26 Jul Decree amending and adding various provisions of the Credit Institutions Law
On June 26, 2024, Mario Alberto Rodríguez Carrillo, a member of the Parliamentary Group of Movimiento Ciudadano, submitted an initiative to amend the Credit Institutions Law (“LIC”) before the Chamber of Deputies.
This initiative proposes certain amendments to the LIC aimed at ensuring that credit institutions properly protect and handle Personal Data (as defined in the Federal Law for the Protection of Personal Data Held by Private Parties) collected from Data Subjects (this is, those individuals whose personal data is held by third parties and is protected by the Federal Law for the Protection of Personal Data Held by Private Parties). This initiative seeks to protect the Data Subject and prevent them from becoming victims of financial crimes, rights violations, telephone harassment, and other emotional situations they could experience.
Additionally, this initiative pays particular attention to economic personal data, or financial and asset-related personal data, as stated under the Federal Law for the Protection of Personal Data Held by Private Parties (the “Law”) and its misuse by credit institutions. It is worth noting that neither the Law nor its regulations, provide a clear definition of what constitutes financial or asset-related personal data. However, the National Institute for Transparency, Access to Information and Personal Data Protection (by its acronym in Spanish “INAI”), has defined Financial or Asset-related Data as information regarding the economic capacity of individuals, including their property and ability to meet their debts, which may include: money, movable and immovable property, tax information; credit history, income and expenses, bank accounts, insurance policies, retirement funds, securities, credit card number, security codes, among others.
Financial or Asset-related Data are involved in several processes when Data Subjects interact with credit institutions, whether it is completing procedures, applying for social programs, conducting credit operations, filling out applications and forms, responding to surveys, making online or telephone purchases, among other activities.
In accordance with the above, it is important to note that pursuant to article 106, Section XX (currently in force) of the Credit Institutions Law (“LIC”), credit institutions are prohibited from the following:
“Provide, for any purpose, including the marketing of products or services, the information obtained as a result of transactions with their clients, unless they have the express consent of the respective client. This consent must be documented in a special section within the documentation used to formalize an operation or service with the credit institution and must be additional to any consent normally required by the institution for the operation or service requested. Under no circumstances shall granting such consent be a condition for contracting such transaction or service.”
Pursuant to Article 8 of the Law, the processing of Financial or Asset-related Data requires explicit consent from the Data Subject, except for certain scenarios stated under the Law. Regardless of any applicable exception, Data Subjects must be informed, prior to the processing of their data, of the purposes for which credit institutions will use their data as data controllers, and of any potential transfers that may occur.
Given the requirements stated under the Law and its regulations, the initiative aims to prevent and address the current issue of data transfer by credit institutions. The initiative proposes that these institutions avoid providing, for any purpose, including the marketing of products or services, information obtained through transactions with their clients. It is crucial for the Data Subject to have full certainty of the data transfers made by the credit institutions, ensuring that both the processing of their data and any transfers are strictly limited to the purposes necessary to maintain the legal relationship between the parties.
In addition, the initiative points out that, unfortunately, Data Subjects often face a challenge due to the reading of a lengthy document that requires time for comprehension and subject matter expertise. This represents a significant challenge, since institutions must clearly and comprehensively disclose the personal data they collect, their purposes, and the way it is processed, among other details, these disclosures must also be drafted in an accessible manner for understanding.
According to the above, the initiative proposes amending Article 6 of the LIC, by adding Section VI, which establishes that credit institutions will also be governed by the Law, and modifying Article 106, Section XX of the LIC, to indicate that credit institutions shall not disclose, for any purposes, including the marketing of products or services, the information obtained from transactions with their clients.
Due to the initiative exposed above, we can identify and reflect on the following: i) the significance of Financial and Asset-related Personal Data proper protection; ii) the risks associated with data transfers made by credit institutions; iii) the necessity of compliance with the Law and the LIC by credit institutions; iv) the significance of accurately drafting a comprehensive privacy notice for easy understanding; v) the relevance and application of exercising ARCO rights (Access, Rectification, Cancellation, and Opposition) by Data Subjects; vi) the appropriate justification for data transfers; vi) the challenges we face in adequately protecting ARCO rights; and vii) the challenges addressed by digitalization.
At Cuesta Campos, we prioritize the respect and appropriate management of our clients’ personal data in accordance with the Law, its regulations and applicable provisions. Our aim is to provide them with all necessary tools to handle correctly the personal data processed by them.
For additional information regarding protection of personal data, please contact our experts in this area.
Contact
Mauricio Castillo
Héctor Valladares
Fionna Folino
THE ABOVE IS PROVIDED AS GENERAL INFORMATION PREPARED BY PROFESSIONALS WITH REGARD TO THE SUBJECT MATTER. THIS DOCUMENT ONLY REFERS TO THE APPLICABLE LAW IN MEXICO. WHILE EVERY EFFORT HAS BEEN MADE TO ENSURE ACCURACY, NO RESPONSIBILITY CAN BE ACCEPTED FOR ERRORS OR OMISSIONS. THE INFORMATION CONTAINED HEREIN SHOULD NOT BE RELIED ON AS LEGAL, ACCOUNTING OR PROFESSIONAL ADVICE BEING RENDERED.