After several months of waiting, on April 25, 2022, the Supreme Court of Justice of the Nation (SCJN) ruled to invalidate the decree creating the National Registry of Mobile Telephony Users (PANAUT). While by itself, this is great news, it is important to analyze the arguments considered by the SCJN, as they raise many important reflections:
- The PANAUT would result in a "strong impact" on the human rights to privacy and protection of personal data, as it would affect sensitive data of cell phone users. This consideration is important because it confirms that the data intended to be collected must or may be classified as sensitive. In particular, biometric data may be considered as sensitive if their processing allows knowing the present or future health status of the data subject;
- It concluded that there already exist in the Mexican legal system other measures and mechanisms that pursue the same constitutional purpose as the challenged Decree, which are equally suitable but less restrictive of the rights to privacy, intimacy and protection of personal data; the intervention of a judge is required, and such intervention must be justified, reasonable and specific, and there must be a series of limits to the exercise of these powers. The authorities which are permitted to carry out this type of requests must be clearly defined and mechanisms to safeguard the information obtained must be foreseen. It is good to emphasize that there is no obligation to deliver personal data to the authorities, after receiving a request from any authority, since it is clear that this obligation arises when the request comes from a competent authority, where the word competence is a key point.
- By establishing an indistinct and generalized obligation to collect and keep private and intimate information, as well as personal and sensitive data of cell phone users, the Decree disproportionately infringes the fundamental rights to privacy, intimacy and protection of personal data and is incompatible with the requirements and standards imposed by a democratic society. One of the main points of debate was that the PANAUT did not consider the reasonable expectation of privacy, nor the principles of purpose, lawfulness, proportionality, accountability and security, which govern its processing. Likewise, it is very important to take into consideration that there is an informative self-determination, which implies the power of the citizens not to give their personal data, as well as the statement of the Minister President of the SCJN, Arturo Zaldívar, who pointed out that there is no security regarding the handling of the data, so it is not justified that the State has in its possession private information of the citizens. This has been evidenced in other occasions such as the failed National Registry of Mobile Telephone Users, known as RENAUT, or the violation of INE's nominal lists, which are available for purchase in different forums.
Based on the foregoing, by a majority of votes, the Plenary of the SCJN resolved to declare the invalidity of the entire Decree reforming the Federal Telecommunications and Broadcasting Law, with the purpose of creating the PANAUT.
The SCJN determined today that the Decree disproportionately infringes disproportionately infringes the fundamental rights to privacy, privacy privacy, intimacy and protection of personal data