Mexico: Supreme Court issued decision on data controllership of search engine managers under Federal Data Protection Law (FLPPDPP)

On 27 November 2024, the Supreme Court of Mexico ruled that search engine operators can not be considered data controllers under the Federal Law on the Protection of Personal Data Held by Private Parties (FLPPDPP). The Court determined that search engine providers do not exercise control over the personal data processed through their services, as they do not determine the content displayed in search results or the purposes of data processing. The Court thus recognised search engine providers as intermediaries rather than entities responsible for data processing. Furthermore, the Court stipulated that individuals seeking to exercise their ARCO rights should approach judicial authorities or the National Institute for Transparency, Access to Information, and Personal Data Protection (INAI) for a case-by-case assessment of the involved human rights considerations, thereby preventing undue obligations on search engine operators.