Trends and developments
What is the current state of the telecoms market in your jurisdiction, including any trends and recent developments/deals?
The telecoms legal framework in Mexico has dramatically transformed in the past four years. Changes are aimed at revamping the regulatory regime in order to:
- modernise the original statute, which was geared towards regulating traditional telephony services;
- match the expectations of investors (domestic and foreign); and
- above all, promote the three elements which are essential for the development of a vibrant telecoms market:
- foster connectivity improvement on a nationwide basis;
- promote effective competition among players; and
- maintain consumers' rights.
Regulatory changes promoted by the new Federal Telecommunications and Broadcasting Law of July 14 2014 have been gradually but decisively altering carrier and consumer practices, thanks to greater involvement by the new telecoms regulator, the Federal Institute of Telecommunications, which has broad authority over consumer protection and competition issues relating to the telecoms market. The recent Organisation for Economic Cooperation and Development report entitled outlines how the law has tackled Mexico's shortcomings relating to access to telecoms services, choice and competition (see www.oecd.org\\publications\\oecd-telecommunication-and-broadcasting-review-of-mexico-2017-9789264278011-en.htm).
What is the primary legislation governing the telecoms market in your jurisdiction?
The primary legislation governing the telecoms market in Mexico is twofold:
- the 2013 amendments to the Mexican Constitution provided the fundamental vision, mission and mandates to Congress and the Federal Institute of Telecommunications (IFT) in relation to telecoms; and
- the Federal Telecommunications and Broadcasting Law and the IFT’s rules and regulations provide the necessary regulatory detail.
Since the Federal Telecommunications and Broadcasting Law entered into force, the IFT has actively crafted and issued secondary rules and regulations which are intended to foster much-needed disruption in the telecoms market. Some key regulatory pieces issued by the IFT include regulations for mobile virtual network operators and the Rules for Collaboration by Telecoms Carriers with Judicial Authorities.
Are any regulatory reforms or initiatives envisaged?
While the IFT clearly prefers not to amend the Federal Telecommunications and Broadcasting Law, and instead continues to implement the telecoms framework by adopting and implementing rules and regulations, certain important matters have recently been decided by the Supreme Court of Justice which will likely require amendments to the Federal Telecommunications and Broadcasting Law in 2018. For example, the statutory provisions in the law regarding the so-called ‘zero access tariff for interconnection’ were deemed unconstitutional by the Supreme Court (because the authority was deemed to have been vested directly on the IFT by the Constitution. See www.internet2.scjn.gob.mx/red2/comunicados/noticia.asp?id=4582).
Universal service obligations
What universal services obligations apply?
Through Mexico's National Digital Strategy, the government has formally adopted a policy which seeks to reduce the digital divide in Mexican society. The Federal Telecommunications and Broadcasting Law incorporates thorough universal services coverage principles and objectives under the supervision of the Ministry of Communications and Transportations (SCT). The SCT must publish an annual connectivity programme to reach the universal services goals. The Federal Telecommunications and Broadcasting Law dedicates a whole chapter to universal services obligations and sets out the general guidelines that the ministry must follow in order to create the universal services plan.
Pursuant to the law, universal service obligations refer to the right to access telecoms services determined by the Ministry of Communications and Transportations. These services include access to information technologies, including broadband.
Private entities wishing to participate in the Mexican telecoms market must obtain a concession from the Mexican government, which will include specific obligations relating to regular reporting of relevant information so that the SCT can quantify and assess progress, as well as compliance with and participation in the universal services plan created by the ministry.
Which authorities regulate the telecoms sector and what is the extent of their powers?
The IFT is the main regulator. Under the Federal Telecommunications and Broadcasting Law, the IFT gained a great deal of autonomy to regulate, promote and supervise the efficient development of the Mexican telecoms sector. Interestingly, the IFT, in addition to becoming the regulator of telecoms services, was vested with the authority to address and resolve all competition issues therein.
While the SCT is now vested with mostly policy-related functions and authority, it still plays an important role in a number of issues relating to telecoms, such as:
- universal services coverage;
- revocation and extension of concessions;
- telecoms and radio policies for the federal government; and
- international coordination of Mexico's satellite resources.
Finally, other government authorities may also have certain authority under the Federal Telecommunications and Broadcasting Law, such as the Ministry of Government which regulates:
- the management of official government broadcasting time;
- television and radio contests;
- television and radio content ratings; and
Are there any restrictions on foreign ownership or investment in the domestic telecoms market?
Mexican law provides that only an entity incorporated under Mexican law may be titleholder of a telecoms concession. There is no limitation on foreign investment in the capital stock of such a Mexico entity, as long as its activity is limited to telecoms. For broadcasting activities, the maximum foreign investment permitted in a Mexican entity is 49%, provided that such percentage will be reduced based on the nationality of the foreign investor or the ultimate controlling entity to reflect such nation's foreign investment restrictions in the broadcasting sector.
Licensing and authorisation
What licenses/authorizations are required to provide telecoms services?
Mexican legislation provides for two types of licence in order to provide telecoms services:
- concessions; and
Concessions are issued by the Federal Institute of Telecommunications (IFT) to enable the provision of public telecoms services. The Federal Telecommunications and Broadcasting Law provides for four types of concession:
- commercial use concessions;
- public use concessions;
- private use concessions; and
- social use concessions.
Concessions are issued exclusively to Mexican entities (ie, entities incorporated under Mexican law) for up to 30 years (renewable). Concessions relating to telecoms services are applied for and granted based on the applicant’s business plan. In the case of concessions relating to spectrum or orbital positions, the award is subject to an auction and bid process.
Non-concessionaires seeking to resell telecoms services or operate as a mobile virtual network operator (or mobile virtual network enabler or mobile virtual network aggregator) must obtain an authorisation. These parties cannot have their own interconnection and roaming agreements. Although nothing in the Federal Telecommunications and Broadcasting Law prevents foreign entities from applying for a reseller authorisation, the IFT's position is that only Mexican entities can apply for authorisations. There are no restrictions on foreign ownership of such an entity.
Telecoms services which are not subject to either a concession or an authorisation are considered to be deregulated services. As a result, the so-called ‘value-added services’ which in the past were subject to a registration-only process may now be freely offered without registration or authorisation.
What are the eligibility, documentary and procedural requirements to obtain a license/authorization?
The provision of telecoms services continues to be subject to the granting of a concession. New sector participants must apply for a single concession (see below).
In the case of spectrum, frequency bands are subject to auction and a bid process. The main change in the Federal Telecommunications and Broadcasting Law is that the chief consideration for the award need not be the economic component of the bid. The law has also shifted the focus of the determination of the floor price of bid processes. The IFT, rather than the Ministry of the Treasury, now determines the floor price with the ministry's prior non-binding opinion in order to migrate from a revenue collection focus to an industry development-driven focus.
The IFT must publish an auction plan annually. Industry participants may comment on the plan and request additional frequency bands be added or that the plan be refocused to address specific needs. As in the past, the state maintains sovereign domain over the means of communication within the telecoms networks.
A new feature incorporated into the Federal Telecommunications and Broadcasting Law is the single (all encompassing) concession. Carriers that hold more than one concession may:
- apply for a single concession, thereby consolidating all of the services being offered (which historically are more likely than not the subject matter of more than one concession) into one concession; and
- petition to have additional converging services included in the single concession.
The single concession will be effective for up to 30 years and is renewable, subject to an IFT ruling to the effect that the applicant is complying with its obligations under its existing concessions and the carrier's acceptance of the IFT's terms and conditions.
The acquisition of spectrum via a bid is not the only means by which a concession holder can provide telecoms services using spectrum. The Federal Telecommunications and Broadcasting Law provides two additional alternatives – namely, the leasing of spectrum between concessionaires and the acquisition of spectrum from a competing carrier. Both options require the IFT's prior approval and the acceptance of certain obligations by the lessee or the purchaser of the spectrum (primarily the joint and several liability of the lessee in connection with obligations provided for in the concession of the leased frequency bands and continuity of service obligations where the purchase of spectrum comes with pre-existing obligations and additional obligations imposed by the IFT).
The IFT's decision will include an analysis of the competitive effects of the lease or sale of spectrum.
Resellers and mobile virtue network operators (mobile virtual network enabler or mobile virtual network aggregator) must obtain a licence (not a concession) from the IFT in order to operate. A licence will be granted for up to 10 years and entitles its holder to:
- access wholesale services offered by concessionaires;
- sell its own services and resell those contracted on a wholesale basis; and
- access its own numbering or that of the wholesaler.
In addition, satellite-landing rights are now subject to a licensing process, whereas the prior telecoms law required a concession.
Validity period and renewal
What is the validity period for licenses/authorizations and what are the terms of renewal?
Concessions are issued for a maximum term of 30 years and authorisations for a maximum term of 10 years. Each may be renewed for a like period if applied for before the start of the fifth part of their respective term and if the applicant is in good standing and meets all of the requirements of law.
The IFT must resolve applications within 60 days of submission. The IFT will record the renewal of the concession in the Public Registry of Concessions.
What fees apply?
The filing fees involved vary annually.
What is the usual timeframe for obtaining a license/authorization?
With regard to concessions, the application must be resolved within 60 days of its filing. If the IFT decides that relevant information is missing, it will afford the applicant 30 additional business days to provide the missing information. If the IFT resolves to grant the concession, the interested party will have 20 business days to pay the applicable fees and the IFT will issue the concession title within 15 business days following payment. Finally, the day after the notification of authorisation is granted, the IFT has 15 business days to record this in the Public Registry of Concessions.
Authorisation applications will be resolved by the IFT within 30 business days of filing. If the 30 days expire without a resolution, a favourable resolution will be deemed to have been granted and the IFT must issue a resolution to that effect within 30 business days.
Network access and interconnection
What rules, requirements and procedures govern network-to-network access and interconnection?
Access and interconnection is regulated by the Federal Telecommunications and Broadcasting Law and the fundamental technical plans for numbering, switching, signalling, transmitting, charging, synchronising and interconnecting is issued by the Federal Institute of Telecommunications (IFT).
The 2013 constitutional reform and the Federal Telecommunications and Broadcasting Law of 2014 clearly address operators’ obligation to interconnect. As the sector regulator, the IFT determines effective competition conditions and must issue the rules pursuant to which operators can compensate each other for interconnection. For all practical purposes, interconnection rates are determined by the IFT, particularly in connection with the preponderant carrier.
In the telecoms sector, a carrier deemed preponderant (see below) is subject to the following (among other things), and requires the IFT’s prior approval:
- the publication of service reference offers;
- a framework interconnection agreement;
- the sharing of infrastructure;
- an unbundling of the local loop;
- the provision of access on a non-discriminatory basis;
- resale services; and
Further, it requires:
- accounting separation;
- the provision of unbundled tariffs to end customers (with the IFT's approval);
- the provision of intermediate services to carriers, licence holders and parties authorised to operate alone in order to avoid cross-subsidisation;
- disclosure of the network topology, including its specifications, functionalities and capacities; and
- in connection with government procurement processes, an obligation to provide intermediate services to competing carriers or licence holders that have been awarded government contracts, but lack the infrastructure to provide those services which can be supplied only by the preponderant economic carrier.
Are access/interconnection prices subject to regulation?
Telecoms operators can freely set the prices for access and interconnection services that they provide, except in the case of the preponderant carrier, whose prices are subject to IFT approval.
The Federal Telecommunications and Broadcasting Law adopted the asymmetric pricing principle, based on two main ideas:
- the preponderant carrier's charges to competing operators for any traffic ending within its network will be strictly regulated; and
- the interconnection pricing of any traffic starting on the preponderant carrier's side and ending in another operator's network will be freely negotiated between the parties (which gave rise to the resolution identified as ‘zero interconnection rate’ by the IFT, which based its decision on a specific provision in the Federal Telecommunications and Broadcasting Law).
How are access/interconnection disputes resolved?
The IFT has broad authority to resolve disputes and assess penalties associated with a carrier's non-compliance or anti-competitive conduct.
A carrier can request the IFT to resolve an interconnection dispute. Within five business days, the IFT will decide the application. If the application is accepted, the IFT will notify the other party and that party must provide its arguments and evidence within a further five business days. Following this, the IFT will rule on the admission of the evidence. The parties will then have two business days for closing arguments, and the IFT will issue a resolution within 30 business days. The carriers may enter into a settlement agreement at any time before a resolution is entered.
Have any regulations or initiatives been introduced or proposed with respect to next-generation access?
No new regulations have been introduced with respect to next-generation access. However, there appears to be a public consultation regarding long-term incremental costs within fixed line networks.
What rules and procedures govern telecoms operators’ access to land (both public and private) to install, maintain and repair infrastructure?
No specific or special rules and procedures govern telecoms operators’ access to land in order to install, maintain and repair infrastructure. The regulatory implications of such actions depend on whether:
- the land is private, in which case state civil laws apply (provided that other federal or state statutes do not come into play, such as in those cases where national monuments must be protected); and
- the land is public land (owned by or subject to the jurisdiction of federal, state or municipal authorities), in which case federal laws, state laws and municipal ordinances, or a combination thereof, apply.
Are infrastructure sharing agreements among operators popular and/or encouraged by the regulatory authorities? Which infrastructure sharing structures/agreements are commonly used? Do any regulations apply?
The Federal Telecommunications and Broadcasting Law provides for specific provisions aimed at fostering agreements between or among carriers for collocation and the sharing of infrastructure. Collocation and sharing agreements are fundamentally creatures of contract, provided that if the operators cannot agree the applicable terms and conditions and the envisioned collocation or sharing of infrastructure is essential for the provision of a service and there are no substitutes, or access is limited by law, the Federal Institute of Telecommunications (IFT) may resolve the conditions for collocation or sharing and the corresponding tariff.
The IFT may review infrastructure sharing agreements and issue measures intended to foster non-discriminatory access and avoid anti-competitive effects.
Collocation and infrastructure sharing must be filed in the Public Telecommunications Registry.
Pricing and consumer protection
What rules govern retail pricing for telecoms services?
In general, telecoms service providers can freely set the retail prices for the services that they provide. Exceptions apply to the preponderant agent, which must have its retail prices approved by the Federal Institute of Telecommunications (IFT).
What rules govern consumer service contracts?
All telecoms services must comply with basic consumer protection rights. Certain warranties and terms may not be waived, as these protect customers’ interests. Below is a non-exhaustive list of such rights:
- The service provider must render the service according to the terms and conditions either offered or implicit in the advertising or information released, unless there is a covenant or the consumer provides written consent to the contrary.
- The service provider cannot deny (without a valid reason) the sale, acquisition or supply of available services to consumers.
- The service provider must allow consumers to make claims through means similar to those used to make the sale.
- When a customer requests an invoice, the service provider must issue one in a timely manner.
- The service provider must use the information that the consumer provides on a confidential basis.
- The service provider must provide consumers with its physical address, telephone numbers and other means to submit claims or request clarifications.
- The service provider cannot stipulate unreasonable covenants or requirements, or unfair or inequitable obligations, on consumers.
Are telecoms service providers bound by any consumer disclosure requirements?
Yes – in accordance to the Federal Telecommunications and Broadcasting Law, all service providers must disclose a list of minimum consumers' rights. The IFT issued a specific list, which is typically posted on service providers' official websites. The list can be found at www.ift.org.mx/sites/default/files/cartaderechosminimos.pdf.
In addition, certain contracts must be registered with the IFT and the Consumer Protection Bureau. The list of contracts that must be registered can be found at http://rcal.profeco.gob.mx/. Registration can also be voluntary.
Issues and concerns
Are there any particular competition issues or concerns in the domestic telecoms market?
In addition to the figure of preponderance (see below), the Federal Telecommunications and Broadcasting Law and the Mexican Antitrust Law provide the framework for dominant carriers – that is, a carrier that falls foul of Mexican competition law either because:
- it engages in anti-competitive behaviours which are illegal by law, regardless of its size and market influence; or
- its actions are deemed to be anti-competitive because of its size and relevant market participation (see below).
The Federal Institute of Telecommunications (IFT) has been particularly concerned about competition issues in the telecoms market and is investigating the markets listed below (all investigations listed took place at the national level):
- On April 29 2016 the IFT initiated an investigation into alleged relative monopolistic practices (or abuse of dominance practices) in the interconnection, broadband internet access, corporate internet, shared use and active or passive infrastructure markets, as well as in the dark fibre services market.
- On August 22 2016 the IFT initiated an investigation into alleged illegal mergers and transactions concerning the commercial use and exploitation of radio electric spectrum frequencies to render public services in the sound broadcast market.
- On October 18 2016 the IFT initiated an investigation into alleged relative monopolistic practices (or abuse of dominance practices) in the production, distribution and commercialisation of public telephony services to be sold to end users by means of telephone devices in the public use market.
- On September 11 2017 the IFT initiated an investigation into alleged relative monopolistic practices (or abuse of dominance practices) in the fixed and mobile telephony services markets, as well as in the market of fixed and mobile internet services and the production, distribution and commercialisation of audio-visual contents broadcasted on the Internet.
Do any sector-specific competition regulatory/legal provisions apply (eg, special conditions for dominant telecoms market players)?
Preponderant carrier A carrier or group of persons will be deemed a preponderant carrier when, by virtue of their involvement in the telecoms sector, such person or group, directly or indirectly, maintains or attains a participation in excess of 50% in the sector. This percentage is measured nationwide by:
- the number of customers;
- the amount of traffic; or
- the used capacity of the network.
Preponderance (and termination of preponderance) requires an IFT resolution, which must be based on information collected by the IFT. The preponderant economic agent will be freed from preponderance regulations if:
- the market evolves in a manner so that its participation in the sector falls below 50%; or
- it adopts a divestiture plan or similar which causes it to fall below the referenced threshold, provided that:
- such divestiture generates favourable and effective pro-competitive effects in the markets which constitute the telecoms sector;
- he divestiture plan does not adversely affect the social coverage obligations of the preponderant economic agent; and
- no other carriers participating in the sector emerge as the new preponderant economic agent in its stead.
Preponderance imposes a series of obligations on the preponderant economic agent, which will remain in effect until the IFT determines that its preponderance in the sector has ceased. The preponderant economic agent must, among other things:
- maintain accounting separation;
- publish services reference offers;
- abide by a framework interconnection agreement;
- permit access on a non-discriminatory basis;
- enter into sharing agreements relating to its infrastructure and resale services;
- unbundle the local loop under its control;
- permit roaming;
- disclose in detail the topology of its network; and
- provide transport and last-mile services to competing carriers.
In addition, the preponderant economic agent requires prior IFT approval to:
- implement tariffs relating to intermediate services to carriers and licence holders and those charged to operate alone in order to avoid cross-subsidisation; and
- provide unbundled tariffs to end consumers.
Pursuant to the 2013 constitutional amendments and the Federal Telecommunications and Broadcasting Law, the IFT acts as the antitrust regulator of the telecoms sector and is empowered to impose dominant carrier status on telecoms concession or licence holders.
In general, the rules relating to dominance date back to the Mexican Antitrust Law. An economic agent with substantial power over one or more markets (of the telecoms sector) will be subject to dominance regulations. This regime is separate and independent from the declaration and effects of the regulatory regime of the preponderant economic agent. Dominant carrier regulations must be market specific rather than sector specific, as sector-specific regulations are limited to the regime of the preponderant carrier.
In determining the market specific constraints or restrictions, the IFT must identify the profile of the economic agent – that is:
- the breadth and scope of its participation in the market or markets in question;
- the ability of the economic agent to determine prices or restrict access to services;
- the regulatory barriers or restrictions; and
- the possibility of substituting services or other essential resources (elements of the network or services that cannot be replicated and have no direct substitutes) controlled by the economic agent and costs.
Are there any requirements for structural, functional or accounting separation of operators’ activities?
The IFT can impose a structural, functional or accounting separation measure only on the dominant carrier in order to prevent further damage to competition and end users.
What rules and procedures govern spectrum allocation?
The acquisition of spectrum via a bid is not the only means for a concession holder to provide telecoms services. The Federal Telecommunications and Broadcasting Law provides two additional alternatives:
- the leasing of spectrum between concessionaires; and
- the acquisition of spectrum from a competing carrier.
Both options require the prior approval of the Federal Institute of Telecommunications (IFT) and the acceptance of certain obligations by the lessee or the purchaser of the spectrum – in particular, the joint and several liability of the lessee in connection with obligations provided for in the concession of the leased frequency bands and continuity of service obligations where the purchase of spectrum comes with pre-existing obligations and additional obligations imposed by the IFT. The IFT's decision will include an analysis of the competitive effects of the lease or sale of spectrum.
What fees apply to spectrum allocation/authorisation?
Federal law provides the applicable fee on a yearly basis.
Can spectrum licences be transferred, traded or sub-licensed?
Voice over Internet Protocol
How is Voice over Internet Protocol (VoIP) regulated in your jurisdiction?
There is no specific regulation for VoIP services. Nevertheless, VoIP is likely be considered as a regulated service subject to a permit whenever there is connectivity in Mexico (inbound or outbound) which initiates or terminates in a public switched telephone network or uses E.164 ITU-T numbering plans. The Federal Institute of Telecommunications grants these permits only to Mexican companies (which may be wholly owned by foreign investors). The application must contain information on the legal existence of the applicant, the identity of its shareholders, relevant financial information, the pro forma business plan, the commercial plan and the technical plan.
How are telephone numbers allocated in your jurisdiction?
Numbers are allocated according to the numbering plan. In general, the concession holder or reseller (as the case may be) must file a petition with the Federal Institute of Telecommunications (IFT). The IFT will normally take between 30 and 60 days to issue a resolution and allocate the relevant numbers, depending on the natural of the request. In Mexico, there are geographic, centralised and non-geographic numbers.
What rules govern telephone number portability?
In general, portability must:
- be free of charge;
- be executed in no more than 24 hours following the consumer's request; and
- not require formal documentation, apart from the consumer's formal request and his or her official identification.
Further rules can be found at www.ift.org.mx/sites/default/files/contenidogeneral/temas-relevantes/dofpiftext061114213.pdf.
Privacy and data security
What is your jurisdiction’s regulatory stance on net neutrality?
The telecoms operators that provide internet access services should follow the general guidelines issued by the Federal Institute of Telecommunications (IFT):
- Freedom of choice – users of internet access services must be able to access any content, application or service offered by operators, within the applicable legal framework, without limiting, degrading or restricting access to them. Operators may not limit users’ right to access services or incorporate or use any devices that can connect to the network, as long as such devices are standardised.
- Non-discrimination – operators and those authorised to market internet access service cannot obstruct, interfere, inspect, filter or discriminate against content, applications or services.
- Privacy – operators must preserve the privacy of users and the security of the network.
- Transparency and information – operators must publish information on their websites regarding the characteristics of the service offered, including the traffic management and network management policies authorised by the IFT, as well as the speed, quality, nature and guarantee of the service.
- Traffic management – operators may take necessary actions to manage traffic management and network administration in accordance with the policies authorised by the IFT in order to guarantee the quality or speed of service contracted by the user, provided that this does not constitute a practice contrary to healthy and free competition.
- Quality – operators must preserve the minimum levels of quality established for this purpose in the respective guidelines.
- Sustained infrastructure development – in the respective guidelines, the IFT promotes the sustained growth of telecoms infrastructure.
Are there regulations or restrictions on encryption of communications?
No regulations or restrictions relate to the encryption of communications. Based on the constitutional principle of confidentiality of private communications, it follows that encryption is permitted.
Are telecoms operators bound by any rules or requirements on the retention of consumer communications data? If so, for how long must data be retained?
Telecoms concessionaires and, where applicable, authorised telecoms operators (resellers or mobile virtual network operators) must record and control all communication made via owned or leased numbering which allow the following information to be identified:
- the name or corporate name and address of the subscriber;
- the type of communication service (eg, voice transmission, voice mailbox, conference or data), supplementary services (including call forwarding or transfer) or messaging or multimedia services (including short message services, multimedia and advanced services);
- data necessary to trace and identify the original and destination of mobile telephone communications, including the destination number and whether the line is the subject of a contract or tariff plan or is prepaid;
- data necessary to determine the date, time and duration of the communication, as well as the messaging or multimedia service;
- the date and time of the first activation of the service and the location label (cell identifier) since the service was activated;
- identification and technical characteristics of the devices, including the international equipment and subscriber identity codes (where applicable); and
- the digital location of the geographical positioning of telephone lines.
The obligation to retain data will begin from the date on which the communication occurred.
For such purposes, the operator must keep the above data for the first 12 months in systems that allow consultation and delivery in real time to the competent authorities through electronic means. At the end of the 12-month period, the operator must keep the data for an additional 12 months in electronic storage systems, during which time the delivery of information to the competent authorities must be carried out within 48 hours.
All processing and storage systems used by operators and authorised people in this regard must be located exclusively in Mexico.
What rules and procedures govern the authorities’ interception of communications and access to consumer communications data?
In general, interception of metadata is constitutionally protected and access requires a court order.
Rules regarding requests for data are not clearly defined. However, there is an express obligation for service providers to comply with any request from the competent authority or a prosecutor. Administrative authorities request contractual information, IP numbers and information relating to the origin, time and duration of a call. Administrative authorities have, thus far, not requested information relating to metadata. That said, extrajudicial requests should be assessed on a case-by-case basis.
Data security obligations
What are telecoms operators’ general data security obligations to consumers?
Telecoms carriers (including licence holders) must take all necessary technical measures to ensure the conservation, protection, non-manipulation, destruction, alteration or cancellation of data that must be preserved. These obligations are also imposed on personnel authorised to handle and control data. Without prejudice to the Federal Telecommunications and Broadcasting Law, regarding the protection, treatment and control of personal data held by operators or those so authorised, the Federal Law for the Protection of Personal Data held by Individuals applies.
According to this law, anyone responsible for processing personal data must establish and maintain administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction or unauthorised use, access or treatment. Those responsible cannot adopt security measures that are less than those they maintain for the handling of their own information.
Further, according to the Collaboration Guidelines on Security and Justice, operators and authorised companies are responsible for ensuring that:
- the protocols that are or will be used for the acquisition, development or implementation of electronic platforms guarantee the integrity and security of the information transmitted, managed and protected; and
- the protocols operate based on international standards, particularly those relating to safeguarding and protecting users’ personal data, as well as the cancellation and safe suppression of information (eg, ISO/IEC 27000 – information security management systems and National Institute of Standards and Technology Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organisations).
The operators and licensed companies must submit to the Federal Institute of Telecommunications (IFT) an annual report relating to the protocols referred to in the previous paragraph, identifying the international standard to which these protocols adhere. The report must include:
- the protocol for access control to information on real-time geographic locations of the communication equipment;
- the data recorded and authorised by the operators; and
- a risk analysis relating to the transmission, handling and storage of such information.
The IFT may make observations and require the necessary adjustments when, in its opinion, the integrity, security, cancellation and deletion protocols for the information must be modified, without prejudice to the fact that the IFT may require additional information when appropriate.
Operators and licensed companies are responsible for the possession, protection, treatment and control of the personal data of the users. The use of the retained data is prohibited for purposes other than those provided for the Federal Telecommunications and Broadcasting Law and the Collaboration Guidelines on Security and Justice.
Finally, operators and licensed companies must submit to the IFT, in January and July of each year, an electronic report through the mechanism established by the IFT regarding compliance with the Collaboration Guidelines on Security and Justice.