Ley Federal de Protección de Datos Personales en Posesión de los Particulares, enforcement, sanctions and offences

Article 38 charges the Secretaría with disseminating knowledge of the right to data protection, promoting its exercise, and overseeing compliance with the Law.

Article 39 gives the Secretaría the power to monitor and verify compliance, interpret the Law administratively, support responsables technically, issue criteria and recommendations, publish security standards and best practices, resolve rights-protection and verification proceedings and impose sanctions, cooperate with other supervisory authorities, and prepare privacy-impact studies before new processing modalities, among other functions.

Article 40 lets a data subject or representative file a rights-protection request with the Secretaría within fifteen days of the responsable's response, or after the response deadline lapses without one, when the responsable denies, ignores, or inadequately answers an ARCO request; the Secretaría gives the responsable fifteen days to answer, admits evidence, and allows five days for closing arguments.

Article 42 sets a maximum of fifty days to resolve the rights-protection request, extendable once for an equal period on justified cause. Article 43 gives the responsable ten days to give effect to a favourable resolution once notified. Article 45 lets the Secretaría cure deficiencies in the complaint without altering its original content. Article 46 lets the Secretaría dismiss the request, confirm, revoke, or modify the responsable's response, or order delivery of the data.

Article 49 lets the Secretaría seek conciliation between the parties at any point, with a binding written agreement closing the matter. Article 51 lets a party challenge a Secretaría resolution by amparo before specialized federal courts, and article 52 lets the Secretaría publish its resolutions with the data subject's identifying references removed.

Article 53 lets a data subject who suffered damage or injury from the responsable's or persona encargada's non-compliance pursue the compensation available under other applicable law.

Article 54 lets the Secretaría open a verification procedure on its own initiative or on request, and article 56 opens a sanctions procedure when a rights-protection or verification proceeding surfaces a suspected violation; article 57 gives the accused responsable fifteen days to submit evidence and five days for closing arguments, with a fifty-day resolution deadline extendable once for an equal period.

Article 58 lists nineteen infractions, from failing to satisfy an ARCO request without justified reason to processing personal data contrary to the Law's principles, creating a sensitive-data database without a justified purpose, and obstructing a verification act.

Article 59 fines an infraction from 100 to 160,000 times the Unidad de Medida y Actualización for the lesser infractions and 200 to 320,000 times the UMA for the more serious ones, adds 100 to 320,000 UMA for a repeated infraction, and lets sanctions for infractions involving sensitive personal data double.

Article 60 lists the factors the Secretaría weighs when it grounds a sanction: the nature of the data, how plainly unjustified the responsable's refusal was, intent, the responsable's economic capacity, and recidivism. Article 61 states that these administrative sanctions apply without prejudice to any resulting civil or criminal liability.

Articles 62 to 64 create criminal offences: three months to three years' imprisonment for a person authorized to process personal data who, for profit, causes a security breach of a database in their custody; six months to five years' imprisonment for anyone who processes personal data through deceit for undue profit, taking advantage of the data subject's or an authorized person's error; and double the penalty in either offence where the data processed is sensitive personal data.