Mexico Data Protection Law: Processing by Local Establishment

The factor of Processing by Local Establishment is used in determining the law's applicability by ensuring that entities established in Mexico are subject to the local data protection laws governing their data processing activities.

Text of Relevant Provisions

The Regulations Art.4(1)(i):

"These Regulations will be obligatory for all processing when: I. It is carried out in an establishment of the data controller located in Mexico;"

The Regulations Art.4(1)(iv)(3):

"In case of corporate bodies, the establishment shall mean the location of the principal management of the business; in case of corporate bodies residing abroad, the location of the principal management of the business in Mexico, or in the absence thereof, that designated by them or any stable installation that allows actual or real performance of an activity"

Analysis of Provisions

The Regulations to the Federal Law on the Protection of Personal Data Held by Private Parties in Mexico specify that the law applies to data processing activities carried out in an establishment of the data controller located in Mexico (Art.4(1)(i)). This provision indicates that the law's applicability is based on the physical presence or establishment of the data controller within Mexico's territory.

The concept of "establishment" is further clarified in Art.4(1)(iv)(3), which defines it for corporate bodies as "the location of the principal management of the business". For foreign entities, it can be "the location of the principal management of the business in Mexico, or in the absence thereof, that designated by them or any stable installation that allows actual or real performance of an activity".

This broad definition of establishment ensures that the law applies to a wide range of entities operating within Mexico, including local companies, subsidiaries of foreign corporations, and even foreign companies with a stable presence in the country.

Implications

The inclusion of this factor has significant implications for businesses operating in Mexico:

1. Local companies: All Mexican companies that process personal data must comply with the law, as they are established in Mexico.
2. Multinational corporations: Foreign companies with subsidiaries, branches, or other forms of stable installations in Mexico are subject to the law for their data processing activities carried out in these establishments.
3. Management location: The location of the principal management of the business is a key factor in determining whether a company is considered established in Mexico.
4. Flexible interpretation: The provision allows for a flexible interpretation of establishment, including "any stable installation that allows actual or real performance of an activity". This could potentially include offices, data centers, or other facilities used for data processing.
5. Compliance requirements: Companies falling under this provision must ensure that their data processing activities comply with all aspects of the Mexican data protection law, including data collection, storage, use, and transfer practices.
6. Territorial scope: The law's focus on establishments in Mexico means that companies without a physical presence in the country may not be directly subject to these provisions, although they might still be covered by other aspects of the law if they process data of Mexican residents.
7. Representative designation: Foreign entities with establishments in Mexico may need to designate a representative to ensure compliance with the law's obligations.