MexicoLey para Regular las Sociedades de Información Crediticia, signed authorization for disclosure
LRSIC, art. 28 (signed authorization for disclosure)
In force.
A data subject rights rule binding private bodies.
- Obligation class
- Consent, Disclosure, Access restriction, Prohibition
- Audit expectation
- none
What it requires
- If you are a credit information company, give information to a user only when the client has given express authorization by signature, stating that the client knows the nature and scope of the information, the use the user will make of it, and that the user may run periodic checks of the credit history while the legal relationship lasts (art. 28).
- Collect the client's signature by hand or electronically on the terms Banco de México sets, and obtain the authorization for individuals and for legal entities with total credits under 400,000 UDIS (art. 28).
- If you are a user, do not rely on an authorization beyond one year from its grant, or up to two further years if the client expressly agrees, except for as long as a legal relationship with the client lasts (art. 28).
- Put an authorization text that forms part of the paperwork for a service in a special section, with the client's handwritten signature as an additional signature (art. 28).
- Do not supply a client's personal data to a user or any third party for marketing products or services, except for credit-history queries (art. 28).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
In English: the company may disclose credit information to a user only on the client's signed authorization. Article 28 names no log or register and no reader of one, and carries no territorial clause, so the row carries no jurisdiction hook.
- Kind
- None
- As of
What this law does
Article 28 allows a credit information company to give information to a user only when the client has given express authorization by signature, stating full knowledge of the nature and scope of the information, of the use the user will make of it and of the user's ability to run periodic checks of the credit history while the legal relationship lasts. The signature may be collected by hand or electronically on the terms Banco de México sets.
The authorization is required for individuals and for legal entities with total credits under 400,000 UDIS, and does not apply to information requested by Banco de México, the Comisión Nacional Bancaria y de Valores, courts in a proceeding where the client is a party or the accused, or the federal tax authorities acting through the Commission for tax, anti-money-laundering or counter-terrorist-financing purposes.
The authorization lasts one year from its grant, or up to two further years if the client expressly agrees, and in any case while the legal relationship between the user and the client lasts. Where the authorization text forms part of the paperwork a client signs for a service, it must sit in a special section and carry its own additional signature.
The company, its employees and officers are forbidden to supply clients' personal data for marketing products or services of users or third parties, except for credit-history queries, and doing so is the offence of revealing secrets under article 210 of the Código Penal Federal.
When LexLint raises it
When your app profile says your app processes personal data or provides financial services.
Back to the example · Lint your app
Page updated .