Intelligence

On July 12, 2026, the Secretariat of Anti-Corruption and Good Governance imposed a fine of 42.8 million pesos on the Mexican Football Federation (FMF) for various irregularities in the handling of personal data collected through the FAN ID system, the biometric identification mechanism created to control the entry of fans into stadiums.

When a company collects biometric data in Mexico, one important question that is often asked is how Mexico’s evolving privacy framework treats that information, and what obligations or risks come with it. The concern is well founded, because biometric data is one of the most sensitive categories of personal information, and Mexico’s recent changes to implement the biometric CURP to citizens have only increased discussion around the topic.

On 20 March 2025, the Decree issuing laws on transparency and protection of personal data was published in the Federal Official Gazette, which became effective the day after its publication.

The legal framework for data protection is found in Articles 6 and 16 of the Mexican Constitution, as well as in the new Federal Law for the Protection of Personal Data Held by Private Parties, published on March 20, 2025...

Many companies in Mexico, particularly those with a large online presence, such as e-commerce businesses, digital marketing agencies, and social media firms, collect personal data from clients...

Una gran parte de las empresas en México, especialmente aquellas con presencia en medios digitales, como empresas dedicadas al e-commerce, marketing digital, redes sociales...