On April 16, 2021, the Mexican federal government published an important Decree in the Official Journal of the Federation to amend and supplement the Mexican Federal Telecommunications and Broadcasting Law.
The Decree provides for the creation of a National Mobile Phone Users Registry (PANAUT for its acronym in Spanish), which consists of a governmental database containing detailed information for every mobile phone line in Mexico. The database will include the information of individuals and business entities with mobile phone lines and will be used in cooperation with relevant authorities for crime prevention.
A key obligation requires mobile phone companies to collect biometric data from mobile phone owners, whether such is an individual or business entity, for each mobile phone line.
Mexico does not have a legal definition for the term “biometric data”; however, the Guide for the Handling of Biometric Data issued by Mexico’s National Institute for Access to Information and Data Protection (INAI for its acronym in Spanish) states that biometric data is “the physiological and behavioral or personality traits of an individual which are subject to measurement”, the same which includes: fingerprints, the face, retinae, iris, voice, etc.
It has become increasingly common to use biometric data as the login key for bank accounts, credit and debit cards, savings accounts and generally in various types of financial transactions. This data is also used to access certain workplaces, personal computers, and mobile devices, among other related uses. The protection of such information has become an increasingly important fundamental right.
The new Decree entered into force the day following its publication and impacts two different situations: (i) for mobile phone lines activated prior to the entry into force of the Decree, mobile phone companies will have a period of two years to collect required biometric data and other relevant information from their respective users; and (ii) for mobile phone lines activated after the entry into force of the Decree, the mobile phone user must provide, among other information, his or her biometric data to successfully activate the line.
Mobile phone users who fail to register with the PANAUT during the prescribed periods will be subject to immediate mobile phone line cancellation, without the possibility of reactivation, and without the right to any monetary compensation.
The Mexican Federal Telecommunications Institute is required to issue the general guidelines for the operation of the registry within 180 days from the publication of the Decree.
Accordingly, mobile phones users in Mexico will have to decide whether to provide their biometric data, considering the inherent risks to their privacy and to the handling of their personal information, or to not have a mobile phone line.
Given its purpose, the scope of the Decree appears to be overly broad, because it appears to pose serious risks for the information of individuals and business entities and their fundamental privacy rights.
Please contact us if you would like to know more about how the PANAUT may affect your business and the possible legal recourse you may have.
Contact Information:
Felipe Chapula Almaraz | fchapula@ccn-law.com.mx
Jorge Sánchez Cubillo | jcubillo@ccn-law.com.mx
