Privacy Recommendations for the reopening of social, educational and economic activities in Mexico

Regarding recent measures taken by the Mexican Federal Government on the “Notice that sets forth a Strategy for the Re-aperture of Social, Educational and Economic Activities, as well as a Streetlight System by Region” in order to assess -on a weekly basis- the epidemiological risk related to the re-aperture activities in each state, as well as certain mandatory extraordinary safety measures” published in the Official Gazette of the Federation on May 14th, 2020, particularly regarding the preparation of Sanitary Protocols and the implementation of filters at workplaces, which is why it is important to take into consideration that the data treated is considered as sensitive data.

In general terms, it is of great importance to keep in mind that it is an obligation of everyone who holds and processes Personal Data, for example, employers towards their workers, clients (individuals) or visitors (at their offices), to issue a Privacy Notice in accordance with the Federal Law on the Protection of Personal Data in the Possession of Individuals. Thus, Personal Data owners must be informed of the sensitive personal data to be processed, including their purposes and how to exercise their “ARCO” rights, mainly.

Regarding the Sanitary Protocols, it should be taken into consideration that health-status data is considered as sensitive data, because they are directly related to the state of health of individuals, for example, body temperature, so it is necessary to inform the data owners through the Privacy Notice that such data will be treated, when applicable. As well as the fact that, due to the current situation and by rule of the General Law of Health, part of the treatment of such Personal Data requires for it to be shared to the Health Authorities in Mexico.

In the state of Jalisco, through the Jalisco Plan for economic reactivation, a protocol for the application of periodic tests and permanent evaluation of workers must also be implemented.

However, since those Personal Data are considered sensitive, it will be necessary to protect it with high security protocols, not keeping it for longer periods than necessary, nor to share it unlawfully to third parties, as well as to avoid discrimination in case that the owner of such Personal Data presents symptoms of the Coronavirus disease. In my opinion, written consent from the owner of sensitive Personal Data to treat information on his or her health status is not necessary under the current situation.

In addition to the above, it is highly advisable to raise awareness among Personal Data owners and to invite them to responsibly and voluntarily disclose any symptoms related to the disease caused by the Covid-19 virus.

To consult the “Notice that sets forth a Strategy for the Re-aperture of Social, Educational and Economic Activities, as well as a Streetlight System by Region” in Spanish please click here.

To consult the Jalisco Plan for economic reactivation in Spanish please click here.