On December 3, 2012, almost a year after data subjects have been able to exercise their ARCO rights (rights of access, rectification, cancellation and objection) before data controllers, the Federal Institute for Access to Information and Data Protection (“IFAI”) imposed a penalty to Pharma Plus, S.A. de C.V. (the operating company of Farmacias San Pablo) due to violations of the Federal Law on the Protection of Personal Data Held by Private Parties.  

IFAI determined that the company violated the “information principle,” as it did not make available to data subjects a privacy notice, and also failed to include the “identity information” in the privacy notice, which identifies the data controller.  

As a result of such violations, IFAI imposed two fines that in the aggregate exceed two million Pesos. The fine for the information principle violation is $1,500,033.78 Pesos (approximately $117,649.70 US Dollars) and for the identity information violation is $500,011.26 Pesos (approximately $39,216.56 US Dollars).  

This penalty sends a clear message to data controllers that IFAI will be closely overseeing compliance with the Act to guarantee personal data protection.  

Source: http://www.ifai.org.mx/video/index.php?id=XGsNIL5A0Nw

Enclosed is the relevant IFAI Publication. Click here to view.