MEXICO Law and Practice Contributed by: Luciano Pérez, Ana Paula Silva and Allan Pastor, Nader Hayaux & Goebel
adequate to the situation at hand. Although communication tools, such as corporate e-mails or mobile phones, are considered work instru - ments, privacy remains a crucial issue. There - fore, clear and precise procedures must be established, which must be communicated to employees in advance in compliance with Mexi - can DPRs. Whistle-Blower and Anonymous Reporting Internal complaint systems must always com - ply with the Mexican DPRs and their principles. However, given the nature of the relationship between employer and employee, the fulfilment of obligations as data controllers acquires new elements, eg, proportionality will require that data processing and complaints should focus exclusively on the employment relationship to maintain the principle of proportionality. Addi - tionally, acting in a manner that protects the reporter’s interests is essential to protect the principle of loyalty. Labour Unions Labour unions must follow the same principles provided in the DPRs and must ensure the pro - tection of their members’ information. 4.4 Transfer of Personal Data in Asset Deals In Mexico, data processing during asset deals are subject to the obligations set forth in the DPRs. When personal data is processed or pro - cessed as part of an asset deal, specific meas - ures must be implemented to ensure compliance with the DPRs. Typically, in asset deals the parties perform a due diligence process to identify any personal data that will be transferred and processed dur - ing the deal and verify if the parties are comply - ing with their data privacy obligations to ensure
security. In this regard, companies should map the personal data being transferred to determine its type, source, and purpose of processing to identify any potential risks or compliance issues that must be addressed during the asset trans - action. The parties must have the consent of the data subjects to use and transfer their personal data for purposes of the asset deals and must have provided their privacy notice to the data sub - jects. If the asset deal involves the transfer of personal data between different entities, it is a common practice to execute a data processing agree - ment between the buyer and seller to regulate the responsibilities, security measures and other relevant obligations concerning data processing. This agreement should clarify the purposes of processing, data retention periods and security requirements. After an asset deal, the buyer must integrate the personal data from the seller’s systems, ensur - ing compliance with Mexican DPRs, especially regarding data security and the rights of data subjects. Data subjects maintain their ARCO Rights, and the buyer must ensure they can exer - cise these rights. Both parties are responsible for implementing adequate security measures, such as encryption and secure data transfer pro - tocols, and must have procedures in place to address data breaches, notify affected individu - als and report to the relevant authorities.
329 CHAMBERS.COM
Powered by FlippingBook