MexicoLey Federal de Protección de Datos Personales en Posesión de los Particulares, sensitive personal data
LFPDPPP, arts. 2(VI), 8 and 12 (sensitive personal data)
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Consent, Retention
- Audit expectation
- none
What it requires
- Obtain the data subject's express, written consent, by autograph signature, electronic signature, or another authentication mechanism, before processing their sensitive personal data, unless a statutory exception applies.NIST Privacy FrameworkCT.PO-P1
- Do not create a database of sensitive personal data unless its creation serves a legitimate, specific purpose consistent with your explicit activities or aims.NIST Privacy FrameworkCT.PO-P1
- Make reasonable efforts to limit the period you process sensitive personal data to the minimum indispensable for the purpose.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
In English: for sensitive personal data the controller must obtain the data subject's express consent in writing, by autograph or electronic signature or another authentication mechanism. Articles 2(VI), 8 and 12 make that consent a condition of processing, bar databases of sensitive data without a legitimate purpose and ask for reasonable efforts to limit the processing period. They do not say the controller must keep, demonstrate or produce the consent, and they name no log, period or reader of a record. The articles carry no territorial clause, so the row carries no jurisdiction hook.
- Kind
- None
- As of
What this law does
Article 2, fracción VI defines sensitive personal data as data touching the data subject's most intimate sphere, or whose misuse could cause discrimination or a serious risk to them, and lists, illustratively but not exhaustively, racial or ethnic origin, present or future health status, genetic information, religious, philosophical or moral beliefs, political opinions, and sexual preference; the list does not name a biometric identifier, voiceprint, or faceprint, so a biometric identifier not otherwise tied to one of the enumerated categories is protected only as ordinary personal data under this Law's general regime.
Article 8 requires the data subject's express, written consent, given by autograph signature, electronic signature, or another authentication mechanism, before processing sensitive personal data, and bars creating a database of sensitive personal data unless its creation serves a legitimate, specific purpose consistent with the responsable's explicit activities or aims.
Article 12 requires the responsable to make reasonable efforts to limit the period sensitive personal data is processed to the minimum indispensable, on top of the general proportionality principle article 12 states for personal data generally.
Article 9, fracción VI separately lets a responsable process sensitive personal data without consent for medical prevention, diagnosis, care, or health-service management while the data subject cannot consent, carried out by someone bound by professional secrecy.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .