Mexico: Issued Report on INAI enforcement of data protection violations in 2022

On 8 January 2023, the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI) in Mexico published a report delineating its enforcement actions and the imposed fines, amounting to MXP 60 million, against individuals and legal entities for violations of the Federal Law on the Protection of Personal Data Held by Individuals (LFPDPPP) in 2022. The fines were imposed across a range of sectors, with the highest number of sanctions being applied to those operating in the fields of mass media information, financial services and insurance, business support services, waste and residue management, and remediation services. The infringements primarily involved the processing of personal data in contravention of the principles set forth in the LFPDPPP, the collection or transfer of personal data without the express consent of the data subject, and the failure to include the requisite elements as required by the law. In 2022, the INAI initiated 119 proceedings for the imposition of sanctions, of which 78 were concluded with fines. Furthermore, 249 Rights Protection Procedures were initiated, addressing access, rectification, cancellation, and opposition (ARCO) rights. Additionally, 1,688 complaints were filed with the INAI for the misuse of personal data in the private sector, and 101 in the public sector.