AT&T violated the personal data law and will pay almost half a million pesos in fines

Justice confirmed a sanction of almost 500,000 pesos against AT&T for violating the personal data protection law to the detriment of a citizen in 2016. The sanction was imposed by Inai, Mexico’s privacy agency, considering that AT&T acted negligently during the exercise of a right of access to personal information.

AT&T, the largest operator on the planet by revenue volume, fought the Inai sanction in court for six years. In her last attempt, she asked the Supreme Court to review the matter, but the Court refused in early December 2022.

This case dates back to 2016, when a client of the company requested access to his personal data that AT&T It collects to comply with the law of collaboration with the authorities in the intervention of private communications.

AT&T He responded to the citizen out of time with a 755-page document that did not contain all the information requested, in addition to the fact that the information he did provide was in an incomprehensible format, with unexplained codes, acronyms, and abbreviations.

According to the resolution to file PPD.0050/16 voted unanimously by the commissioners of the plenary of the Henna on July 13, 2016, AT&T violated articles 22, 23, 28, 32 and 45 of the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).

Consequently, the privacy agency ordered that sanctions be imposed against AT&T for “acting negligently in the processing and response to the request for access to the owner’s personal data” (file PS.0053/16).
The sanction of Henna It was for a total of 474,760 pesos, which AT&T must pay to the Federal Treasury.

The company in Mexico enters the amount of the fine every three seconds.

Private communications and personal data

The decision of the Henna 2016 was the first time that the Mexican data protection authority resolved a file related to the controversial collaboration law to intervene in private communications.

This law —articles 189 and 190 of the Eighth Title of the Federal Telecommunications and Broadcasting Law— obliges all operators in Mexico to collect and safeguard personal data about their customers’ communications, including the location of their phones.

“It is evident that the information indicated in section II of article 190 are personal data of the end users of telecommunications services,” determined the Henna in its resolution of July 13, 2016. And it added: “Although it can be accepted that in order to protect national security there are laws for the collection and storage of personal information in registries not open to the public, with due guarantees for the proportional use and for legitimate purposes, this situation does not impede the right of access to personal information maintained by order of legal provisions under certain circumstances”.

The information collected identifies and makes a person identifiable, therefore it is protected by the personal data protection law.

Last November, the Federal Telecommunications Institute (IFT) sanctioned AT&T with almost 4 million pesos for responding out of time to 9 requests from authorities to access personal data and the location of their customers’ phones between 2017 and 2018. AT&T You can appeal this IFT sanction.

“For AT&T Mexico, protecting the personal data of our customers is a responsibility that we take very seriously, for this reason we comply with the requirements made by the authorities empowered to do so, such as the law enforcement authorities, at the same time that we take the necessary measures to protect your information, which is why we are prevented from providing information that is not legally permitted or to those who are not legally empowered to request it”, said AT&T in a pose requested for this article. “The company reiterates its respect and commitment to complying with the law.”

The jurisprudence of 2020

AT&T lost the litigation because a 2020 case law of the Supreme Court was applied retroactively to it, which indicates that the decisions of the Henna They cannot be fought by means of the nullity trial (the contentious administrative trial), but rather by means of the amparo trial.

Though AT&T started its legal defense in 2017, the courts involved considered that the 2020 jurisprudence is applicable.

AT&T can no longer resort to new means of defense, which makes the decision of the Henna and the respective sanction for almost half a million pesos. Juged thing.