Algunas de las obligaciones que incorpor\u00f3 el GDPR, que no est\u00e1n previstas a\u00fan en la regulaci\u00f3n mexicana, son:<\/p>\n
- \n
- El derecho a la portabilidad, el cual faculta al titular a obtener una copia de sus datos personales tratados por el responsable;<\/li>\n
- Introduce el principio de protecci\u00f3n de datos desde el dise\u00f1o (Privacy by Design);<\/li>\n
- Establece obligaciones expresas respecto del consentimiento de un ni\u00f1o menor a 16 a\u00f1os; y<\/li>\n
- Obligaciones y requisitos nuevos en caso de que el responsable utilice tecnolog\u00edas novedosas en el tratamiento de datos.<\/li>\n<\/ol>\n
Como sugerencia, las Entidades mexicanas que puedan obtener y tratar datos de residentes de la UE o las subsidiarias mexicanas de empresas internacionales, deben analizar el impacto del GDPR en sus operaciones en M\u00e9xico, y considerar fortalecer su r\u00e9gimen de protecci\u00f3n de datos personales, para cumplir con los est\u00e1ndares internacionales, incluyendo el GDPR, para evitar contingencias y multas.<\/p>\n
The General Data Protection Regulation (GDPR) of the European Union and its implications in Mexico<\/h3>\n
The exponential technological advances in recent decades, in particular the use of big data and digital services, enhanced by the new dynamics imposed by the health emergency derived from the pandemic, have stressed the current regulation on personal data protection, which has led authorities worldwide to question whether a stricter protection regime is required.<\/p>\n
At the head of the trend, the European Union adopted on May 25, 2016, the General Data Protection Regulation (“GDPR”). The GDPR repealed the 1995 European Union (the “EU”) Data Protection Directive (Directive 95\/46 \/EC) (the “EU Directive”), with the purpose to provide more strict regulation regarding the protection of personal data.<\/p>\n
The GDPR is mandatory for: (i) entities established within the EU, and (ii) entities resident outside the EU, which offer their products or services to EU citizens.<\/p>\n
Mexico, following the principles of the EU Directive, published on July 5, 2010, the Federal Law for the Protection of Personal Data in Possession of Individuals, and subsequently, the secondary regulation (the “Data Law”).<\/p>\n
The Data Law has not been homologated to the GDPR; however, Mexican individuals and companies may be required to comply with the GDPR if (i) they offer and deliver products or services on a regular basis to EU residents, or (ii) they use tools that allow them to track cookies or IP addresses of people visiting their website from EU countries.<\/p>\n
In case of breach, Mexicans individuals or entities, or their affiliates located in the EU, may be subject to penalties under the GDPR. Fines can be up to \u20ac20 million or 4% of the annual revenue. During the three years in which the GDPR has been in force, the European Commission has imposed 680 fines, amounting to more than \u20ac287 million.<\/p>\n
The Data Law and the GDPR share substantially the same principles:<\/p>\n
- \n
- The obligation to obtain the prior consent of the owner for the processing of his\/her personal data;<\/li>\n
- The obligation to have a privacy notice and to deliver it to the owner prior to the processing of his\/her data;<\/li>\n
- The terms in which the owner may exercise his\/her rights of Access, Rectification, Cancellation and Opposition (the “ARCO Rights”);<\/li>\n
- The incorporation of the concepts of (i) the data controller (Responsable), who is the person that decides on the processing of the personal data of the owner, and (ii) the data processor, who is the person that process the data on behalf of the data controller; and<\/li>\n
- The obligation to appoint a Data Protection Officer who will be in charge of supervising compliance with the regulation.<\/li>\n<\/ol>\n
Some of the new obligations incorporated by the GDPR, which are not included yet in the Mexican regulation, are:<\/p>\n
- \n
- The portability right, which entitles the owner to obtain a copy of his\/her personal data processed by the Controller;<\/li>\n
- Introduces the principle of data protection by design (Privacy by Design);<\/li>\n
- Incorporates express obligations regarding the consent of minors under 16 years of age; and<\/li>\n
- New obligations and requirements if the data controller implements new technologies in the processing of the data.<\/li>\n<\/ol>\n
As a suggestion, Mexican companies that might obtain and treat data from EU residents or Mexican subsidiaries of international companies, must evaluate the impact of the GDPR in their operations, and consider strengthening their personal data protection regime to comply with international standards, including the GDPR, to avoid any contingencies or fines.<\/p>\n
(1) GDPR Enforcement Tracker al 2021; https:\/\/www.enforcementtracker.com\/?insights<\/a><\/p>\n
Para mayor informaci\u00f3n sobre el GDPR y el r\u00e9gimen de protecci\u00f3n de datos personales en M\u00e9xico, nos ponemos a sus \u00f3rdenes con sus contactos habituales en Nader, Hayaux & Goebel.<\/p>\n
Luciano P\u00e9rez G\u00f3mez<\/a><\/p>\n
+52 (55) 4170 3027<\/p>\n
lperez@nhg.com.mx<\/a><\/p>\n
<\/p>\n
![\"image_pdf\"](\"https:\/\/www.nhg.mx\/wp-content\/plugins\/pdf-print\/images\/pdf.png\" "\\"View")
<\/a>![\"image_print\"](\"https:\/\/www.nhg.mx\/wp-content\/plugins\/pdf-print\/images\/print.png\" "\\"Print")
<\/a><\/div>","protected":false},"excerpt":{"rendered":"Los avances tecnol\u00f3gicos exponenciales vistos en las \u00faltimas d\u00e9cadas, en particular el uso de big data y servicios digitales, potencializado por la nueva din\u00e1mica impuesta por la emergencia sanitaria derivada de la pandemia, han puesto mucha presi\u00f3n en la regulaci\u00f3n de protecci\u00f3n de datos personales, lo que ha hecho que las autoridades a nivel global…<\/p>\n