Privacy International defends the right to privacy across the world, and fights surveillance and other intrusions into private life by governments and corporations. Read more »


I. Legal Framework

The Constitutional Framework

The Constitution protects the right to privacy, which traditionally includes the inviolability of the domicile and correspondence. The Constitution protects the person, his/her family, documents or possessions, and the confidentiality of correspondence; the immunity can only be broken by written order of the competent authority (Article 16).

Article 16 of the Constitution of 1917 provides, in part:

One's person, family, home, papers or possessions may not be molested, except by virtue of a written order by a proper authority, based on and motivated by legal proceedings.

In all search warrants, that only the judicial authority will be able to produce, it must be written expressly the place to be inspected, the person or people to be arrested and the objects searched for, so as to limit to the stated issues the proceedings, and in concluding them, a detailed record must be written in the presence of two witnesses proposed by the occupant of the place that was inspected or in their absence or refusal, by the authority that practiced the proceedings.

Private communications are inviolable. The Law will provide a criminal sanction to any act that attempts against the freedom and privacy of private communications. Exclusively the federal judicial authority, at the request of the federal authority empowered by the law or by the holder of the Ministerio Público (Prosecutor Authority) of the corresponding federal entity, will be able to authorize the intervention of any private communication. The competent authority, in written, will have to find and motivate the legal causes of the request, and also the kind, the subjects, and the duration of the intervention. The federal judicial authority will not be able to grant these authorizations in issues of electoral, fiscal, mercantile, civil, labour, or administrative character, or in the case of the communications of the person under arrest with his/her defender.

The authorized interceptions will adjust to the requirements and limits anticipated in the law. The results of the interventions that do not fulfil these requirements will lack all value as evidence.

The administrative authority may make home visits only to certify compliance with sanitary and police rules; the presentation of books and papers indispensable to verify compliance with the fiscal laws may be required according to the respective laws and formalities prescribed for their inspection. Correspondence will be free from all inspection, and its violation will be punishable by law.1

Currently, two proposals for Constitutional amendment have been proposed. The first, presented before the Senate, adds several paragraphs to article 16 of the Federal Constitution, expressly acknowledging the right to personal data protection as a fundamental right.2 The proposal passed the Senate during the last legislative session, and was introduced before the House of Representatives; however, the bill is still awaiting approval. The second proposal was introduced in March 2007. The bill modifies article 73 of the Constitution in order to grant to Congress the power to legislate on personal data protection held by private entities.3

Data protection framework

There are 34 federal laws that deal with privacy issues and personal data protection in Mexico.4 The most recent enactments are related to finance and banking, consumers' rights, credit information, telecommunications and national security. The Federal Law of Transparency and Access to the Government Public Information (LFTAIPG)5 standardized the principles under which the diverse organs of the State must process citizens' personal data, including especially the safeguard of the consent and purpose specification principles, and the guarantee of the rights of access and correction. However, the law lacks sufficient protections to provide greater levels of security for the processing of private data; better and suitable law enforcement mechanisms and authorities are needed.

There is not yet a comprehensive data protection law in Mexico. Provisions in the Federal Consumer Protection Law, however, place restrictions on direct marketing and credit reporting agencies. The first Mexican E-Commerce law took effect on May 29, 2000. The decree amended the Civil Code, the Commercial Code, the Federal Code of Civil Procedure, and the Federal Consumer Protection Law (FCPL), the Rules of Civil Procedure and the Consumer Protection Act. It covers consumer protection, privacy, digital signatures and electronic documents. The decree includes an article in the Federal Consumer Protection Law giving authority to the government "to provide for the effective protection of the consumer in electronic transactions or concluded by any other means, and the adequate use of the data he provides " (Article 1.VIII); and to coordinate the use of the Code of Ethics by providers, including the principles of this law. The decree also created a new chapter in the FCPL entitled: "Rights of Consumers in electronic transactions carried out through electronic or optical means or through any other technology."6

Every professional is strictly obliged to keep the secrets of matters entrusted by his/her clients, except for the compulsory information set forth in other laws (Article 36 of the Regulation of Article 5 of the Federal Constitution pertaining to the Exercise of Professions in the Federal District (Ley Reglamentaria del Artículo 5 Constitucional)).7

The Federal Consumer Protection Law (Ley Federal de Protección al Consumidor or FLCP) aims at protecting consumers who carry out transactions through the use of conventional, electronic, optic means, or any other technology (Section VIII, Article 1).8 The customer should always know the kind of personal data that the commercial providers have collected from him. This right includes free access to that data and the right to correct it, including the right to know who are the third party companies that know the customer's personal data (Article 16).9 Commercial messages or advertising sent to consumers should indicate the business's contact information and the name of the Procuraduría Federal del Consumidor (Consumers Protection Agency, or PROFECO) (Article 17).10 The consumer is entitled to directly opt out from any business's direct marketing scheme. PROFECO may develop, where applicable, a consumers' public registry listing all persons who opted out (Article 18).11 Businesses are prohibited from using consumers' personal information for marketing or advertising purposes if their names are on the PROFECO's opt-out list or if consumers have directly requested opt-out from them (Article 18bis).12 Businesses must protect the confidentiality of information that consumers provided to them. They shall not disclose it or transmit it to third parties except with the consumer's express written authorization (opt-in) or by petition of a judicial authority (Section I, Article 76bis). Authorities and tribunals are prohibited from obtaining information on merchants' private accounting systems (Article 42 of the Code of Commerce (Código de Comercio)).13

People are entitled to have their data rectified when incomplete, inaccurate or obsolete, and have the right to complain before administrative and judicial authorities when the principle of confidentiality has been breached.14 The information and data disclosed by individuals for statistical purposes, or coming from civil or administrative registries, shall not be communicated in any nominative form. It shall not be used as evidence before any administrative or fiscal authority.15

The General Population Act regulates the National Registry of Population and Personal Identification.16 The purpose of the Registry is to register all persons making up the country's population using data enabling their identity to be certified reliably. The aim is ultimately to issue the citizen's identity card, which will be the official document of identification, fully endorsing the data contained in it concerning the holder.17 When a person is incorporated in the National Registry of Population, an identification keyword is assigned to the citizen.18 This keyword is used to register and identify Mexicans on an individual basis. That identification has the particularity of conferring a unique code for each citizen with which one can have direct access to multiple personal data. A unique code increases the risk of file interconnection.19

All documents and information provided by citizens to the Federal Electoral Registry shall be held strictly confidential and shall not be communicated or disclosed, except when the Federal Electoral Institute is a party in legal trials, remedies or proceedings and acts to comply with its legal obligations or upon the petition of a competent judge.20