On January 7, 2024, the National Institute for Transparency, Access to Information, and Personal Data Protection (INAI) published a report summarizing the fines it had imposed for violations of the Federal Law on Protection of Personal Data Held by Private Parties (FLPPDPP) in the year 2023.

What were the details of the report?

In particular, the INAI noted that it had imposed fines amounting to MXN 46,849,777 (approx. $2.7 million) on individuals and legal entities found in breach of the FLPPDPP.

Specifically, the report highlights that the most sanctioned sectors were the financial services and insurance, mass media, and retail trade, in that order. Furthermore, the most frequent grounds for sanction were:

• processing of personal data in violation of the principles established in the FLPPDPP;
• failing to comply with the duty of confidentiality; and
• omitting from the privacy notice any of the elements required by law.

Moreover, the INAI stated that 91 sanction imposition procedures were established, of which 74 were concluded and fines imposed by the INAI. In addition, 293 rights protection procedures were initiated, including:

• 155 on the right of access to personal data;
• five on rectification;
• 122 on cancellation; and
• 79 on opposition to the processing of data.

Furthermore, mass media was the sector found most in violation of these rights (25.8%), followed by financial services (20.6%) and health and social assistance services (16.5%).  

You can read the press release, only available in Spanish, here.