CREEL, GARCÍA-CUÉLLAR, AIZA Y ENRÍQUEZ S.C.
The Decree issuing the General Law for the Protection of Personal Data in the possession of Obliged Subjects in Mexico will enter into force on January 27, 2017.
The Decree issuing the General Law for the Protection of Personal Data in the possession of Obliged Subjects (“LGPDPPSO”) was published yesterday and will enter into force on January 27, 2017.
The regulatory authority empowered to exercise the provisions of the LGPDPPSO is the National Institute for Transparency, Access to Information and Protection of Personal Data (“INAI“), which at the same time regulates and enforces the Federal Transparency and Personal Data laws that precede the LGPDPPSO.
The LGPDPPSO is part of the set of statutes that supports the National System of Transparency, Access to Public Information and Protection of Personal Data (“National Transparency System“), together with the General Law on Transparency and Access to Public Information And the Federal Law on Transparency and Access to Public Information, which must comply with the provisions of the LGPDPPSO, within six months of its entry into force.
In addition, the National Transparency System is an essential part of the National Anticorruption System, which was published on July 18, 2016.
The purpose of the LGPDPPSO is to establish the principles and procedures for guaranteeing the right of everyone to the protection of their personal data when they are in the possession of any authority, entity, body or agency of the executive, legislative and judicial branches, either at the federal, state and municipal levels, as well as autonomous bodies, political parties, trusts and public funds (identified as “Obliged Subjects“).
The LGPDPPS introduces provisions on data portability and regulates the relationship between the Obliged Subjects, as data controllers, and those who intervene as data processors. In the same way it regulates transfers and remissions of personal data; establishes preventive actions during the process; means for contesting unlawful processing of personal data and sanctions, as well as a verification procedure that can be initiated ex officio by the INAI.
It contemplates an obligation for the authorities of the National Transparency System, to issue a “National Program for the Protection of Personal Data” within the term of one year after the entry into force of the LGPDPPS.
It establishes the duty for the Obliged Subjects, to process, issue or modify their internal regulations at the latest within eighteen months following the entry into force of the LGPDPPSO.
The entry into force of the LGPDPPSO, derogates all provisions regarding the protection of personal data of a federal, state and municipal level that contravene the provisions of the LGPDPPSO.
Personal data in possession of individuals or legal entities (including trade unions/any other natural or legal person who receives and exercises public resources) will continue to be processed in accordance with the Federal Law on the Protection of Personal Data held by Private Parties.
The information provided merely highlights what we considered some of the most relevant topics contained in the recent amendments. Should you have any questions as to how the new LGPDPPSO could impact you, feel free to contact our partner Begoña Cancino at:
Tel: (52-55) 4748-0679
*This article or news brief does not constitute legal advice and is protected by copyright.