Law and security in labor data management in Mexico

Your name, address, and contact phone number are very important pieces of information that we must handle with care, meaning we should only share them with trusted contacts because mishandling them can lead to tragedies like scams. Regarding this, individually we can select which people we share this with; however, the more complicated issue is what to do when our data is held by a company, and that is precisely what we are discussing in this blog.

The management of labor data in Mexico is mainly governed by the Federal Law on the Protection of Personal Data Held by Private Parties, which establishes the principles, rights, and obligations related to the processing of personal data. In the workplace, this implies how companies or employers must handle the personal information of their employees or job candidates. Here are the basic principles:

Federal Law on the Protection of Personal Data Held by Private Parties

Legitimacy, consent, and loyalty: data must be collected and processed fairly, legally, and with the consent of the owner, except for exceptions where the law allows it without consent.

1. Information: the data owner must be informed about the purposes for which their personal data is collected.

2. Quality: data must be accurate, necessary, and relevant for the purposes for which it is collected.

3. Purpose: data can only be collected for specific, explicit, and legitimate purposes, and must not be processed in a manner incompatible with those purposes.

4. Loyalty: the processing of data must guarantee adequate protection of the owner's privacy.

5. Proportionality: only data strictly necessary in relation to the purposes for which it is collected should be gathered.

   
   

Furthermore, ARCO rights also apply in Mexico, meaning a set of fundamental rights that any person has to control their personal data. These rights are covered under the Federal Law on the Protection of Personal Data Held by Private Parties and consist of:

ARCO

• Access: the right to know what personal data is being processed and the purpose of the processing.

• Rectification: the right to correct inaccurate or incomplete data.

• Cancellation: the right to request the deletion of one's data when it is considered that it is not being processed in accordance with the law.

• Opposition: the right to object to the processing of one's personal data for legitimate reasons related to one's particular situation.

Now then, what obligations do employers have?

1. Guarantee the confidentiality of personal data.
   Inform employees about the processing of their personal data.

2. Obtain consent from employees to process their personal data, except in cases where the law exempts it.

3. Implement physical, technical, and administrative security measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access, or processing.

4. Limit the use and disclosure of personal data.
   Respond to ARCO rights requests from data owners.