Ley No. 787, Ley de Protección de Datos Personales, supervision, sanctions, and complaints

Article 28 creates the Direccion de Proteccion de Datos Personales, attached to the Ministry of Finance and Public Credit, with a director designated by that ministry's highest administrative authority, to control, supervise, and protect the processing of personal data in public and private data files.

Article 29 gives the Direccion de Proteccion de Datos Personales broad functions: advising on this Act's content and scope, issuing rules on confidentiality, integrity, and security, requesting information from public and private data file holders, imposing administrative sanctions on offenders, filing complaints with the competent authority, verifying registration requirements, accrediting inspectors, promoting self regulation models, opining on relevant bills, publicizing the right to informational self determination, and cooperating with foreign data protection authorities.

Article 34 lets an accredited inspector inspect on a complaint or on its own motion with judicial authorization, and article 35 requires a person or entity under inspection to allow the inspectors access to its data files, cooperate with the inspection, supply the requested information and documents, including its operating registration and security measures, and allow its equipment to be reviewed.

Article 44 classifies as a minor infraction processing personal data without the required express consent, failing to include, complete, rectify, update, suppress, block, or cancel data on request, failing to follow the Direccion de Proteccion de Datos Personales' instructions, collecting data through a form that lacks a clear notice that a file will be created, and sending advertising to a person who has refused it.

Article 45 classifies as a serious infraction processing personal data by fraudulent means or in violation of this Act, obstructing the right to informational self determination or unjustifiably denying requested information, breaching the professional secrecy this Act requires, repeating a minor infraction, keeping a data file without the minimum security, integrity, and confidentiality conditions the applicable rules require, or obstructing an inspection.

Article 46 gives the Direccion de Proteccion de Datos Personales power to impose the administrative sanctions of a warning or suspension of processing operations for a minor infraction, and closure or cancellation of the data file, temporary or permanent, for a serious infraction, without prejudice to any separate liability for damages or any criminal sanction.

Articles 47 through 51 give a data subject an administrative protection action before the Direccion de Proteccion de Datos Personales to learn of their processed data, to challenge a breach of confidentiality, integrity, or security, to correct false, inaccurate, outdated, omitted, or unlawfully processed information, to access information a public or private entity holds about them, and to demand correction, inclusion, suppression, blocking, or cancellation of their data, brought by the data subject, their guardian, their heirs, or a representative, and article 52 lets the data subject use a constitutional amparo action once the administrative route is exhausted, and lets a data controller separately challenge an administrative act under the law governing the Executive Power's procedures.