On 20 March 2025, the Decree issuing laws on transparency and protection of personal data was published in the Federal Official Gazette, which became effective the day after its publication.
The legislative amendments, (a) enact three new laws: (i) the General Law on Transparency and Access to Public Information; (ii) the General Law on the Protection of Personal Data Held by Obligated Entities; (iii) the Federal Law on the Protection of Personal Data Held by Private Parties; and (b) amend article 37, section XV, of the Organic Law of the Federal Public Administration.
Therefore, the key points of the Decree include the following:
• The elimination of the National Institute for Transparency, Access to Information, and Personal Data Protection (“INAI”), because of the constitutional reform on organic simplification transferring its functions: (i) to the Ministry of Anti-Corruption and Good Governance (“SABG”); and (ii) to Transparency for the People, a deconcentrated administrative entity of the SABG.
• According to the explanatory memorandum of the Decree, these modifications aim to enhance efficiency in processing access to information requests and personal data protection while optimizing resources and eliminating redundancies in government structures.
• However, this Decree represents a significant retrogression on transparency and right of access to information, a clear example of this is the elimination of the authorities’ power to file unconstitutional actions and constitutional controversies. Likewise, the Decree incorporates ambiguous concepts such as “Social Peace” and “damage to the interest of the State” allowing the authority to limit access to information.
• On personal data protection matters, although substantially it may seem there were not many modifications, there are also interpretative ambiguities until the corresponding regulations are issued. Such is the event that tacit consent is the general rule for obtaining consent of the holder of personal data, unless express consent is required by legal provisions.
• Both in matters of transparency and personal data protection, the only appeal shall be the amparo trial before District Courts and Circuit Courts “specialized in transparency and personal data”, which are not yet available. Considering the context of the recent reforms to the judiciary, the creation of these specialized courts constitutes a measure that discourages the protection of human rights.
• The Decree introduces a setback in access to public information and excessive bureaucracy in the supervision of personal data protection in Mexico.
For additional information, contact:
Luis Burgueño, Partner: +52 (55) 5258-1003 | lburgueno@vwys.com.mx
Gloria Martínez, Counsel: +52 (55) 5258-1016 | gmartinez@vwys.com.mx