On April 16, amendments and additions to Mexico’s Federal Telecommunications and Radio Broadcasting Law (the “Telecommunications Law”) were published in the Federal Official Gazette. Importantly, the publication creates the National Mobile Phone Users Database (Padrón Nacional de Usuarios de Telefonía Móvil, or “PANAUT” in Spanish), which is to be operated by the Federal Telecommunications Institute (the “Institute”), the government regulatory agency that administers Mexico’s telecommunications networks.
The database will be created through mandatory registration of all mobile phones on Mexico’s cellular networks, whether pre-paid or under contract (pospago), and it is intended to give Mexican law enforcement and courts information related to actual and potential crimes.
What information will be registered in the PANAUT database? Pretty much everything, which is why news of this new legislation is causing an uproar in Mexico and why you should be concerned if you use a mobile phone with a Mexican number.
The PANAUT database will contain comprehensive information about the owner of every mobile phone in Mexico, including the phone number; full name or entity/corporate name of the owner; nationality of an individual owner; residential/corporate address of an owner; copy of photographic identification (e.g. passport number or foreign residence card) of foreign owners, or personal identification card (CURP) of Mexicans; owner’s biometric data (more on that later); for corporate phones, complete identification details for legal representatives; whether the line is pre-paid or under contract (pospago); and the date and time of initial network activation through a SIM card. Subsequently, owners will be responsible for providing updates with new line activations, cancellations, or changes in the phone owner’s identity information, etc. Failure to register a mobile phone by submitting the required information will lead to automatic and immediate cancellation of the phone line without possibility of reactivation or compensation.
For mobile phone lines acquired before April 17, 2021, when the PANAUT database entered into force, mobile phone companies and service providers will have until April 17, 2023 to solicit and receive users’ information and register all lines under their administration. For phones acquired on or after April 17, 2021, mobile phone companies and service providers will have six months to gather and provide user information to the Institute, after the Institute issues implementing guidelines to do so. The law promises considerable fines for mobile phone companies and service providers that fail to comply, so you can be sure they will be motivated to collect your data (and pass it along).
And if, as a foreign citizen/foreign legal representative of a company/foreign company, you are thinking: “Oh! But I was already living in Mexico and had a Mexican number! I have two years to submit my information, and in the meantime, this Telecommunications Law amendment will not really affect me,” or “I can always change my number”, think again and keep reading!
The Implications of Mexico’s New Cellular Data Laws
We see the PANAUT database having the following impacts on those who use Mexican cellphone networks:
1. In the week since the publication of the amendment that provides for the PANAUT database, Mexican society and the Mexican business community have been up in arms about what they see as government overreach that infringes human rights (the right to mobile phone/data services are considered a human right in Mexico), impinges on data privacy, and imposes onerous obligations on businesses. Many Mexican individuals and organizations are filing suit in federal courts in an action called an amparo, and we are recommending our clients do the same (more on this later), so as to protect themselves.
2. Mexico’s mandated database that records and stores all mobile phone user data will conflict with legislated data privacy rights in other jurisdictions and will force individuals and organizations to implement cumbersome workarounds, such as separate phones for use in Mexico for frequent travelers to the country.
3. Though Mexico has imposed on mobile phone companies and service providers specific deadlines for registering all mobile phone lines, these deadlines apply to users as well and nothing prevents mobile phone companies and service providers from requiring users to submit their information well before the official deadlines so long as they prove to have the means to guard the information, just to show the Mexican government they are supportive of the legislation.
4. The threat of account cancellation for non-compliance has raised concerns about potential human rights violations since users can be prevented from accessing mobile phone/data services. Mobile devices have become a primary means to get online and as far back as July 2019, mobile phone penetration in Mexico was over 75 percent among the population above the age of six.
5. The amendment has stated that the Institute will collect for the PANAUT database biometric data for every mobile phone user, but it has not yet specified the biometric data to be collected. We can presume this will require fingerprints at a minimum, but that may be only the start.
6. The Mexican government contends that collecting all this personal and/or sensitive information will help reduce crime, given that many crimes are committed with the aid of mobile phones, but the evidence does not support the government’s position. Yes, criminals carry and use mobile phones, but so do all of the rest of us. The collection of the comprehensive information demanded for the PANAUT database will give the Mexican government unprecedented access to citizens’ (and foreign residents’ and frequent visitors’) private lives, with no guarantees their personal and/or sensitive information will be well-protected. Should this database fall in the hands of criminals, the personal safety of millions of mobile phone users in the country, Mexican and foreign, would be at stake.
Most important to note about the April 16 publication of the amendments to the Telecommunications Law is that the PANAUT database came into force the following day. This means that if you have a Mexican mobile phone, the clock is already ticking for you to provide all your information, and despite the two-year deadline for mobile phones active before April 16, your telecoms provider might ask you for the information sooner. If you are planning to get a new mobile phone in Mexico, or if you got one within the past week, you can expect to be asked to provide your data within the next nine months, if not before.
What can/should you do?
Mexican law provides for a one-month window following the enactment of a law or amendment to challenge it by filing a legal action – which again, is called an amparo – in federal court. The process for doing this has two important effects:
One, filing an amparo will require the Mexican government defend the legitimacy of the legislation and compel mobile phone companies and service providers to state exactly what security measures they will put in place to protect the information they receive. An additional important benefit is that if enough amparo actions are filed and decided in favor of plaintiffs, jurisprudencia (binding court precedent) might be created, rendering this amendment to the Telecommunications Law inapplicable (in effect, kicking the legislation back to the legislature for revision).
Two, and this one is much more important to individuals and organizations, if the court decides an amparo filing in favor of the plaintiff (e.g. you or your business), the plaintiff is exempted from having to comply with the obligation to give away their personal/sensitive data.
It is for this second reason that we are encouraging our clients that do business in Mexico, live in Mexico, or even regularly travel to Mexico, to file an amparo action before the May 31 deadline. Yes, you could freeride on the outrage and accompanying legal actions of the Mexican populace and business community, hoping for a positive outcome and an eventual revision to the legislation, but until the legislative amendment is rejected by the courts and referred back to the legislature, the PANAUT database exists and the law requires you provide your information to it.
Our law firm has geared up to bring such actions in large quantities and because of that, we will be charging only a $150 USD fixed fee for each such action on behalf of any individual or company for the first phone line and $100 USD for each additional line. I urge you to contact me if you wish to bring such action or if you have any questions.