As Mexico focuses on strengthening individual privacy rights, an interesting conversation is emerging from the intersection of advertising and privacy. Our interview with Verónica Siten Salgado, a data privacy consultant with Arochi & Lindner, shed some light on the nuances of Mexico's data protection laws and how it impacts businesses advertising in the country.
Watch this episode of A Little Privacy, Please!®
Give us a general overview of the Mexican legal framework for data protection.
In Mexico, there are two data protection laws, one of which addresses the public sector, and the other one that we will talk about today addresses the private sector.
This law came into force in 2010, and it is known as the Data Protection Law. It is supported by eight principles and two duties. In addition, there is a document that states the rules to create, use, and implement a privacy notice in compliance with the local legal framework. It is called The Privacy Notice Guidelines.
It is important to understand that the privacy notice must reflect the real operation and administration of our personal data within a company, which is to say, how a data controller uses our personal information.
How does a data controller comply with Mexico's Data Protection Law?
One of the obligations of a data controller is to make the privacy notice available to the data subjects prior to collecting any personal information or on the very first contact with them. The privacy notice must contain the data purposes, distinguishing between the primary and the secondary ones, and this document should also include a mechanism to object to the personal data processing for secondary purposes or meanings.
No objection could be considered as tacit consent. But if a person objects to processing their personal info, the controller should add that person to an exclusion list. Objection is one of the four ARCO rights (Access, Rectification, Cancellation, Opposition). Objection focuses on stopping data processing for secondary purposes and establishes the use of an exclusion list.
In addition to the objection rights, the Federal Consumer Protection Office (PROFECO) created the REPEP program, which is a federal and official exclusion list to avoid marketing and advertising calls.
What are some best practices for companies advertising to Mexican consumers to be aware of?
There are three basic and useful tips:
- Be aware of privacy matters when you are designing a marketing or advertising campaign that will help you to be compliant with the privacy legislation and to be well received by the targeted population. Keep in mind that privacy and data protection have become key matters for people.
- Know the privacy notice of the company you are creating content for. This will allow you to design content and strategies duly harmonized with the company's privacy policy. Remember that this notice is supposed to be an external reflection of the data protection principles of the company.
- If you have any questions regarding privacy matters and need help to land your ideas on the legal ground, do not hesitate to contact counsel. I am sure they will be happy to collaborate with you!
