue com - pensation through civil courts by claiming dam - ages and lost profits derived from the violation of the Mexican law. 1.4 Data Protection Fines in Practice In 2023, the INAI reported imposing fines total - ling nearly MXN47 million on individuals and
entities that violated the DPRs. Among the most heavily sanctioned sectors were financial and insurance services, which faced penalties amounting to nearly MXN22 million. There is no public information on fines imposed during 2024. This lack of reporting may be attrib - uted, in part, to a significant budget reduction in 2024, which adversely affected the INAI’s ability to exercise its sanctioning powers effectively. 1.5 AI Regulation In the past few years, Mexico has been address - ing the challenges and opportunities posed by AI. While the country lacks AI-specific legisla - tion, several initiatives and frameworks have been introduced to regulate AI’s development and application, particularly in the context of data protection. The Mexican DPRs do not specify AI-related obligations; however, the obligations they regu - late are broad and applicable to AI activities. This creates a framework that, while not explicitly tai - lored to AI, can be applied to certain aspects of AI-related operations. In the last four years, more than 50 legislative initiatives, ranging from constitutional reforms to proposals for specific laws related to AI, have been introduced. However, none have pro - gressed. The most recent initiative was presented on 13 December 2024 by Senator Juanita Guer - ra Mena. This initiative proposes to issue the National Law Regulating the Use of Artificial Intelligence (AI). The initiative aims to define AI, establish a national policy for its use, outline guiding principles such as privacy by design and transparency, and create both a National Centre for Artificial Intelligence and a National
325 CHAMBERS.COM
Powered by FlippingBook