Data Protection and Covid-19 vaccination

In Mexico, the documentation requested by the authorities as part of the vaccination process contains the following: official identification, which contains personal data, such as name, age, sex, address, information about existing allergies and the Unique Population Registry Code (CURP).

Nevertheless in many cases the federal health authorities additionally requests a simple copy of the personal documentation of the citizens to be vaccinated, take photographs of said documentation or even take a photograph to the citizens during the process. Due to the fact that this practice is against the principle of proportionality established in the General Law of Protection of Personal Data Held by Obliged Subjects, that means that said interference with the data protection rights of the persons is not proportional to its purpose the INAI, it has requested to the federal health authorities to avoid asking for this further information.

In the event that the federal authorities do not have a privacy notice and request such documentation, said infringing authorities are subjected to an administrative and economic sanction, which cannot be paid with public resources, but has to be borne directly by the director responsible for the infringing authority.

As this practice is not justified for any reason, the INAI has advised the owners of the personal data that they should request the corresponding privacy notice from the health authorities and report them immediately before the INAI to be able to exercise their Cancellation and Opposition rights to avoid the improper use of information in case that simple copies of their documentation are requested or in case the authority requires to take photographs.