News

Mexico is on the verge of losing its current data protection authority

24 December 2024

Key takeaways

As a result of a recently approved constitutional reform, Mexico extinguishes its current Data Protection Authority and appoints a new one.

On December 20, 2024, the decree by which the INAI and 6 other autonomous constitutional bodies will eventually be extinguished (“Decree”) was published in the Official Gazette of the Federation. Previously, on November 28, 2024, amendments to the Organic Law of the Federal Public Administration (“OLFPA”) were published in the Official Gazette of the Federation to grant the necessary powers to the relevant authorities to implement such Decree.

The INAI had powers regarding transparency and protection of personal data. As a result of the Decree and the amendments to the OLFPA, both powers are transferred to the Ministry of Anticorruption and Good Governance (formerly the Ministry of Public Function). Currently, the specific area of said Ministry that will be in charge of personal data is unknown, but it will eventually be clarified through the publication of its Internal Regulations. It is important to note that the Decree seeks to extinguish the regulator, but the legal framework regarding the protection of personal data held by private entities remains (i.e. Federal Law for the Protection of Personal Data Held by Private Parties, its Regulations and the Privacy Notice Guidelines).

With regards to personal data in held by public institutions, the Decree mentions that said entities: i) will have sufficient powers to address personal data protection matters; and ii) will be governed by the general law on transparency and access to public information and protection of personal data in the terms issued by the Federal Congress.

Legal basis: Article 6(II) and (VIII) of the Constitution; Article 37(XIV) and (XV) of the OLFPA.

Authored by Federico De Noriega Olea and Ana Paula Rumualdo.

Next steps

The Decree entered into force the day after its publication in the Official Gazette of the Federation. The Federal Congress has 90 calendar days to issue the necessary adjustments to implement the Decree. Local Congresses have 90 calendar days also to align their regulations on transparency and protection of personal data with the Decree.

Once the amendments required to implement the Decree enter into force, the INAI will be extinct and the Federal Executive will issue the corresponding extinction decree.

The implications of this reform are broad and are yet to be fully defined. For the time being, the INAI will continue to process the matters that is currently handling. If such matters are not concluded before the amendments to the existing secondary legislation are issued, such matters will be transferred to the Ministry of Anticorruption and Good Governance for their continuation and conclusion.

The Decree establishes that public entities will be governed by the general law on transparency and access to public information and protection of personal data in the terms issued by the Congress of the Union. The foregoing could be construed as a mandate to issue a new regulation for public entities; however, Article 6(VIII), second paragraph of the Decree only substituted “autonomous agency” for “public entities”. We understand that there are no plans to issue a new regulation on data protection for public entities, nor a new legislation on transparency. So, the existing regulations would remain and only modifications would be made to adapt them to the Decree (i.e. General Law on Protection of Personal Data Held by Public Entities, Federal Law on Transparency and Access to Public Information and General Law on Transparency and Access to Public Information).