Red en Defensa de los Derechos Digitales

Region of Operation

Website

Influence key stakeholders

Our impact

Fighting Identity Systems

From smartcards to biometrics and beyond, and across the world.

Learn more

Being able to assert who we are and what claims we have can be empowering. But identity checks are increasingly conducted and required, both with and without our knowledge.

Our fight

ID, Identity and Identification

An identity system should give people the ability to make and prove claims about themselves without divulging any unnecessary information to any party, free from concerns about being tracked, monitored, and having data exploited.

Open Letter to Facebook and Google

tech-admin — Thu, 28 Jan 2021 15:49:02 +0000

Target Profile

Google

Facebook

Audiences and Purpose

Change

We campaign for solutions

We are building a global movement

Content

ryul-davidson-PcyrQsX5f4w-unsplash.jpg

Summary

Privacy International is part of a 60+ coalition calling on Facebook and Google to provide equal and better transparency regarding political advertising on their platforms globally.

Media

Key points

We believe it is necessary for both Google and Facebook to:

Accelerate the expansion of full transparency tools to all countries where you operate to ensure that the least favoured countries benefit from the same level of transparency as the most favoured countries
Develop, and make public, a plan of action setting out commitments and related timescales to roll out full transparency tools globally
Disclose the full array of criteria, both past and present, used to select countries qualifying for higher transparency standards

This letter is also available in Spanish.

Dear Mr. Zuckerberg and Mr. Pichai,

In the past few years, you have pioneered important transparency tools to help your platform users understand, learn about and contextualise the political advertising they see. We agree that advertiser verification processes and ad repositories are key safeguards against online manipulation and misinformation. However, we are saddened to observe that these benefits have not been equally distributed among your global user base.
Each platform operates fluctuating and often widely differing transparency standards for different countries. While some users benefit from seeing political advertising in an ad repository, others do not. Where some users are offered detailed information about a political ad, others are not. There are no legitimate or otherwise publicly disclosed reasons justifying this difference in treatment.
The combined effect of these inconsistent policies is to create a two-tiered user base within each platform, with a wide regulatory gap separating the transparency haves and have-nots. We first highlighted these problems in 2019. While some progress has been made since, we are disappointed to conclude that the transparency divide persists.
Online transparency should not be a privilege of the few, but the right of all. To that end, the changes we believe are necessary are as follows:

Accelerate the expansion of full transparency tools to all countries where you operate to ensure that the least favoured countries benefit from the same level of transparency as the most favoured countries
Develop, and make public, a plan of action setting out commitments and related timescales to roll out full transparency tools globally
Disclose the full array of criteria, both past and present, used to select countries qualifying for higher transparency standards

The above changes, which we believe to be fair and reasonable, are only a starting point to begin to correct the current platform-created inequality between users. By contrast, the benefits are conclusive: heightened transparency standards for millions of users worldwide, and increased legitimacy of online political advertising for the sake of fair and informed decision-making by voters.
We urge you to take responsibility as two of the most influential platforms in online political campaigning, and empower users and voters with heightened ads transparency.

Yours sincerely,

Access Now
Africa Freedom of Information Centre (AFIC)
Aliansi Jurnalis Independen/Alliance of Independent Journalists (AJI)
Amnesty International
ApTI
Article 19
Artículo 19 México y Centroamérica
Asociación por los Derechos Civiles
Asociación para una Ciudadanía Participativa, ACI Participa
Associação Data Privacy Brasil de Pesquisa
Asociación para el Progreso de las Comunicaciones (APC)
Association for International Affairs (AMO) in Prague
Association pour le Developpement Integré et la Solidarité Interactive (ADISI-C)
Citizen D
Centre for Independent Journalism Malaysia (CIJ-M)
Collaboration on International ICT Policy for East and Southern Africa (CIPESA)
Civil Liberties Union for Europe
Bytes for All (B4A)
Datos Protegidos
Defend Democracy
Dejusticia
Democracy Reporting International (DRI)
Derechos Digitales
Digital Rights Foundation
ELSAM
Electronic Frontier Finland
Electronic Frontier Norway
epicenter.works
EU Disinfo Lab
Fundación Acceso
Fundación Huaira de Quito-Ecuador
Fundación Internet Bolivia
Fundación Karisma
Freedom Forum
Free Media Movement (FMM)
Global Forum for Media Development
Global Witness
Hiperderecho
Homo Digitalis
Instituto Brasileiro de Defesa do Consumidor
InternetLab
Intervozes - Coletivo Brasil de Comunicação Social
IPANDETEC Centroamérica
Irish Council for Civil Liberties (ICCL)
Laboratorio de Datos y Sociedad (DATYSOC)
Media Foundation for West Africa (MFWA)
Media Institute of Southern Africa MISA- Zimbabwe
Media Matters for Democracy
Merit Legal Advocacy & Human Rights Initiative (MELAHRI)
OBSERVACOM
Paradigm Initiative (PIN)
Privacy International
R3D: Red en Defensa de los Derechos Digitales
SFLC.in
Stiftung Neue Verantwortung (SNV)
Sursiendo, Comunicación y Cultura Digital AC
TEDIC
The Tor Project
Unwanted Witness
Usuarios Digitales
Venezuela Inteligente
Who Targets Me
World Wide Web Foundation
Xnet

Repeating Image and Text

More about our partner

La Asociación por los Derechos Civiles

The Association for Civil Rights (ADC) is a non-governmental organisation based in Buenos Aires that promotes civil and social rights in Argentina and other Latin American countries. It was founded in 1995 with the aim of fostering a legal and institutional culture to guarantee fundamental rights, based on respect for the constitution and democratic values.

Country of Operation

Argentina

Region of Operation

Asociación por los Derechos Civiles

Website

Dejusticia

The Center for Law, Justice and Society (Dejusticia) is a Colombia-based NGO that works to strengthen the rule of law and promote human rights in Colombia and across the developing world. It produces research to contribute to action for social change, and carries out advocacy through campaigns, litigation, education and capacity-building.

Country of Operation

Region of Operation

Website

Dejusticia

Derechos Digitales

Founded in 2005, Derechos Digitales is a non-profit organisation based in Chile that works across Latin America. Its main objective is the development, defense and promotion of human rights in the digital environment. Its work focuses on issues around freedom of expression, privacy and personal data, and copyright and access to knowledge.

Country of Operation

Chile

Region of Operation

Website

Derechos Digitales

Digital Rights Foundation

Digital Rights Foundation (DRF) is a research and advocacy NGO based in Pakistan that focuses on how Information and Communication Technologies (ICTs) can support human rights, democratic processes and digital governance. It works towards a world where all people, and especially women, are able to safely exercise their right of expression.

Country of Operation

Pakistan

Region of Operation

Website

DRF

Fundación Karisma

Founded in 2003, Fundación Karisma is a civil society organisation dedicated to supporting and disseminating the good use of technologies in digital environments, social processes and public policies in Colombia and the region, with a human rights focus. It also undertakes legal and technological activism in coalitionwith local, regional and international partners.

Country of Operation

Region of Operation

Website

Fundación Karisma

Hiperderecho

Hiperderecho is a non-profit Peruvian organisation dedicated to facilitating public understanding and promoting respect for rights and freedoms in digital environments. It seeks to spread the liberating capacity of technology to develop or enhance digital spaces so that all Peruvians can exercise their rights and strengthen their citizenship.

Country of Operation

Peru

Region of Operation

Website

Hiperderecho

InternetLab

InternetLab is an independent research center that aims to foster academic debate around issues involving law and technology, especially internet policy. Our goal is to conduct interdisciplinary impactful research and promote dialogue among academics, professionals and policymakers. We follow an entrepreneurial nonprofit model, which embraces our pursuit of producing scholarly research in the manner and spirit of an academic think tank. As a nexus of expertise in technology, public policy and social sciences, our research agenda covers a wide range of topics, including privacy, freedom of speech, gender and technology.

Country of Operation

Brazil

Region of Operation

Website

InternetLab

Red en Defensa de los Derechos Digitales

Country of Operation

Region of Operation

Website

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC) is a Paraguayan non-governmental organisation that develops open civic technology, supported by its work in communications and alternative advocacy. It also promotes and defends digital rights in favour of a free Internet culture, with the aim of establishing a collaborative society where digital rights are exercised and respected.

Country of Operation

Paraguay

Region of Operation

Website

TEDIC

The Institute for Policy Research and Advocacy (ELSAM)

The Institute for Policy Research and Advocacy (ELSAM) is a civil society organisation that works to enhance the democratic political order in Indonesia by empowering civil society. Founded in 1993, it actively participates in efforts to promote human rights through policy and legal research, advocacy, and training.

Country of Operation

Indonesia

Region of Operation

Website

ELSAM

Unwanted Witness

Founded in 2012, Unwanted Witness is a Ugandan-based civil society organisation that seeks to create secure, uncensored online platforms for human rights activists. It aims to contribute to good governance through effective online activism, networking and capacity-building. It also advocates for the strengthening of mechanisms related to freedom of expression and accountability.

Country of Operation

Uganda

Region of Operation

Africa

Website

Source: https://www.forbes.com/sites/thomasbrewster/2017/09/25/mexico-surveilla…

Our campaign

PI is campaigning for 1) platforms to give all users heightened ad transparency and 2) for transparency into targeting and funding of ads to be meaningful.

The role of social media and search platforms in political campaigning and elections has come under scrutiny. Concerns range from the spread of disinformation, to profiling of users without their knowledge, to micro-targeting of users with tailored messages, to interference by foreign entities, and more. Significant attention has been paid to the transparency of political ads, and more broadly to the transparency of online ads.

Notably, in the lead up to the 2019 EU Parliamentary elections Facebook, Google, and Twitter, as well as the Interactive Advertising Bureau and others, agreed to take a series of steps to prevent online disinformation on their respective platforms. These measures are reflected in a self-regulatory Code of Practice on Disinformation and the companies provided the European Commission with monthly updates on their progress.

PI is campaigning for 1) platforms to give all users heightened ad transparency and 2) for transparency into targeting and funding of ads to be meaningful.

Learn more

Democratic engagement is increasingly mediated by digital technology, from campaigning to election results transmission. These technologies rely on collecting, storing, and analysing personal information to operate. They raise novel issues and challenges for all electoral stakeholders on how to protect our data from exploitation.

Did Mexico Drop $5 Million On This 'Unlimited' Uber-Stealth Spy Tech?

tech-admin — Tue, 07 Apr 2020 12:01:43 +0000

Did Mexico Drop $5 Million On This 'Unlimited' Uber-Stealth Spy Tech? tech-admin Tuesday, April 7, 2020

Mexico is one of the biggest buyers of next-generation surveillance technology. And now data leaked to Forbes indicates it's taken an unprecedented step in becoming the first-known buyer of surveillance technology that silently spies on calls, text messages and locations of any mobile phone user, via a long-vulnerable portion of global telecoms networks known as Signalling System No. 7 (SS7).

The revelation was contained in what an anonymous source close claimed was internal sales information from Israeli provider Ability Inc., which appeared to have sold its Unlimited Interception System (ULIN) to Mexico. With prices ranging between $5 and $20 million, ULIN enables silent, almost-undetectable snooping on cellphones, and all that's required is a telephone number, according to a leaked manual detailed by Forbes in 2016.

It comes at a time when Mexico is wrapped up in a spyware scandal. Researchers found this year that activists, journalists, murder victims' attorneys, and investigators into a mass student disappearance have been targeted by the Pegasus spyware, a creation of $1 billion-valued Israeli firm NSO Group. So far no Mexican agency has been accused of running the software. But New York Times' reports were swiftly followed by public protests in June. President Enrique Peña Nieto called for an inquiry (while at the same time denying his government was responsible.) In August, an NSO Group spokesperson said the company was "deeply disturbed by any alleged misuse of our product," but didn't address any of the specific allegations.

Now, adding to the anxiety is ULIN, a technology that allows silent spying on calls, text and location for any mobile phone on the planet. All a potential snooper needs is a target's telephone or IMEI number. Distance from target doesn’t hinder the technology and attacks are incredibly hard to detect, making it potentially more potent than NSO's spyware. ULIN takes advantage of SS7, the vulnerable area of telecom infrastructure used to shift customers between networks when travelling abroad.

Hyperlink

Learn more

Who They Target

Comms Data Retention

Communications Surveillance

Comms Surveillance Tech

Direct Access by Government

Interception of Communications

Direct Access

Location Surveillance Technology

More about our partner

Influence key stakeholders

See more examples

Date

Monday, September 25, 2017

Content

Educational

Stories

An open letter to Google

tech-admin — Wed, 08 Jan 2020 15:19:16 +0000

Target Profile

Google

Audiences and Purpose

Change

We campaign for solutions

We are building a global movement

Content

Pi-Android-mock-up-3-1-photo correct.png

Summary

Privacy International and over 50 other organisations have submitted a letter to Alphabet Inc. CEO Sundar Pichai asking Google to take action against exploitative pre-installed software on Android devices.

Media

Key points

Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled.
Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions.
Pre-installed apps should have some update mechanism, preferably through Google Play and without a user account.
Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way.

You can find the letter below. Add your voice to this campaign by signing our petition if you believe that its time Google stopped enabling exploitation.

Note: This letter is also available in French and Spanish

Dear Mr. Pichai,

We, the undersigned, agree with you: privacy cannot be a luxury offered only to those people who can afford it.

And yet, Android Partners - who use the Android trademark and branding - are manufacturing devices that contain pre-installed apps that cannot be deleted (often known as "bloatware"), which can leave users vulnerable to their data being collected, shared and exposed without their knowledge or consent.

These phones carry the "Google Play Protect" branding, but research shows that 91% of pre-installed apps do not appear in Google Play – Google’s app store.

These pre-installed apps can have privileged custom permissions that let them operate outside the Android security model. This means permissions can be defined by the app - including access to the microphone, camera and location - without triggering the standard Android security prompts. Users are therefore completely in the dark about these serious intrusions.

We are concerned that this leaves users vulnerable to the exploitative business practices of cheap smartphone manufacturers around the world.

The changes we believe are needed most urgently are as follows:

Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled.
Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions.
Pre-installed apps should have some update mechanism, preferably through Google Play and without a user account.
Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way.

We, the undersigned, believe these fair and reasonable changes would make a huge difference to millions of people around the world who should not have to trade their privacy and security for access to a smartphone.

We urge you to use your position as an influential agent in the ecosystem to protect people and stop manufacturers from exploiting them in a race to the bottom on the pricing of smartphones.

Yours sincerely,

American Civil Liberties Union (ACLU)

Afghanistan Journalists Center (AFJC)

Americans for Democracy and Human Rights in Bahrain (ADHRB)

Amnesty International

Asociación por los Derechos Civiles (ADC)

Association for Progressive Communications (APC)

Association for Technology and Internet (ApTI)

Association of Caribbean Media Workers

Australian Privacy Foundation

Center for Digital Democracy

Centre for Intellectual Property and Information Technology Law (CIPIT)

Citizen D

Civil Liberties Union for Europe

Coding Rights

Consumer Association the Quality of Life-EKPIZO

Datos Protegidos

Digital Rights Foundation (DRF)

Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate of the Oxford Martin School, University of Oxford

DuckDuckGo

Electronic Frontier Foundation (EFF)

Forbrukerrådet // Norwegian Consumer Council

Foundation for Media Alternatives

Free Media Movement (FMM)

Freedom Forum

Fundación Karisma

Gulf Centre for Human Rights (GCHR)

Hiperderecho

Homo Digitalis

IJC Moldova

Initiative for Freedom of Expression- Turkey (IFox)

Irish Council for Civil Liberties

Media Foundation for West Africa

Media Institute of Southern Africa (MISA)

Media Policy and Democracy Project (University of Johannesburg)

Media Policy Institute (MPI)

Media Watch

Metamorphosis Foundation for Internet and Society

Open Rights Group (ORG)

Palestinian Center For Development & Media Freedoms (MADA)

Panoptykon

Paradigm Initiative

PEN Canada

Philippine Alliance of Human Rights Advocates (PAHRA)

Privacy International

Public Citizen

Red en Defensa de los Derechos Digitales (R3D)

Syrian Center for Media and Freedom of Expression (SCM)

TEDIC

The Danish Consumer Council

The Institute for Policy Research and Advocacy (ELSAM)

The Tor Project

Unwanted Witness

Vigilance for Democracy and the Civic State

Repeating Image and Text

More about our partner

La Asociación por los Derechos Civiles

Country of Operation

Argentina

Region of Operation

Asociación por los Derechos Civiles

Website

Coding Rights

Coding Rights is a Brazilian-based think tank that aims to advance the enforcement of human rights in the digital world. Its goal is to ensure that policy-making affecting technological development and digital rights is informed by actual technological knowledge, and that technological development is guided by fundamental human rights.

Country of Operation

Brazil

Region of Operation

Website

Coding Rights

Digital Rights Foundation

Country of Operation

Pakistan

Region of Operation

Website

DRF

Foundation for Media Alternatives

The Foundation for Media Alternatives (FMA) is a non-profit service institution that supports citizens and communities—in particular civil society organisations and other development stakeholders—in their strategic use of Information and Communication Technologies (ICTs). It was founded in 1987 and is based in Manila.

Country of Operation

Philippines

Region of Operation

Website

FMA

Fundación Karisma

Country of Operation

Region of Operation

Website

Fundación Karisma

Hiperderecho

Country of Operation

Peru

Region of Operation

Website

Hiperderecho

Red en Defensa de los Derechos Digitales

Country of Operation

Region of Operation

Website

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

Country of Operation

Paraguay

Region of Operation

Website

TEDIC

The Institute for Policy Research and Advocacy (ELSAM)

Country of Operation

Indonesia

Region of Operation

Website

ELSAM

Unwanted Witness

Country of Operation

Uganda

Region of Operation

Africa

Website

Influence key stakeholders

Our campaign

Achieved Results

Following from this campaign, Google announced that the JioPhone Next, a new low-cost phone launched with Reliance in India, will receive the latest Android operating system and security updates.

Buying a brand new low-cost phone can leave you with an outdated operating system and exploitative apps.

When you buy a brand new lower cost phone (like a Tecno Y2 or MYA 2 for example), it's likely to come pre-installed with insecure apps and an outdated operating system. What this means is that your or your loved ones could be left vulnerable to security risks or to having their data exploited.

While buying the most recent iPhone can give you a secure operating system and reliable encryption, buying a brand new lower cost phone may leave you facing an array of security risks.

We don't think privacy should be a luxury. That's why we advocate for companies to provide the latest security features and privacy protections for low cost phones, as well as high cost phones.

Learn more

Being in a vulnerable situation should not involve greater exposure to government and corporate surveillance.

You might think you own your phone - but there is data on there you can't access, you can't delete, and possibly is being silently leaked to companies you've never heard of.

Lettre ouverte à Google

tech-admin — Tue, 07 Jan 2020 15:23:23 +0000

Target Profile

Google

Audiences and Purpose

Change

We campaign for solutions

We are building a global movement

Content

Pi-Android-mock-up-1-1-photo.png

Summary

Privacy International et plus de 50 autres organisations ont soumis une lettre au PDG d'Alphabet Inc., Sundar Pichai, demandant à Google de prendre des mesures contre les logiciels préinstallés sur les appareils Android qui exploitent les données des utilisateurs.

Media

Key points

Les personnes devraient pouvoir désinstaller sans restriction les applis sur leurs téléphones. Cela implique également toutes les fonctionnalités cachées qui continuent alors que l’appli est désactivée.
Les applis préinstallées devraient être examinées et validées selon le même protocole que les applis Play store, et notamment sur les autorisations du fabricant.
Les applis préinstallées devraient proposer une mise à jour systématique, de préférence via Google et sans compte d’utilisateur.
Google devrait refuser toute certification à un appareil qui ne répond pas à ces exigences de la vie privée, quand des fabricants ou des vendeurs ont tenté d’exploiter les données des utilisateurs sans leur consentement.

Vous pouvez trouver la lettre ci-dessous. Ajoutez votre voix à cette campagne en signant notre pétition si vous pensez qu'il est temps que Google cesse d'activer l'exploitation.

Ce contenu est également disponible en anglais et en espagnol.

Cher M. Pichai,

Nous, les organisations signataires, sommes d’accord avec vous :
la vie privée n’est pas un luxe, offert seulement à ceux qui en ont les moyens.

Pourtant, les « Android Partners » – qui utilisent la marque déposée Android – fabriquent des téléphones avec des applications préinstallées qui ne peuvent pas être supprimées (connues sous le nom de bloatware). Ces applis rendent les utilisateurs très vulnérables : leurs données sont collectées, partagées et exposées sans leur consentement ou même sans qu’ils en aient conscience.

Ces téléphones portent le label « Google Play Protect » alors qu’une étude montre que 91 % des applis préinstallées ne sont pas proposées sur Google Play – Google App Store.

Ces applis préinstallées peuvent avoir certaines autorisations du fabricant qui les laissent fonctionner en-dehors du système de sécurité Android. Ces autorisations, définies par l’appli elle-même (incluant l’accès au microphone, à la caméra et à la géolocalisation), ne déclenchent aucune notification d’alerte de sécurité d’Android. Les utilisateurs n’ont absolument pas connaissance de ces intrusions majeures.

Nous sommes préoccupés par le fait que les utilisateurs de téléphones bon marché sont livrés à ces pratiques commerciales inquiétantes dans le monde.

Les changements que nous demandons en urgence sont les suivants :

Les personnes devraient pouvoir désinstaller sans restriction les applis sur leurs téléphones. Cela implique également toutes les fonctionnalités cachées qui continuent alors que l’appli est désactivée.
Les applis préinstallées devraient être examinées et validées selon le même protocole que les applis Play store, et notamment sur les autorisations du fabricant.
Les applis préinstallées devraient proposer une mise à jour systématique, de préférence via Google et sans compte d’utilisateur.
Google devrait refuser toute certification à un appareil qui ne répond pas à ces exigences de la vie privée, quand des fabricants ou des vendeurs ont tenté d’exploiter les données des utilisateurs sans leur consentement.

Nous, les signataires, pensons que ces changements justes et raisonnables auraient un impact considérable pour des millions de personnes dans le monde, qui ne devraient pas avoir à renoncer à leur vie privée et à leur sécurité en achetant un smartphone.

Nous vous demandons, puisque vous êtes un acteur influent du système, de mieux protéger les personnes et d’empêcher les fabricants de les utiliser abusivement, dans cette course effrénée aux bas prix des smartphones.

Je vous prie d'agréer, Monsieur, l'expression de nos sentiments distingués.

American Civil Liberties Union (ACLU)

Afghanistan Journalists Center (AFJC)

Americans for Democracy and Human Rights in Bahrain (ADHRB)

Amnesty International

Asociación por los Derechos Civiles (ADC)

Association for Progressive Communications (APC)

Association for Technology and Internet (ApTI)

Association of Caribbean Media Workers

Australian Privacy Foundation

Center for Digital Democracy

Centre for Intellectual Property and Information Technology Law (CIPIT)

Citizen D

Civil Liberties Union for Europe

Coding Rights

Consumer Association the Quality of Life-EKPIZO

Datos Protegidos

Digital Rights Foundation (DRF)

Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate of the Oxford Martin School, University of Oxford

DuckDuckGo

Electronic Frontier Foundation (EFF)

Forbrukerrådet // Norwegian Consumer Council

Foundation for Media Alternatives

Free Media Movement (FMM)

Freedom Forum

Fundación Karisma

Gulf Centre for Human Rights (GCHR)

Hiperderecho

Homo Digitalis

IJC Moldova

Initiative for Freedom of Expression- Turkey (IFox)

Irish Council for Civil Liberties

Media Foundation for West Africa

Media Institute of Southern Africa (MISA)

Media Policy and Democracy Project (University of Johannesburg)

Media Policy Institute (MPI)

Media Watch

Metamorphosis Foundation for Internet and Society

Open Rights Group (ORG)

Palestinian Center For Development & Media Freedoms (MADA)

Panoptykon

Paradigm Initiative

PEN Canada

Philippine Alliance of Human Rights Advocates (PAHRA)

Privacy International

Public Citizen

Red en Defensa de los Derechos Digitales (R3D)

Syrian Center for Media and Freedom of Expression (SCM)

TEDIC

The Danish Consumer Council

The Institute for Policy Research and Advocacy (ELSAM)

The Tor Project

Unwanted Witness

Vigilance for Democracy and the Civic State

Repeating Image and Text

More about our partner

La Asociación por los Derechos Civiles

Country of Operation

Argentina

Region of Operation

Asociación por los Derechos Civiles

Website

Coding Rights

Country of Operation

Brazil

Region of Operation

Website

Coding Rights

Digital Rights Foundation

Country of Operation

Pakistan

Region of Operation

Website

DRF

Foundation for Media Alternatives

Country of Operation

Philippines

Region of Operation

Website

FMA

Fundación Karisma

Country of Operation

Region of Operation

Website

Fundación Karisma

Hiperderecho

Country of Operation

Peru

Region of Operation

Website

Hiperderecho

Red en Defensa de los Derechos Digitales

Country of Operation

Region of Operation

Website

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

Country of Operation

Paraguay

Region of Operation

Website

TEDIC

The Institute for Policy Research and Advocacy (ELSAM)

Country of Operation

Indonesia

Region of Operation

Website

ELSAM

Unwanted Witness

Country of Operation

Uganda

Region of Operation

Africa

Website

Our campaign

Achieved Results

Following from this campaign, Google announced that the JioPhone Next, a new low-cost phone launched with Reliance in India, will receive the latest Android operating system and security updates.

Buying a brand new low-cost phone can leave you with an outdated operating system and exploitative apps.

While buying the most recent iPhone can give you a secure operating system and reliable encryption, buying a brand new lower cost phone may leave you facing an array of security risks.

We don't think privacy should be a luxury. That's why we advocate for companies to provide the latest security features and privacy protections for low cost phones, as well as high cost phones.

Learn more

Being in a vulnerable situation should not involve greater exposure to government and corporate surveillance.

You might think you own your phone - but there is data on there you can't access, you can't delete, and possibly is being silently leaked to companies you've never heard of.

Mexico: a TV set for your biometrics data

staff — Tue, 07 May 2019 14:12:45 +0000

Mexico: a TV set for your biometrics data staff Tuesday, May 7, 2019

In Mexico, people registered as beneficiaries of any programmes led by the Ministry of Social Development could obtain a TV set, as part of the transition from analogue to digital TV organised by the Ministry of Communications and Transportation. Yet, the Ministry of Communications and Transportation requested the collection of fingerprints, the scanning of the beneficiary’s voter card and the beneficiary’s address in exchange of the TV set. The company Codigo Empresarial SA de CV was tasked with the collection and storage of this data. The move was deemed illegal by the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI).

https://r3d.mx/2015/09/07/por-que-sct-solicita-datos-biometricos-para-la-entrega-de-televisores/

Publication: R3D

https://www.proceso.com.mx/437309/sct-vulnero-la-ley-al-recabar-datos-biometricos-entrega-tv-digitales-inai

Publication: Proceso

Location

Safeguarding Peoples' Dignity

Related learning resources

Examples of Abuse

Our fight

What PI is fighting for

Protect People and Communities Online

Learn more

Biometrics

Poverty

More about our partner

Social Media Surveillance

See more examples

Date

Monday, September 7, 2015

Content

Educational

Stories

Data Privacy Week: Confronting the Corporate Gaze

staff — Tue, 29 Jan 2019 08:47:26 +0000

Data Privacy Week: Confronting the Corporate Gaze staff Tuesday, January 29, 2019

The Privacy International Network is celebrating Data Privacy Week, where we’ll be talking about how trends in surveillance and data exploitation are increasingly affecting our right to privacy. Join the conversation on Twitter using #dataprivacyweek.

It is no mystery that data exploitation is part of most consumer-oriented tech companies’ business models. A big part of our lives is recorded and exploited, from our web searches, to our personal communications, location, and our shopping habits, just to name a few data points, to generate even more data about us, through the observation of the data trail we leave behind.

Our lives are then not only under the scrutiny of governments and their (mass) surveillance activities, but also under the eyes of corporations looking to extract value from our data and interactions. All of this is happening at a global scale, and in many cases with little or non-existent safeguards.

The Privacy International Network is working to expose companies that fail to protect their customers’ data, analysing their terms of service and practices, exploring how users perceive social media platforms, and studying how these platforms are being leveraged for intelligence purposes.

Telecommunications: How do they (not) defend our data?

How transparent are telecommunication companies about their collaboration with law enforcement agencies? Red en Defensa de los Derechos Digitales (R3D) posed that question in their report “Who does not defend your data” (available in Spanish). It examines a new federal telecommunications law in Mexico that imposed obligations for telecommunications companies to collaborate with law enforcement agencies, many of them poorly drafted and undermining the right to privacy.

In Uganda, Unwanted Witness had a similar question. They researched the existing legal framework on telecommunications and privacy to explore how companies were protecting their customers’ data. Their subsequent report is pretty self-explanatory: Your Communication and Personal Data is not Safe Anymore, and highlights the lack of regulation to protect the rights of the users of telecom companies and Internet Service Providers, which is compounded by the absence of data protection legislation.

(In)visible followers: Social and state surveillance enabled by social media

Our relationship with social media is becoming increasingly complex: while providing new audiences to promote our messages and defend our causes, it also enables unprecedented levels of surveillance of our actions.

7iber focused their attention on that tension, investigating why people in Jordan are increasingly migrating from Facebook to Twitter (available in Arabic). Their research found that, among other factors, users' perception of social surveillance from their families on Facebook had triggered that decision.

Meanwhile, the Argentina-based Asociación por los Derechos Civiles researched the use of open source intelligence in their report “Followers we don’t see” (available in Spanish). They analysed the government's monitoring of social media to investigate crimes, and detailed how this ‘cyber patrolling’ had eroded the right to privacy and freedom of expression, creating a chilling effect for social media users.

In some cases the scale of the surveillance is bigger. In a report launched this week, 7amleh, a partner organisation from Palestine, describes how the Israeli government restricts key telecommunications infrastructure in Palestine, including access to frequencies and key network equipment. This control of key infrastructure facilitates violations of Palestinians’ right to privacy and freedom of expression.

Digital platforms: How accountable are they?

Finally, there is the question of the accountability of digital platforms. Two members of the PI Network have studied this issue: Dejusticia, in Colombia, researched the accountability of Google and other big Internet companies, while Digital Rights Foundation (DRF) prepared a report about ride-sharing apps in Pakistan.

After analysing privacy policies from more than 30 companies with business models based on data exploitation, Dejusticia found that their practices were not properly addressed by the current personal data framework (available in Spanish). Moreover, they concluded that many of these practices, like user profiling, need to be further addressed by legislative and regulatory reform.

In Pakistan, DRF prepared a detailed study on the practices of Uber and Careem in the country, highlighting the need for better complaints mechanisms and security procedures, which are particularly necessary from a gender perspective and the specific impacts that such policies have over women. They also found that both companies’ privacy policies lack basic guarantees such as data breach disclosures and contain unspecified data sharing provisions, among other flaws.

Countering the hidden data ecosystem

Alongside the work of its partners, Privacy International has been active in countering corporate exploitation. Last year, we presented a complaint against seven companies for wide-scale and systematic infringements of data protection law.

We also launched a report outlining how how apps on Android share data with Facebook, finding that at least 61 percent of the apps that were tested automatically transfer data to Facebook the moment a user opens the app, regardless of whether people have a Facebook account or not.

The fight to confront and counter the corporate gaze is only beginning, and we will keep working with the Network to expose and push back against exploitative practices that impact our privacy, freedom, and autonomy.

Learn more

Data Protection

What PI is fighting for

Expose Data Exploitation: Data, Profiling, and Decision Making

Our fight

Safeguarding Peoples' Dignity

Location

Jordan

Palestine

Digital Rights Foundation

More about our partner

Dejusticia

La Asociación por los Derechos Civiles

Our data is not for trade

Our campaign

When Big Brother Pays Your Benefits

When Social Media makes you a target

Content

News and Analysis

Reports

State of Privacy Mexico

tech-admin — Sat, 26 Jan 2019 15:41:26 +0000

State of Privacy Mexico tech-admin Saturday, January 26, 2019

Introduction
Right to Privacy
Communication Surveillance
Data Protection
Identification Schemes
Policies and Sectoral Initiatives

Introduction

Acknowledgement

The State of Privacy in Mexico is the result of an ongoing collaboration by Privacy International and Red in Defensa de los Derechos Digitales (R3D) in Mexico.

Key Privacy Facts

1. Constitutional privacy protections: The right to privacy is enshrined in article 6 of the Mexican constitution.

2. Data protection law: A number of pieces of legislation regulate data protection in Mexico, primarily the 2010 Federal Law on the Protection of Personal Data held by Private Parties, and the General Law on the Protection of Personal Data by Public Entities (Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados) entered into force on 26 January 2017.

3. Data protection agency: The primary data protection agency is the National Institute for Transparency, Access to Information and Data Protection (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales, 'INAI').

4. Recent scandals: In November 2018 reports by the New York Times, Citizen Lab, R3D and Article 19 revealed that two journalists from newspaper Ríodoce were targeted with Pegasus just days after the journalist Javier Valdez, cofounder of the publication, was murdered. The malware attacks took place even after previous cases of abuse had been made public.

5. Recent development: Mexico became the 2nd Latin American country to accede to the Council of Europe’s Convention for the protection of individuals with regard to Automatic Processing of Personal Data (known as "Convention 108") and its Additional Protocol. The Convention and its Protocol entered into force in respect of Mexico on 1 October 2018.

Right to Privacy

The constitution

The right to privacy is enshrined in article 6 of the Political Constitution of the United Mexican States, which stipulates that:

"A. In order to exercise the right to information, the Federation, the States and the Federal District, in the sphere of their own cognizance, shall be ruled by the following principles: (...)

II. Information regarding private life and personal data shall be protected according to law and with the exceptions established therein:

Article 16. No person shall be disturbed in his private affairs, his/her family, papers, properties or be invaded at home without a written order from a competent authority, duly explaining the legal cause of the proceeding.

All people have the right to enjoy protection on his personal data, and to access, correct and cancel such data. All people have the right to oppose the disclosure of his data, according to the law. The law shall establish exceptions to the criteria that rule the handling of data, due to national security reasons, law and order, public security, public health, or protection of third party's rights.(...)"

Regional and international conventions

Mexico has ratified several international instruments relevant to the right to privacy, including:

In 2018, Mexico became the second Latin American country to accede to the Council of Europe’s Convention for the protection of individuals with regard to Automatic Processing of Personal Data, also known as “Convention 108”, and its Additional Protocol and thus becomes its 53rd Party. The Convention and its Protocol entered into force in respect of Mexico on 1 October 2018.

Communication Surveillance

Introduction

Mexico had a total population of over 129 million in 2017. The country had a national internet penetration figure of around 63.85 % in 2017. That year, the mobile phone subscription rate was around 88.5 persons per 100.

According to a 2015 study by PricewaterhouseCoopers, Mexicans spend an average of just under four hours per day on social media, and the most popular social media platforms include Facebook, Twitter, Youtube, Google+ and Linkedin.

Surveillance laws

In Mexico, the following laws regulate communication surveillance:

National Code for Criminal Procedure (Código Nacional de Procedimientos Penales)
- Article 291: Private communications surveillance. This article authorizes the Mexican Attorney General, or the public servants to whom he delegates this faculty, and his counterparts within each federal entity, to request authorization from the competent judicial authority to intercept communications when the Public Prosecutor deems it necessary, stating the object and necessity of such measure.
- Article 303: Geographic location in real-time and request for disclosure of stored data. This article authorizes the Mexican Attorney General, or the public servants to whom he delegates this faculty, to request the competent judicial authority to require from the telecommunication services providers and/or licensees the disclosure of this type of information, in a timely and sufficient way. This article also establishes that the information should be destroyed in case it does not serve as appropriate or relevant means of proof.
Federal Police Law (Ley de la Policía Federal)
- Article 8: Among the powers and obligations of the Federal Police, it establishes the requirement "[t]o request, in writing, the judicial authority to authorize private communication surveillance for the investigation of crimes."
- Article 51: Establishes that preventive communication surveillance shall be authorized only in relation to the commission of the following crimes (from the National Criminal Code):
  - a) Escape of convicts;
  - b) Crimes against health, with some exceptions;
  - c) Corruption of minors or incompetent persons;
  - d) Pornography of underage or incompetent persons;
  - e) Sexual tourism against underage or incompetent persons;
  - f) Sexual trafficking of underage or incompetent persons;
  - g) Exploitation of the body of underage or incompetent persons;
  - h) Assault committed in highways or roads;
  - i) Homicide related to organized crime;
  - j) Human trafficking of underage or incompetent persons;
  - k) Car theft;
  - l) Extorsion;
  - m) Money laundering;
  - (From the Federal Law for Firearms and Explosives): clandestine insertion of firearms, in terms of the Federal Law Against Organized Crime;
  - (From the the General Migration Law): human trafficking of persons without papers, and persons mentioned by the General Law to Prevent and Punish Kidnapping Crimes.
National Security Law (Ley de Seguridad Nacional):
- Article 34: Authorizes the CISEN to request the judicial authority, in the terms regulated by the Mexican Constitution and this law, to authorise the surveillance of private communications for those cases which imply threats against National Security. It also defines communication surveillance as the capturing, tapping, monitoring, recording or registering, performed by an authorized entity, of private communications of any kind and by any means, device or technology.
- Article 39: Establishes that surveillance can be applied to private communications or broadcasts, carried out by any means of transmission, whether already known or to be known, or in person, including the recording of private images.
Federal Telecommunications and Broadcasting Law (Ley Federal de Telecomunicaciones y Radiodifusión):
- Article 189: Establishes that telecommunication licensees and, where applicable, the service providers of apps and content and authorized entities, are obliged to respond to any written request, duly justified by reasons of fact and law, from a competent authority.
- Article 190: Establishes that telecommunication licensees and, where applicable, the authorized entities, are obliged to (amongst others): (...) II. Maintain a registry and control of communications made through any line, under any method, which allows the identification of listed data. (...) IV. Have a dedicated division, available 24/7, to handle requests for information, geographic localization and private communication surveillance as mentioned above.
Federal Law Against Organized Crime (Ley Federal Contra la Delincuencia Organizada):
- Article 16 (...) Establishes that private communication surveillance covers a whole system of communications, or applications that result from technological evolution, that allow the exchange of data, information, audio, video and messages, as well as electronic archives that record and/or preserve the content of the communications or register data that identifies the communications, which may be presented in real-time or after the communication process has been carried out.
- Article 17: Establishes that the requests for communication surveillance must: be duly justified by reasons of fact and law; state the individual or individuals subject to the measure; identify the place or places where it will be carried out, if possible; identify the type of communication, its duration and the process to be implemented and the lines; identify the numbers or devices that will be tapped and, where applicable, the denomination of the telecommunication service licensee by whom the communication surveillance will be implemented. This article also determines that the time limit of the surveillance, including its extensions, shall not exceed six months. After this period, new communication surveillance shall be authorized only when the Public Prosecutor demonstrates there is new evidence that justifies it.
- Article 24: Establishes that the jurisdictional authority must order the destruction of those registries of communication surveillance that are not related to the crimes investigated or to other crimes that require the opening of a different investigation, unless the defense requests that such information be preserved because it considers it useful for its work. Also, that the authority should order the destruction of the registries from unauthorized communication surveillance or when these exceed the time limit of the corresponding judicial authorization.
- Article 28: Establishes that any public servant involved in private communication surveillance should maintain discretion about their content of those communications.
General Law to Prevent and Punish Crimes of Kidnapping (Ley General para Prevenir y Sancionar los Delitos en Materia de Secuestro):
- Article 24. Establishes that the Mexican Attorney General, or the public servants to whom he delegates this faculty, his counterparts within each federal entity and the authorities so empowered by law, may request from the federal judicial authority approval to surveil private communications. The request for authorization shall include its legal basis, the reasoning behind its applicability, the type of communications to be tapped, and where applicable, the subjects or the lines, devices, numbers and places that will be surveilled, as well as the time of surveillance, which cannot exceed six months. The investigative authority may use all the technological means it deems necessary to carry out the surveillance. In any case, it is the obligation of the telecommunication services licensees involved to assist in this.
- This article also states that the disclosure of private communications in application of this law constitutes an exception to the duty of confidentiality established by other laws.
- The Public Prosecutor may offer to the corresponding judge, as means of proof, the findings revealed by the surveillance. If not admitted, they must be destroyed.
- Finally, the article mentions that any procedure developed in terms of this law, carried out by means of illegal or unauthorized conduct, must be nullified by the respective judge. Article 50 Ter. establishes that authorization for surveillance of private communications, in application of this law, shall be granted only in cases of homicide, assault in highways or roads, car theft, kidnap or illegal detention, the crimes previously mentioned from the Federal Criminal Code as well as from the Law to Prevent and Punish Crimes of Kidnapping and their equivalent crimes regulated by local laws from the federal entities.
Guidelines for Collaboration on Security and Justice Matters (Lineamientos de Colaboración en materia de Seguridad y Justicia). The seventh guideline establishes that the Licensees and Authorized Entities are obliged to designate a division responsible for handling te requests for geographic localization, in real-time, of mobile devices and equipment, and disclosure of stored data and private communication surveillance. This division shall be available 24/7 to attend such requests.
Proposed Internal Security Law (Ley de Seguridad Interior). In December 2017, a law which proposed to expand the communications surveillance powers of CISEN, the Center for Research and National Security, an intelligence agency under the Ministry of the Interior, was approved by the Chamber of Deputies, and referred for debate and adoption in the Senate. A wide range of international actors including the UN Special Rapporteur on Human Rights has expressed concerns over the draft law. In November 2018, the Mexican Supreme Court overturned the proposed law with the nine voting judges concluding the proposed law was unconstitutional and that the legislative process had included procedural violations.

Surveillance actors

According to the National Code of Criminal Procedure (Código Federal de Procedimientos Penales) and applicable legislation, the only authorities empowered to conduct communication surveillance are:

The Federal Police;
Center for Research and National Security (Centro de Investigación y Seguridad Nacional, CISEN); and
the Public Prosecutor agencies.

Surveillance capabilities

Law enforcement access to communications data

The Mexican government appears to have a significant appetite for communications surveillance. Mexican mobile operators fielded more than 55,000 requests from authorities for information on citizens' calls, messages, and location data, according to figures obtained by Reuters in 2015. This was nearly 25 percent higher than in 2013.

A report publised by R3D in November 2016 revealed a marked increase in the number of requests by Mexican authorities for access to communications data. The report called surveillance "out of control".

Intrusion malware

ln 2015, files from Italian surveillance technology company Hacking Team were hacked and released to the public. Information in the leak revealed that the following Mexican government agencies purchased technology to intercept private communications:

The governments of Durango, Querétaro, Estate of Mexico, Puebla, Campeche, Baja California, Tamaulipas, Nayarit, Sonora and Yucatán;
the Marine Ministry (Secretaría de Marina);
the Army;
the Federal Police;
the Prosecutor's Office of the State of Mexico;
CISEN; and
PEMEX (the Mexican oil institution).

The media disclosed that the Mexican government was the number one client of the Italian firm and that among the technologies purchased was Hacking Team's Remote Control System "Da Vinci" product and other malware used to spy social networks and mail services including Facebook, Twitter and Gmail. Also, in 2014, it became public knowledge that the Mexican government acquired technology to bug mobile phones from the Finnish company NetHawk. To date, the government has failed to inform the public under which conditions this technology would be used, for what purposes, by which entity and the legal basis of its deployment.

In February 2017, an investigation by the Citizen Lab revealed that government-exclusive spyware from Israeli firm NSO group was used in an espionage operation targeting Mexican government food scientists and two public health advocates working to combat obesity. A journalist investigating official corruption, Rafael Cabrera, had also been targetted with the spyware. Further details about targets were revealed by the Citizen Lab and R3D in mid-2017. These included lawyers investigating the mass disappearance of students, an anti-corruption campaigner, influential journalists and an American representing victims of sexual abuse by the police, according to the New York Times. In December 2017, the UN and IACHR Special Rapporteurs on Freedom of Expression jointly called on the Mexican government to establish an independent investigation into the use of the spyware, and to establish a legal framework to protect individuals from arbitrary and clandestine interference in their privacy.

In 2018, new cases of surveillance abuse with NSO Group malware Pegasus were discovered. First in September 2018, CitizenLab published a new report presenting further evidence that NSO Group's Pegasus spyware had been active in Mexico, even after revelations of surveillance of human rights defenders and journalists in the case known as #GobiernoEspía. Then in November 2018 reports by the New York Times, Citizen Lab, R3D and Article 19 revealed that two journalists from newspaper Ríodoce were targeted with Pegasus just days after the journalist Javier Valdez, cofounder of the publication, was murdered. The malware attacks took place even after previous cases of abuse had been made public. This appears to show a total disregard by the Mexican government and serious negligence by NSO Group.

In 2017 following the first evidence presented on the use of Pegasus to target journalists and HRDs, an investigation by the Special Prosecutor’s Office for Crimes Against Freedom of Expression (FEADLE) of the Office of the General Prosecutor was announced but no progress has been made to date.

Despite the emergence of further evidence in 2018, Mexico has not accepted the establishment of an international monitoring mechanism and documents related to the contracting and use of Pegasus malware have not even been made public by Mexican State authorities.

Surveillance oversight, checks and balances

Article 69 of the General Law for Transparency and Access to Public Information imposes the duty to those authorities allowed to carry out communication surveillance to publish periodic statistical reports on the purpose, temporal scope and legal basis of:

The number of surveillance communication requests;
Access to the communications registry; and
Access to data regarding the geographic localization of mobile communication devices in real time.

Also, they must include a reference that the corresponding judicial authorization was granted. Moreover, the Federal Telecommunications Institute (Instituto Federal de Telecomunicaciones) is in charge of verifying that the telecommunication service providers effectively comply, without undue delay, with their transparency obligations, in accordance to the Guidelines for Collaboration on Security and Justice Matters (Lineamientos de Colaboración en materia de Seguridad y Justicia).

The telecommunications regulator (IFT) removed the transparency obligations that were previously included in the Guidelines for Collaboration on Security and Justice Matters which obligated telecommunications companies to report every 6 months data about user data requests made by authorities.

A report by R3D, ¿Quién no defiende tus datos?, revealed that, according to the transparency reports that were submitted by telecommunications companies to the telecommunications regulator (IFT), during 2016 and 2017, telecommunications companies received more than 145,000 requests for user data, out of which 94% of the times the information was surrendered, even when 30% of the requests were made by unidentified authorities or authorities that do not have a legal right to access user data requests. Moreover, the biggest telecommunications company (Telmex/Telcel) surrendered data 100% of the times authorities requested data (more than 116,000 requests).

As revealed by R3D in their report, Transparencia y vigilancia en México: lo que no sabemos sobre lo que el gobierno sabe de nosotros, transparency obligations established in the General Law on Transparency, which mandate that authorities to publish statistics on surveillance operations, have not been complied with by any authority.

Surveillance case law

In April 2016, the Second Chamber of the Supreme Court of Mexico rejected a legal challenge to the data retention provisions of the Federal Telecommunications Act (also known as the 'Ley Telecom') requiring all telephone companies and internet service providers to retain users' communications data for 24 months. The challenge had been filed by the Red en Defensa de los Derechos Digitales (R3D) on behalf of a group of Mexican journalists, human rights activists, and students. R3D is appealing the decision to the Inter-American Court of Human Rights.

Data Protection

Data protection laws

The following pieces of legislation concerning data protection have been enacted:

The Federal Law on the Protection of Personal Data held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP) enacted on 5 July 2010 and entered into force on 6 July 2010.
The Regulations to the Federal Law on the Protection of Personal Data Held by Private Parties (Reglamento de la Ley Federal de Protección de Datos Personales en Posesión de los Particulares) enacted on 21 December 2011 and entered into force on 22 December 2011.
The Privacy Notice Guidelines (Lineamientos del Aviso de Privacidad) enacted on 17 January 2013 and entered into force on 18 April 2013.
The Parameters for Self Regulation Regarding Personal Data (Parámetros de Autorregulación en materia de Protección de Datos Personales) enacted on 29 May 2014 and entered into force on 30 May 2014.
The General Law on the Protection of Personal Data by Public Entities (Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados) entered into force on 26 January 2017.

Accountability mechanisms

According to the Federal Law for the Protection of Personal Data in the Possession of Private Parties (Ley Federal de Protección de Datos Personales en Posesión de Particulares, 'LFPDPPP'), the data owners have the right to request access, rectification, and deletion of their personal data, and to object to its processing.

The authority in charge of solving any controversies derived from the exercise of the above-mentioned rights at the federal level is the National Institute for Transparency, Access to Information and Data Protection (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales, 'INAI'). At the local level, each state has its own similar institution. Ultimately, the data owners can also recur to domestic courts through an "amparo", a remedy for the protection of constitutional rights, which is found in certain jurisdictions. The INAI is authorized to perform on-site visits to verify that the data controller's facilities comply with the LFPDPPP. The LFPDPPP provides for the following sanctions:

A warning instructing the data controller to carry out the actions requested by the data owner, under the terms established by this Law;
A fine from 100 to 160,000 days of the Mexico City minimum wage;
A fine from 200 to 320,000 days of the Mexico City minimum wage; and
In the event of repeated occurrences of the violations described in the preceding paragraphs, an additional fine imposed from 100 to 320,000 days of the current Mexico City minimum wage. With regard to violations committed in processing sensitive data, sanctions may be increased by up to double the established amounts.

Data breaches: case law

Privacy International is not aware of any case law arising from data breach cases in Mexico. Please send any tips or information to: research@privacyinternational.org

Examples of data breaches

In 2015, a database containing voter registration records was published online, exposing the personal information of 93.4 million Mexican citizens. The records contained the individuals' name, photograph, complete address, date of birth, last names of their parents, occupation and their unique voting credential code. The Instituto Nacional Electoral (INE), a body that oversees the elections in Mexico, indicated the involvement of a political party in the leak. The INE later stated that it had filed a criminal complaint with Mexico's Special Prosecutor's Office for Electoral Crimes (FEPADE) and the cyber division of the national police.

In 2017, following revelations about a major leak of data from car hire app Uber in 2016, the Mexican National Institute of Transparency, Access to Information and Protection of Personal Data (INAI) asked Uber for information on the number of "Mexican users, drivers and employees" that had have been affected. The institute also asked Uber for information on the measures the company is taking to mitigate the damage and protect clients' information.

In October 2017, it was revealed that MoneyBack, the company responsible for returning value-added tax to foreign tourists who visited Mexico, left an unsecured database on the internet with 400 GB of files of sensitive personal information, such as passport numbers, credit cards and official IDs of foreign citizens.

Identification Schemes

ID cards and databases

Mexico's national ID card scheme is called the Unique Population Registry Code (Clave Única de Registro de Población, 'CURP'). A CURP number is available to all inhabitants of Mexico, domestic and foreign, and Mexicans living in other countries. To request a CURP, an individual must provide a copy of an identity document (such as a birth certificate, naturalization letter, or immigration document). The CURP is currently used in a number of sectors, including the Tax Administration System (on the Registration of Tax Identification Card, on annual income taxes), education (on school records and certificates) and in military service (on the military service card).

Voter registration

The electoral card ("credencial de elector" or "credencial del INE") is also a widely accepted form of official ID. To obtain an electoral card, a Mexican citizen must present his/her certificate or proof of nationality, photo identification, and a proof of address.

SIM card registration

Mandatory SIM registration was introduced in 2009 in Mexico under the National Mobile Telephone User Registry (Registro Nacional de Usuarios de Telefonía Móvil, 'RENAUT') scheme. The scheme required new subscribers to be fingerprinted upon purchasing a handset or phone contract. However, it was repealed in 2012 and the Federal Institute for Access to Information and Data Protection (IFAI) was required to destroy all personal data of Mexicans contained in the registry.

Policies and Sectoral Initiatives

Cybersecurity policy

In late 2016, the Office of the National Commissioner on Security implemented, by means of the Federal Police, a Cybersecurity Strategy that allows the formulation and strengthening of courses of investigation to identify and locate possible perpetrators of cyber attacks. The strategy is carried out by the Scientific Division and has three main premises:

Preventing cybernetic crimes by disseminating information and orienting citizens;
Timely detection of cybernetic threats and attacks, with the aim of reducing, neutralizing or mitigating their negative effects on the population; and
Strengthening the technical and scientific capabilities to investigate and prosecute cybercrime.

In April 2017, the General Secretariat of the Organization of American States (OAS), provided technical assistance to the Mexican government for the development of a National Cybersecurity Strategy.

Cybercrime

In Mexico, there is a National Response Center for Cybernetic Incidents (Centro Nacional de Respuesta a Incidentes Cibernéticas, CERT_MX) controlled by the Federal Police. There is also the Coordination Centre for the Prevention of Electronic Crimes (Coordinación para la Prevención de Delitos Electrónicos) subject to the Scientific Division of the Federal Police.

Encryption

Privacy International is not aware of any laws or regulations that specifically regulate the use of encryption technologies in Mexico. Please send any tips or information to: research@privacyinternational.org

Licensing of industry

The telecommunications regulatory body in Mexico is the Federal Institute of Telecommunications (Instituto Federal de Telecomunicaciones). The licensing criteria in this field are regulated by:

The Federal Law of Telecommunications and Broadcasting; and
The decree that modifies and incorporates several dispositions to articles 6, 7, 27, 28, 73, 78, 94 and 105 of the Political Constitution of the United Mexican States, in matters of telecommunications.

E-governance/digital agenda

The Mexican government's e-governance initiative, e-Mexico, was launched in 2001 following a nationwide consultation process. The main aims of the initiative were to increase connectivity through the installation of Digital Community Centers offering low-cost, low-barrier internet access, and create content in various sectors, particularly e-Health, e-Learning, e-Economy, e-Science and Technology, and e-Government.

Health sector and e-health

The Mexican government has an e-Health initiative, e-Salud. The portal serves as a clearing house for information related to the physical, mental and social well-being services, health centers and various health promotion and disease prevention and detection tools.

Smart policing

We are not aware of any specific examples of smart policing in Mexico. Please send any tips or information to: research@privacyinternational.org

Transport

In 2017, a proposed amendment to the Transportation Law approved by the congress of the Mexican state of Puebla places obligations on ride-share apps including Uber and Cabify to provide access to allow "any competent authority" access to clients' data used to provide the service, including GPS data, in order "to monitor the drivers and ensure the safety of users. Mexican civil society group R3D called on the Puebla Congress not to approve these amendments to the law over concerns about its vagueness and disproportionality, and the absence of controls and accountability mechanisms governing access to users' data.

Smart cities

In 2016, the Mexican city of Puebla hosted the Smart City Expo, a fair of smart city technology and an "international summit of discussion about the link between urban reality and technological revolution." It held another expo in June 2017.

Migration

We are not aware of any specific examples of privacy issues related to migration in Mexico. Please send any tips or information to: research@privacyinternational.org

Emergency response

We are not aware of any specific examples of privacy issues related to emergency response in Mexico. Please send any tips or information to: research@privacyinternational.org

Humanitarian and development programmes

We are not aware of any specific examples of privacy issues related to humanitarian and development programmes in Mexico. Please send any tips or information to: research@privacyinternational.org

Social media

We are not aware of any specific examples of privacy issues related to social media in Mexico. Please send any tips or information to: research@privacyinternational.org

List Icon (DO NOT USE)

List Image (DO NOT USE)

Location

Related learning resources

State of Privacy

More about our partner

Content

Reports

Change

We uncover and expose

Summary

A study of privacy and surveillance issues in Mexico. The State of Privacy project was last updated on January 2019, unless otherwise provided on specific pages.

The Right to Privacy in the United Mexican States

staff — Mon, 06 Aug 2018 08:43:58 +0000

Content

This report is presented by Red en Defensa de los Derechos Digitales (R3D) and Privacy International (PI). La Red en Defensa de los Derechos Digitales (R3D) is a non-governmental, non-profit organisation located in Mexico, dedicated to the defence of human rights in the digital environment. Privacy International (PI) is a non-governmental, non-profit organisation located in London, focused on the defence, promotion and protection of the right to privacy around the world.

PI and R3D wish to raise concerns regarding the situation of the violation of the right to privacy in Mexico, for consideration in the next review of Mexico as part of the 31st session of the Universal Periodic Review (UPR) Working Group.

Este informe está disponible en español.

Repeating Image and Text

Location

Mexico

Latin America

Democracy portfolio country

Off

More about our partner

Red en Defensa de los Derechos Digitales

Country of Operation

Region of Operation

Website

Target Stakeholders

Our impact

Recognition of Privacy in UN Human Rights Mechanisms

We got the UN to address and build on the right to privacy.

Learn more

Governments compel companies to store data on their customers and the data they generate through using communications services.

As digital communications grow, governments continue to seek new ways of getting access to content and metadata.

Our fight

Safeguarding Peoples' Dignity

The promises made with innovation have not been enjoyed by all equally. Innovative solutions can be designed to empower and serve individuals and communities, rather than state and corporate power. A new approach to data and technology must be established to make this a reality.

What PI is fighting for

Modernise the Rule of Law and Strengthen Surveillance Safeguards

Fighting against the most intrusive surveillance laws and campaigning to make sure they protect people’s privacy.

El Derecho a la Privacidad en los Estados Unidos Mexicanos

staff — Tue, 29 May 2018 12:12:35 +0000

Content

Este informe es presentado por la Red en Defensa de los Derechos Digitales (R3D) y Privacy International (PI). La Red en Defensa de los Derechos Digitales (R3D) es una organización no gubernamental, sin fnes de lucro, ubicada en México, dedicada a la defensa de los derechos humanos en el entorno digital. Privacy International (PI) es una organización no gubernamental sin fnes de lucro ubicada en Londres enfocada en la defensa, promoción y protección del derecho a la privacidad alrededor del mundo.

PI y R3D desean presentar preocupaciones en torno a la situación de violación al derecho a la privacidad en México, para su consideración en el próximo examen a México dentro de la sesión 31 del Grupo de Trabajo del Examen Periódico Universal (EPU).

This report is available in English.

Repeating Image and Text

Location

Mexico

Latin America

Democracy portfolio country

Off

More about our partner

Red en Defensa de los Derechos Digitales

Country of Operation

Region of Operation

Website