Wednesday, August 17, 2016
Mexican DPA Affirms DP Law Applies to HR
On July 21, Mexico's National Institute of Access to Information and Data Protection (INAI) confirmed that companies are responsible for the processing of personal data of their employees under the Federal Law on Protection of Personal Data Held by Private Parties 2010. The affirmation came in a INAI decision in which a company argued that it could rely upon the personal use exemption to process its employees' personal data without consideration of the federal data protection law. The case concerned a complaint filed by an employee, after his employer refused to comply with his access request at first, and later granted only partial access, on the grounds that the processing was used exclusively for internal purposes and not disclosed or used for commercial purposes. The INAI rejected this attempt to exploit ambiguity around the personal use exemption, and also warned that data concerning an employee or former employee, such as their position, email, and salary constitute personal information and must be processed in accordance with the DP law.