THIRD SECTION EXECUTIVE BRANCH MINISTRY …

1 Translation from Spanish 26/1/12 Wednesday, December 21, 2011 federal OFFICIAL GAZETTE ( THIRD SECTION ) 1 THIRD SECTION EXECUTIVE BRANCH MINISTRY OF THE ECONOMY regulations to the federal Law on the Protection of Personal Data Held by Private Parties In the margin, a seal with the National Coat of Arms that reads: United Mexican Office of the President of the Republic. FELIPE DE JESUS CALDER N HINOJOSA, President of the United Mexican States, in the exercise of the power vested in me by Article 89(I) of the Constitution of the United Mexican States, pursuant to Article 34 of the federal Public Administration Organizational Law and Articles 3(X)

2 , 18, last paragraph, 45, last paragraph, 46, second paragraph, 54, last paragraph, 60, last paragraph, and 62, last paragraph, of the Law on the Protection of Personal Data Held by Private Parties, hereby issues the following: regulations TO THE federal LAW ON THE PROTECTION OF PERSONAL DATA HELD BY PRIVATE PARTIES Chapter I General Provisions Purpose Article 1. The purpose of this law is to regulate the provisions of the federal Law on the Protection of Personal Data Held by Private Parties. Definitions Article 2.

3 In addition to the definitions established in Article 3 of the federal Law on the Protection of Personal Data Held by Private Parties, for the purposes of these regulations , the following definitions shall apply: I. Departments: Those indicated in Article 26 of the federal Public Administration Organizational Law; II. ARCO rights: The rights of access, rectification, cancellation and objection; III. Digital environment: The environment made up of the combination of hardware, software, networks, applications, services, or any other technology of the information society that allows for the exchange or computerized or digitalized processing of data; IV.

4 Exclusion list: Database intended to record free-of-charge the refusal of the data subject to have his personal data processed; V. Administrative security measures: Combination of actions and mechanisms to establish the management, support, and review of the security of information at an organizational level, the identification and classification of information, as well as the creation of an awareness by personnel and their education and training in the area of protection of personal information; VI.

5 Physical security measures: Combination of actions and mechanisms, whether or not using technology, intended to: a) Prevent unauthorized access or damage to or interference with physical installations, critical areas of the organization, equipment and information; b) Protect mobile, portable, or easily removable equipment located inside or outside installations; c) Provide maintenance to equipment containing or storing personal data so as to ensure their availability, proper working order, and integrity, and d) Guarantee the elimination of data in a secure manner; VII.

6 Technical security measures: Combination of activities, controls, and mechanisms with measurable results that use technology to ensure that: a) Access to logical data bases or to information in logical format is by identified and authorized users; b) The access referred to in the previous paragraph is only so that the user may carry out the activities required by his position; c) Actions to acquire, operate, develop, and maintain secure systems are included, and d) The management of communications and computerized resources used in the processing of personal data is carried out VIII.

7 Identifiable individual: Any individual whose identity can be determined, directly or indirectly, by any information. An individual will not be deemed identifiable when to obtain the identification, disproportionate periods of time or activities are required; IX. Transmission: Communicating personal data between a data controller and a data processor, within or outside of Mexico; X. Electronic media: Storage medium that can be accessed only by means of the use of a device with electronic circuits that processes its contents in order to examine, modify or store personal data, microfilms included; XI.

8 Physical media: Storage medium intelligible by sight, in other words, which does not require any device to process its content in order to examine, modify or store the personal data, and Translation from Spanish 26/1/12 Wednesday, December 21, 2011 federal OFFICIAL GAZETTE ( THIRD SECTION ) 2 XII. Suppression: Activity consisting in eliminating, erasing, or destroying personal data, once the blocking period has elapsed, under security measures previously established by a data controller.

9 Subject Matter Article 3. These regulations apply to the processing of personal data found on physical or electronic media that make possible, access to personal data according to specific criteria, regardless of the form or method of its creation, type of media, processing, storage, or organization. These regulations do not apply when, in order to obtain access to personal data, disproportionate periods of time or activities are required. Pursuant to Article 3(V) of the Law, personal data may be in numerical, alphabetical, graphic, photographic, acoustic or other any other form, concerning an identified or identifiable individual.

10 Territorial Scope Article 4. These regulations will be obligatory for all processing when: I. It is carried out in an establishment of the data controller located in Mexico; II. It is carried out by a data processor, regardless of its location, on behalf of a data controller established in Mexico; III. The data controller is not established in Mexico but is subject to Mexican laws as a consequence of entering into a contract or under international law, and IV. The data controller is not established in Mexico and uses media located in Mexico, unless such media are used only for transit purposes that do not involve processing.