MEXICO Law and Practice Contributed by: Luciano Pérez, Ana Paula Silva and Allan Pastor, Nader Hayaux & Goebel
5. International Considerations 5.1 Restrictions on International Data Transfers Restrictions on International Data Issues The Mexican DPRs permit data transfers abroad, subject to compliance with the information and the consent requirements in the Mexican DPRs. However, it is stated that general requirements apply, even in international data transfers. Mexi - can DPRs also require international data transfer receivers to assume the same obligations and responsibilities as the original controller. Mechanisms or Derogations That Apply to International Data Transfers Mexican DPRs allow data controllers to use and dispose of any legal instruments to fulfil their obligations. Contract clauses are the first and only tools named explicitly in the Mexican DPRs that data controllers may rely on to meet their international obligations when performing data transfers. As a general rule, these clauses must provide at least that: • the data receiver must agree to submit to the same obligations as the original data control - ler; and • the data receiver must agree and acknowl - edge the authorisations granted by the data subject in the privacy notice. The data controller can also request the INAI’s opinion regarding international data transfers. If deemed necessary, the data controller may submit a request to determine whether the data transfer complies with the Mexican DPRs. Government Notifications and Approvals There are no government notifications or approv - als required to transfer data internationally. The data controller will have to include the transfers
of personal data in the privacy notice in order to inform the data subject. Data Localisation Requirements There are no specific data localisation require - ments, nor do the Mexican DPRs contemplate the need to store personal data in-country. Therefore, it is possible to transfer data inter - nationally; however, data controllers are still required to implement measures to safeguard the data and comply with the requirements for the transfer of personal data established in the DPR, such as the provision of the privacy notice to the data receiver. Sharing Technical Details According to the Public DPRs, governmen - tal authorities must conduct a privacy impact assessment in certain cases and submit it to them. Limitations and Considerations There are no specific requirements for foreign government data requests. Therefore, it is possi - ble to transfer data internationally; however, data controllers are still required to comply with the requirements for the transfer of personal data established in the DPRs. 5.2 Government Notifications and Approvals There are no government notifications or approv - als required to transfer data internationally. The data controller will have to include the transfers of personal data in the privacy notice in order to inform the data subject. 5.3 Data Localisation Requirements There are no specific data localisation require - ments, nor do the Mexican DPRs contemplate the need to store personal data in-country. Therefore, it is possible to transfer data inter -
330 CHAMBERS.COM
Powered by FlippingBook