On December 20, 2024, the President of Mexico published a decree in the Federal Official Gazette amending and adding various articles to the Political Constitution of the United Mexican States (the “Constitution”) to address administrative simplification (the “Autonomous Bodies Reform”). The reform aims to streamline government structure, eliminate administrative redundancies that increase operational costs, and simplify procedures. One of its objectives is to dissolve seven autonomous bodies, including the National Institute for Transparency, Access to Information, and Protection of Personal Data (the “INAI”).

In the data protection field, the Reform principally contemplates the following:

  1. Information related to private life and personal data will be protected under the terms and exceptions established by law.
  2. The law referred to in Article 90 of the Constitution will determine jurisdiction over procedures for the protection, verification, and sanctioning related to personal data held by private entities.
  3. Everyone has the right to free access to public information, their personal data, and the correction of such data, without needing to prove interest or justify use. Mechanisms for accessing public information and expedited review procedures will be established, handled by the competent authorities as per the Constitution and applicable laws.
  4. Obligated parties must promote, respect, protect, and guarantee the rights of access to public information and personal data protection. The relevant laws will define the framework, principles, and procedures for exercising these rights, as well as the oversight responsibilities of internal control bodies at federal and local levels.
  5. Obligated parties will be governed by the general law on transparency, public information access, and personal data protection, as enacted by Congress to establish the basis, principles, and procedures for exercising these rights.
  6. The exercise of these rights will be governed by principles such as certainty, legality, independence, impartiality, efficiency, objectivity, professionalism, transparency, and maximum disclosure.
  7. The National Electoral Institute (“INE”) will oversee matters related to public information access and personal data protection by political parties and hear appeals against their decisions, as defined by law.

The reform's provisions on personal data protection took effect on December 23, 2024. However, the Second Transitional Article grants Congress 90 calendar days from the effective date to amend relevant laws accordingly.

The Fifth Transitional Article specifies that (i) the INAI will be dissolved once the legislation referenced in the Second Transitional Article comes into effect, (ii) legal acts issued by the INAI and state guarantor bodies prior to the secondary legislation’s effective date will remain legally valid. Agreements, contracts, and equivalent acts will remain in force, binding the institutions assuming the INAI’s functions, unless the parties decide to ratify, amend, or terminate them, (iii) the INAI’s material resources, records, registries, platforms, and electronic systems will be transferred to federal executive agencies as stipulated by the reform and secondary legislation.

Under the Sixth and Seventh Transitional Articles: (i) the INAI commissioners will conclude their terms when the secondary legislation takes effect unless their appointments expire earlier. Any new appointments will be temporary and cannot exceed the date the legislation becomes effective, and (ii) the INAI personnel’s labor rights will be fully respected, and its human resources will be transferred to the institutions assuming the agency's functions.

The preliminary decree prior to the publication of the Autonomous Bodies Reform established that the following entities within the federal public administration (“APF”) would assume the functions corresponding to the INAI: (i) the Ministry of Public Administration (the new Ministry of Anticorruption and Good Governance), the oversight and disciplinary body of the Judiciary, the oversight bodies of autonomous constitutional entities, and the control offices of Congress, each within their respective areas of competence, would absorb the functions related to access to information and personal data protection for members of the APF, (ii) the National Electoral Institute (“INE”) would assume the functions related to political parties.

(iii) the Federal Center for Conciliation and Labor Registration and the Federal Arbitration and Conciliation Tribunal would assume the functions related to labor unions, (iv) crucially, the protection and safeguarding of personal data held by private entities would fall under the Executive Branch, although, at that time, no specific entity within the Executive Branch had been designated to assume these functions. Notwithstanding the above, the Autonomous Bodies Reform did not clarify which specific entities within the Executive Branch would take on these responsibilities, except for the functions to be absorbed by the INE.

The dissolution of the INAI poses significant challenges for personal data protection, access to information, and transparency in Mexico. The absorption of these functions by the Executive Branch raises well-founded concerns regarding the continuity and effectiveness of these safeguards. This situation could lead to operational and legal gaps, increased workload, and the delegation of responsibilities to non-specialized personnel.

Additionally, the absorption of the INAI’s functions, where the State acts as both judge and party, undermines fundamental principles of transparency and accountability. The elimination of the autonomous body introduces risks of bureaucratization, delays, and reduced capacity to address issues, thereby weakening the protection of essential rights for citizens and complicating compliance with data protection and transparency legislation for both national and international entities.

Until secondary legislation on the matter is published, uncertainty will persist.

At Ritch Mueller, we have extensive experience in personal data protection, with a team of professionals available to advise our clients and help them navigate the legal implications of these changes. We can assist in adapting to this new regulatory landscape, ensuring compliance with obligations, mitigating potential risks, and safeguarding our clients’ rights.

Visit our site www.ritch.com.mx or reach us at (+52) 55 9178 7000 | [email protected]