Ley Federal de Protección de Datos Personales en Posesión de los Particulares, sensitive personal data

Article 2, fracción VI defines sensitive personal data as data touching the data subject's most intimate sphere, or whose misuse could cause discrimination or a serious risk to them, and lists, illustratively but not exhaustively, racial or ethnic origin, present or future health status, genetic information, religious, philosophical or moral beliefs, political opinions, and sexual preference; the list does not name a biometric identifier, voiceprint, or faceprint, so a biometric identifier not otherwise tied to one of the enumerated categories is protected only as ordinary personal data under this Law's general regime.

Article 8 requires the data subject's express, written consent, given by autograph signature, electronic signature, or another authentication mechanism, before processing sensitive personal data, and bars creating a database of sensitive personal data unless its creation serves a legitimate, specific purpose consistent with the responsable's explicit activities or aims.

Article 12 requires the responsable to make reasonable efforts to limit the period sensitive personal data is processed to the minimum indispensable, on top of the general proportionality principle article 12 states for personal data generally.

Article 9, fracción VI separately lets a responsable process sensitive personal data without consent for medical prevention, diagnosis, care, or health-service management while the data subject cannot consent, carried out by someone bound by professional secrecy.