Inai begins to accumulate files on personal data protection

Every week that the plenary session of the National Institute for Transparency, Access to Information and Protection of Personal Data (Inai) cannot meet, due to the fact that the Senate and the federal government do not comply with the appointment of at least one of the three commissioners that it lacks to meet, it will stop issuing, on average, 49 resolutions of means of challenge related to the protection of personal data in the possession of authorities or public institutions and the implementation of, at least, five administrative procedures for the protection of rights and two procedures of imposition of sanctions related to personal data in the possession of individuals.

However, there is a long list of tasks that have not been interrupted, despite the fact that since last April 1 it only has four of the seven commissioners that must integrate the plenary session.

Jonathan Mendoza Iserte, Inai’s Secretary for Personal Data Protection, explained that this institution is responsible for protecting the human right to personal data protection, which translates into many actions in addition to the resolution of appeals that must be given in the full.

According to the official, in terms of personal data protection, what currently cannot be done in that institution, since it is the exclusive task of the plenary session, is the resolution of coercive procedures, specifically those that have to do with violations of principles and / or duties and rights; review resources, which have to do with the exercise of ARCO rights (access, rectification, cancellation or opposition), including portability to the public sector; as well as determination of investigations and verifications in the public sector, among several other functions.

2,500 means of challenge

The information contained in the 2022 work report of that institution, which reports that, from October 2021 to September 2022, the body received 63,435 applications, gives an idea of ​​the work carried out by the Inai plenary session —and that has begun to accumulate—. attention related to the protection of personal data.

In that same period, it received 2,619 means of challenge (access, rectification, cancellation and opposition) regarding the protection of personal data held by obligated subjects of the public sector, a figure that represents an increase of 5% compared to the previous period, when 2,496 attended.

In that period, the plenary session resolved 2,554 means of challenge regarding the protection of personal data held by regulated entities, which represents a decrease of 0.39%, compared to the previous period. These figures include matters regarding the protection of personal data held by obligated subjects, appeals for review, appeals filed, and resolutions to appeals for nonconformity filed against the resolutions of state guarantor agencies and their respective procedural replays.

Of those 2,554 appeals resolved, 1,523 resolutions were issued confirming, modifying, revoking or ordering to allow access, rectification, cancellation or opposition of personal data. The remaining 1,031 appeals were dismissed or dismissed.

The highest percentage of the resolutions was in those where it was instructed to modify, revoke and order to deliver the requested information, or, the rectification, cancellation or opposition of the applicant’s personal data, which represents 54%.

260 cases of protection of rights

In the same period, the INAI received 266 requests for the protection of rights related to personal data held by individuals, which represented a decrease of 13.4% compared to the 307 received in the previous period.

The Federal Law on Protection of Personal Data Held by Individuals (LFPDPPP) establishes procedures such as the protection of rights, whose objective is to restore to the person who owns the data the right of access, rectification, cancellation or opposition to the treatment of these that have been exercised before the person responsible for the treatment.

There is also a procedure for the imposition of sanctions, which can be initiated by order of the plenary session of the institute and conclude with a warning or a fine to the offender and with this, inhibit behaviors that violate the Law.

From October 2021 to September 2022, 267 administrative procedures for the protection of rights were concluded (considering those previously received).

It received 308 requests for claims on rights of access, rectification, cancellation and opposition related to personal data held by individuals.

The access and cancellation rights were the most exercised, with 46.4% and 35.7%, respectively, followed by the opposition with 16.6% of the occasions. The right of rectification was exercised only in 1.3%.

The law on the matter provides for the imposition of sanctions that begins with the resolution of the procedure for the protection of rights or verification, which is instructed by the plenary session of the institute when it becomes aware of an alleged breach of the principles, duties and obligations. provided for by said Law.

From October 2021 to September 2022, 113 procedures for the imposition of sanctions instructed by the plenary were carried out.

In addition, in the same period, fines were imposed for a total amount of 60,678,292 pesos, of which 63% were concentrated in the financial and insurance services sector, 24.8% in information in the mass media, 4.1 % in business support services and waste and waste management and remediation services, while the remaining 8.1% was imposed on offenders located in 10 different sectors.

The most recurring violations by individuals in possession of personal data are for processing personal data in contravention of the principles established in the LFPDPPP (38%); omitting the privacy notice, some or all of the elements referred to in the law (9.5%) and for breaching the duty of confidentiality (8.9%).

In the same period as the previous ones, the institution received 1,754 complaints for alleged violations of the LFPDPPP. Of these, they resulted in 1,040 orientations, that is, the holders were informed that the document presented did not correspond to the matter that includes the verification procedure, in this case to the treatment and protection of personal data in the possession of individuals, but to situations such as nonconformities for the provision of services, competence of other authorities.

Jonathan Mendoza Iserte highlighted that what has not been interrupted and continues to be done every day in a responsible manner is everything that has to do with advice, training for obligated subjects and those responsible for personal data, preparation of guides, dissemination and socialization of the law , technical support with all preventive mechanisms.

He explained that the INAI has two ways to intervene: one is at the request of a party and another ex officio when violations of principles or duties in the matter are noticed.

Rights regarding personal data

The INAI is the authority responsible for defending people’s right to privacy, sanctioning individuals and authorities when they use their data for purposes other than those for which they authorized it.

In other words, this institution is responsible for guaranteeing the protection of personal data, both those held by government institutions or the public administration, and individuals.

Personal data is any information concerning a person, which allows their identification, for example, their name, address, telephone number, gender, among others.

In addition, some of these are considered sensitive and are those that affect your most intimate environment, the misuse of which may give rise to or carry a serious risk, for example, those that may reveal aspects such as racial or ethnic origin, present and future health status. , genetic information, religious, philosophical and moral beliefs, union affiliation, political opinions, sexual preference, among others.

Abraham Montes Magaña, coordinator of the guarantor bodies of the National Transparency System (SNT), highlights that every day people expose their personal data and, although slowly, there is increasing awareness of it.

According to figures from the National Institute of Statistics and Geography (Inegi), 85% of Mexicans say they are concerned about exposing their personal data on a social network, although —points out Montes Magaña— very few read the privacy notices when a site on the internet presents them to you.

Arístides Rodrigo Guerrero García, Coordinating Commissioner of the SNT Personal Data Protection Commission, draws attention to the personal data found in the digital world. He recalls that every minute 5.9 million searches are performed on Google, the equivalent of 500 hours of video are uploaded to YouTube and 66,000 photos are shared on Instagram.

If it is taken into account that, on average, Mexicans spend 4.8 hours a day handling their cell phones or mobile devices and, in the case of young people between 18 and 26 years of age, it is 6.8 hours, the digital footprint they leave with It is huge and getting bigger every day.

The good news is that there is a legal framework, institutions and public policies that protect the right to privacy and the INAI is the guarantor body to which you can turn if you consider that a public institution or an individual is committing an irregularity related to your personal data. Although, for now, you will have to form your request for justice if it has to be resolved by the plenary, because there is no quorum.

diego.badillo@eleconomista.mx