Data Protection: Compensatory Measures to Comunicate Privacy Policy Without the Authorization of the IFAI

The purpose of the General Criteria is to have a general framework to implement, without express authorization of the Federal Institute for Information Access and Data Protection (“IFAI”), certain compensatory measures for the massive communication of the Privacy Policy when such delivery is either impossible or requires disproportionate efforts from Controller, and which derives from the provisions of Article 18, last paragraph, of the Federal Law of Protection of Personal Data in Possession of Individuals (the “Law”), and Article 32, first paragraph, of its Regulations (the “Authorized Compensatory Measures”).

CONDITIONS TO APPLY GENERAL CRITERIA

The Authorized Compensatory Measures shall be applied only when (i) the Controller has obtained personal data before the obligation to issue the Privacy Policy became effective on July 6, 2011, regardless the data was obtained from the Data Subject, or indirectly from another source (e.g. data transfer); (ii) the delivery of the Privacy Policy to the Data Subject is impossible or requires disproportionate efforts from Controller; and (iii) the purpose for data processing remains the same, or is for a similar or compatible purpose.

Controller can implement the Authorized Compensatory Measures to the extent that it is in compliance with the Quality Principle established in the Law and its Regulations, and, therefore, must cancel processing of any personal data that is no longer required to fulfill the purpose that gave origin to their processing and the applicable legal obligations.

In case of sensitive, economic or financial personal data, the General Criteria shall only apply in such cases when it is not necessary to obtain Data Subject’s consent to process personal data (e.g. when processing is intended to comply with obligations deriving from a legal relationship between Data Subject and Controller).

Burden of proof about applicability of the Authorized Compensatory Measures lies in Controller.

CONTENTS OF THE PRIVACY POLICY

The Privacy Policy divulged by using Authorized Compensatory Measures shall provide, at least, the following: (i) identity and address of Controller; (ii) purpose for data processing, identifying the purpose that originated the collection of personal data and the current purpose for data processing; and (iii) mechanisms offered by Controller to Data Subject to have access to full text of the Privacy Policy.

In case that the name of Controller has changed, it is necessary to expressly state any former names of Controller during the period in which processing of personal data has occurred, and its current identity.

MEANS TO COMMUNICATE THE PRIVACY POLICY

Under the terms of the General Criteria, Controller shall divulge the Privacy Policy through any of the following media: (i) newspapers with nationwide distribution; (ii) local newspapers or specialized magazines; (iii) Internet webpage of Controller; (iv) hyperlinks placed on a website of IFAI; (v) posters; (vi) radio newsflashes, and (vii) other alternative mass media communication.

Controller shall take into consideration certain aspects when selecting the appropriate media to divulge the Privacy Policy, such as profile, domicile, age, gender, occupation of Data Subject, among others. Likewise, Controller shall choose the media and the period that is most efficient for the communication of the Privacy Policy to cover the widest number of possible Data Subjects.

For further information, please contact your principal Firm representative or one of the lawyers listed below:

Mexico City Office

Mr. Jorge León-Orantes (Partner)
Ms. Paola Morales (Associate)
Tel.: +52 55 5279.5400
Fax: +52 55 5280.7840

Monterrey Office

Mr. César G. Cruz (Partner)
Mr. Diego Acosta (Associate)
Tel.: +52 81 8133.6000
Fax: +52 81 8368.0111

Tijuana Office

Mr. Aarón Levet (Partner)
Tel.: +52 664 634.2978