On August 6, 2023, the National Institute for Transparency, Access to Information and Personal Data Protection (INAI) announced, that it had imposed, from January 1 to June 30, 2023, fines totaling MXN 11,020,991 (approx. $644,670) on individuals and/or entities that violated the Federal Law on Protection of Personal Data Held by Private Parties (FLPPDPP). In particular, the INAI noted that during the mentioned period, 52 sanctions were initiated, from which the amount of fines imposed was derived. The sectors with the highest fine amounts are the financial services sector, accounting for 36.76% of the total; the health and social assistance services sector for 35.28%; the manufacturing sector for 15.77%; and other sectors for 12.19%.

Moreover, the INAI noted that among the most common behaviors that lead to penalties are processing personal data in contravention of the principles established in the FLPPDPP, collecting or transferring personal information without the explicit consent of the owner when required, and omitting one or more elements provided by the FLPPDPP in the privacy notice. During the same period, the INAI, through the General Directorate of Evaluation, Research, and Verification of the Public Sector, addressed 71 complaints against federal government agencies for alleged violations of the General Law on Protection of Personal Data Held by Obligated Subjects.

The INAI highlighted that the highest number of complaints relates to the improper handling of personal data, with 37 reports; likewise, 32 complaints were received for the disclosure of information without the consent of the owners, and two for the unauthorized transfer of personal data, of which 66 have been concluded and five are in progress.

You can read the press release, only available in Spanish, here.