Ley para la Protección de Datos Personales, enforcement and sanctions

Article 35 gives the Entidad Rectora, the Agencia de Ciberseguridad del Estado (ACE), power to dictate mandatory policies for managing personal data.

Article 50 lists ACE's attributes, among them supervising and inspecting obligated institutions, exercising sanctioning power, issuing provisional measures, promoting public awareness, resolving disputes over sensitive data classification, supporting responsible parties technically, cooperating with other supervisory authorities, issuing operating policies and security measures, certifying data protection compliance and auditing those certifications yearly, training public and private institutions, publishing implementation guides, and requesting information from public and private entities.

Article 51 gives the ACE Director General these powers except the power to sanction, which a separately appointed Director of Data Protection exercises through delegated administrative sanctioning proceedings, and article 52 sets that Director's qualifications. Article 53 applies the Ley de Ciberseguridad y Seguridad de la Informacion's sanctioning procedure and prescription rules to this Law's infractions.

Article 54 puts the burden of proving consent or delivery of the privacy notice on the responsible party, and the burden of proving a lawful international transfer on the party that transferred the data. Article 55 requires ACE to publish every sanctioning resolution on its website, in a version with personal data dissociated or anonymized.

Article 56 classifies infractions as minor, such as failing to inform a data subject of their rights, not publishing the processor's contact details, failing to notify a breach, unauthorized database access, inaccurate processing, altering an authorization document, charging for a free service, breaching the information or public sector notice duties, or ignoring an ACE request, serious, such as incomplete or inaccurate access responses, unanswered ARCO POL requests, repurposed processing, obstructing an ACE audit, ignoring ACE technical measures, breaching the article 59 prohibitions, or ignoring ACE security policies, and very serious, such as processing without prior consent, denying ARCO POL requests, using a child's data without parental consent, processing an incapacitated person's data without consent, an unlawful international transfer, an unconsented transfer, commercializing personal data, reversing pseudonymization, processing after a revoked consent, or ignoring a valid revocation.

Article 57 fines a minor infraction one to ten, a serious infraction eleven to twenty five, and a very serious infraction twenty six to forty monthly minimum wages of the commercial sector. Article 58 lets ACE order remedial measures on top of a fine and preserves the infractor's civil or criminal liability.

Article 59 bars a responsible party from creating a sensitive data database unlawfully, processing racial, ethnic, political, religious, health, or sexual orientation data outside this Law's sensitive data rules, disclosing personal data learned through one's position, or using, transferring, sharing or commercializing personal data in violation of this Law.