MEXICO Law and Practice Contributed by: Luciano Pérez, Ana Paula Silva and Allan Pastor, Nader Hayaux & Goebel
AI System to co-ordinate efforts among public, private and academic sectors. The proposal remains pending before the Senate committees for further review. Furthermore, the Plenary of the Transparency, Access to Public Information, Personal Data Protection, and Accountability Institute of Mex - ico City, issued an initiative entitled the “Law for the Use of Artificial Intelligence (AI) and the Processing of Personal Data by Obligated Enti - ties in Mexico City”. This initiative aims to estab - lish principles, rules and procedures to ensure the protection of personal data in the devel - opment and use of AI systems. The proposed law incorporates international approaches from organisations such as the OECD and the Euro - pean Union’s AI Act, addressing key issues like cybersecurity, transparency, risk management and algorithmic audits in the use of AI. It also includes measures and sanctions for those mis - using personal data, ensuring the protection of fundamental rights in compliance with the Mexi - can DPRs. Although the initiative represents an advancement at a local level, it represents a significant step in Mexico’s legal framework to safeguard personal data in the digital age and in the use of AI systems. The initiative is pending review before the Congress of Mexico City. 1.6 Interplay Between AI and Data Protection Regulations In Mexico, AI regulation is in its early stages, with no specific legislation addressing the unique challenges posed by AI technologies. However, the DPRs indirectly apply to AI activities. These impose broad obligations that govern the collec - tion, processing, storage and transfer of person - al data, including sensitive personal data, which are relevant to AI systems that handle such data.
Data controllers ( responsables ), data subjects ( titulares ), personal data ( datos personales ) and data processing ( tratamiento ) are key concepts under the Mexican DPRs. These concepts are critical when considering the regulation of AI, as the processing of personal data is central to AI systems, which may collect, analyse or store large amounts of data. Mexican DPRs have a heavy emphasis on regu - lating data controllers and their actions. Accord - ingly, data controllers are bound by the princi - ples of lawfulness, loyalty, information, consent, quality, purpose, proportionality and responsi - bility. Compliance with these principles ensures that data controllers collect and process person - al data properly and implement the necessary measures to protect such personal data. These principles apply to AI systems as they ensure that any data collected or processed by AI sys - tems is carried out legally, transparently and with the consent of the data subject. In Mexico, it is not common to initiate private liti - gation related to data privacy conflicts. Instead, disputes concerning violations of personal data protection are typically resolved through the pro - cedures established before the INAI, as outlined in 1.3 Enforcement Proceedings and Fines . 2.2 Recent Case Law In Mexico, there is no significant or public recent or ongoing litigation related to data privacy under the framework of personal data protection laws. Unlike jurisdictions with a strong tradition of case law, such as the European Union and its CJEU jurisprudence concerning Articles 82 and 83 of the GDPR, Mexico primarily relies on 2. Privacy Litigation 2.1 General Overview
326 CHAMBERS.COM
Powered by FlippingBook