MEXICO Law and Practice Contributed by: Luciano Pérez, Ana Paula Silva and Allan Pastor, Nader Hayaux & Goebel
4.2 Personalised Advertising and Other Online Marketing Practices Pursuant to the DPR, if the data controller pro - cesses personal data for purposes that are not necessary or give rise to the legal relationship between the data controller and the data sub - ject, these will be considered secondary pur - poses (marketing communications, spam email, advertising, call, texts, commercial prospecting, among others). The data subject has the right to deny or revoke their consent, as well as to oppose the process - ing of their personal data when the processing is for secondary purposes. These secondary purposes will have to be included in the privacy notice as well as the means by which the data subject may exercise the right to deny, revoke and oppose the processing for such purposes. In the context of personalised advertising, the collection of sensitive and non-sensitive data for profiling is permissible only when data subjects are properly informed about the nature of the data processing and when consent is obtained. This is done through privacy notices, which must clearly explain the purpose of data collection and processing, including advertising purposes. 4.3 Employment Privacy Law Workplace Privacy Mexican DPRs apply to the data that is pro - cessed by the employer the same as any other data controller. This implies that the employer must comply with all the corresponding require - ments and obligations of the Mexican DPRs when processing the personal data of their employees. Communications Monitoring In general, surveillance and supervision in work environments must always be proportional and
• Third-party compliance: verify that any third- party data processor or recipient of personal data adheres to the Mexican DPRs and aligns with the terms of the controller’s privacy notice. 3.4 Regulators and Enforcement Currently, as described in 1.2 Regulators , the INAI is the authority responsible for enforc - ing data regulation in Mexico. However, the amendment to the Federal Mexican Constitu - tion will lead to the dissolution of the INAI as a government agency. Consequently, the Mexican Congress, through upcoming amendments to secondary provisions, will create new regula - tory entities that will assume the responsibilities previously held by the INAI. In Mexico, cookies are defined in the Mexican DPRs as a data file stored on the hard drive of a user’s computer or electronic communica - tion device when browsing a specific website, which enables the exchange of state informa - tion between the site and the user’s browser. The state information may reveal session identifiers, authentication or user preferences, as well as any data stored by the browser regarding the website. 4. Sectoral Issues 4.1 Use of Cookies The DPRs oblige data controllers to inform data subjects when using remote or local electronic, optical or other technologies that automatically and simultaneously collect personal data upon interaction, such as cookies. This notification must be provided at the moment of contact through a visible communication or warning, detailing the use of such technologies, the data collected and how the cookies can be disabled.
328 CHAMBERS.COM
Powered by FlippingBook