The Supreme Court of Mexico confounded privacy advocates in recent weeks by ruling in favor of greatly expanded government access to the bank data of private citizens, but also striking down a plan for a biometric data registry for cell phone users.
Both of the propositions were based on crime issues that are currently hot topics in the country. The warrantless search measure comes as part of the current presidential administration’s campaign to rein in big companies attempting to dodge taxes and stymie money laundering by criminal cartels, while the biometric data scheme was in response to an endemic kidnapping problem that saw overall numbers drop in 2021 but violence against kidnapped migrants increase.
Mexican government agencies will have warrantless access to view bank data
The finance agencies of the nation will now have automatic access to the bank data of citizens, something that previously required a court-issued search warrant.
The Supreme Court ruled that citizen’s right to privacy was secondary to the need for access to bank data to fight money laundering and tax evasion. The decision was sparked by the defense of a businessman in a tax fraud case, who argued that he should not be compelled to hand over bank data as it is private information protected by the country’s constitution.
Minister for the Supreme Court Margarita Rios-Farjat said in an interview that the new powers would be “carefully applied” and that authorities would not be given direct access to accounts or the ability to seize funds. The decision nevertheless riled privacy advocates throughout the country concerned with the possibility of arbitrary targeting, with one prominent politician going so far as to call it “fiscal terrorism.”
The administration of President Andres Manuel Lopez Obrador made crusading against financial crime a major plank of his 2018 campaign, which was considered a historic landslide. The head of the left-wing Morena party put banks and public officials in his crosshairs, seeing an attack on money laundering as a central means of dealing with both tax fraud and the country’s massive drug trade (criminal enterprises worth an estimated $58 billion USD a year). The battle has not gone all that well since the 2018 election, with the head of Mexico’s Financial Intelligence Unit (UIF) stepping down in November 2021 after an incident in which $35,000 in cash was found on a plane carrying guests to his wedding.
Privacy loss on bank data, but win on biometric data
Privacy advocates were upset with the bank data decision, but were also handed a win by the Supreme Court with its ruling that the national government could not go ahead with a plan to collect the biometric data of cell phone users. Phone carriers were also likely quite happy with the ruling, given that they were being tasked with paying the cost for the program.
Nine of the Supreme Court justices voted against the biometric data plan, and the other two voted for partial invalidation of it. The scheme would have created a national registry called “Panaut” that phone companies would have been required to submit user eye or fingerprint scans to. Law enforcement agencies would have been given access to the Panaut biometric database.
The Morena party developed the Panaut plan in 2021 in response to a problem with kidnapping in the country that dates back years. Overall incidents of kidnapping actually dropped by about 200 in 2021, but Mexico still has one of the highest rates of it in the world. The most common targets for kidnapping are foreign long-term residents who have families known to be able to make ransom payments, and migrants passing through the country who are targeted for sex trafficking.
The intent was to make these incidents, along with other types of crime, easier to track. But the plan was suspended shortly after when the country’s telecommunications regulator, IFT, initiated a legal challenge on the basis of potential human rights violations and concerns about the ability to secure sensitive biometric data.
The biometric data of about 120 million phone users, or all but about nine million people residing in the country, would have been subject to collection. The Mexico Internet Association estimated that the plan would cost the country’s phone industry hundreds of millions of dollars to implement.
Though the scope of biometric data collection is new, Mexico has tried mandatory cell phone registration databases before. Former attempts in 2008 and 2011 were abandoned after data breaches leaked citizen information. Critics point out that during the former attempts, criminals simply used cloned and stolen chips to evade detection, and the system was not able to stop jailed cartel heads from communicating by phone with associates while in prison.