Data Privacy Event. Mexican Data Protection Law. February 13, Brussels, Belgium

Transcription

1 Mexican Data Protection Law February 13, 2014 Brussels, Belgium

2 Data Privacy in Mexico Page 2

3 Timeframe of the Mexican Data Privacy Legal Framework IFAI Art 16 const & local laws DPL and IFAI Rules on DPL Guidelines for privacy notice and specifications for BCR Membership to the OECD (j. 1994) & compromise assumed under the Free Trade Agreement with the EU (2000) 2009 Constitutional reform (privacy & data protection as constitutional right) 2010 DPL is enacted as a federal regulation (nationwide enforceability) Meets International Standards of the Madrid Resolution of Nov Meets OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data Regulator: IFAI (double function as in UK, Switzerland & Hungary) Ancillary regulations and guidelines followed Still to come: certifiers, e-reports & complaints, registration of BCR Page 3

4 Body of Law comprised of Data Protection Law ( Ley Federal de Protección de Datos Personales en Posesión de Particulares ) July 2010 Rules on the DPL ( Reglamento ) December 2011 Guidelines on Privacy Notice ( Aviso de Privacidad ) and Specifications for BCR ( Esquemas de Autoregulación Vinculante ) and Certifiers IFAI recommendations on a Personal Data Security Management System Establishment of Electronic System for Reports and Complaints (not yet in operation) January 2013 October 2013 November 2013 Rules of Operation of the RAE (BCR Registry) and Certifiers Expected: January 2014 (originally: July 2013) Page 4

5 Scope of the Mexican DPL Page 5

6 Scope of the Mexican DPL (contd) Protection of personal data in the private sector (individual or legal person handling personal data in Mexico) International principles: Collection Limitation, Data Quality, Purpose Specification, Use Limitation, Security Safeguards, Openness, Individual Participation & Accountability. Consent could be implied (general data) or express: opt-in (financial and sensitive data) Privacy Notice ( Aviso de Privacidad ) Specific focus on Sensitive Data ARCO Rights (Access, Rectification, Cancellation or right to be forgotten and Opposition) Mechanism for exercising ARCO rights with data controller Data controller and processor must implement security measures & internal policies Appointment of Data Protection Officer or Committee (no registration required) Page 6

7 Scope of the Mexican DPL Flexible system (APEC privacy standards): Obligation to carry out a personal data inventory although no obligation to register it Allows international transfer of personal data without prior authorization from IFAI Sets specifications for BCR to facilitate compliance BCR need not be authorized by IFAI BCR could soon be registered with IFAI (effect: reduced fines in the event of review) Immediate notification to IFAI and data subjects of data breaches Data protection procedure with IFAI High fines for breaches and penalties for criminal offenses Access to courts to contest IFAI resolutions Page 7

8 Fines & Penalties Page 8

9 Fines & Penalties Enforcement Level (IFAI) Fines: monetary penalties from approx up to approx. 4, per breach, and up to 8, when Sensitive Data is involved. Penalties: Criminal offenses may be punished from 6 months up to 3 years, and up to 6 years when Sensitive Data is involved. Recent and/or relevant Fines: Telecommunications (Telcel): 350,102 September, 2013 Bank (Banamex): 928,667 August, 2013 Private Practice Doctor: 2,341 May 2013 Retail drug store (Farmacia San Pablo) 139,754 November 2012 Page 9

10 Thank you

11 EY Assurance Tax Transactions Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com EYGM Limited. All Rights Reserved. EYG no. ED ED None This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax, or other professional advice. Please refer to your advisors for specific advice. ey.com