Mexico: Whether a third party can access personal information included in government databases, including home address, through the Unique Population Registration Code (Clave Única de Registro de Población, CURP) or driver's license; protection of personal data in case a driver's license is lost or stolen (2016-July 2018)

Research Directorate, Immigration and Refugee Board of Canada, Ottawa

1. Access to Personal Information with the CURP

In response to an access to information request filed by the Research Directorate, a representative from the National Institute of Transparency, Access to Information and Protection of Personal Information (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales, INAI) indicated that [translation] "[a]ny person can consult or know the CURP of a Mexican citizen" through the web portal of the Ministry of the Interior (Secretaría de Gobernación) set up for this purpose (Mexico 21 June 2018). A print-out of the web portal is attached to this Response. The INAI representative explained that anyone who has either someone else's 18-character CURP, or their complete first and last names, date of birth, and the name of the federal state where he or she was born, can obtain the following information through the web portal of the Ministry of the Interior:

[translation]

• CURP.
• First surname.
• Second surname.
• First name(s).
• Sex.
• Date of birth.
• Nationality.
• Federal state of birth.
• Type and data of the document [used to obtain the CURP].
• Historical entries, in cases where there have been amendments to the CURP [1]. (Mexico 21 June 2018)

The INAI representative explained that the Ministry of the Interior's web portal to consult the CURP is [translation] "considered a source of public access as it can be consulted by any person without there being any rule or norm that prohibits it" (Mexico 21 June 2018). The same source further indicated that, according to Mexican law, obtaining personal data through publicly accessible sources does not require the consent of the person in question (Mexico 21 June 2018).

In correspondence with the Research Directorate, an associate professor at the University of Colorado Denver whose areas of focus include criminology, and science and technology, and who has published a book on surveillance technologies and information systems in Mexico, stated that, drawing on his previous research from 2010 to 2012, if someone knows another person's name, sex, and place and date of birth, which is [translation] "fairly common," a CURP can be obtained "quite easily" (Associate Professor 16 June 2018).

Sources indicate that the CURP does not indicate a person's address (Mexico 21 June 2018; Professor 16 June 2018). Sources indicate that a third party cannot access a person's home address only by knowing the CURP (Managing Partner 10 June 2018; Professor 16 June 2018).

1.1 Driver's Licenses

Sources indicate that the information contained in driver's licenses in Mexico varies from state to state (Mexico 21 June 2018; Professor 16 June 2018). In correspondence with the Research Directorate, the Managing Partner of a law firm with offices in Monterrey, Nuevo León and Mexico City, whose practice areas include the protection of personal data, stated that

[translation]

it is important to note… that in addition to the name of the driver, all Mexican driver's licenses contain the [holder's] home address. Consequently, if a third party has access to the driver's license of another person, they would have direct access to the home address that the person registered during the process to obtain the driver's license. (Managing Partner 10 June 2018)

The Keesing Reference Systems provides 8 samples of Mexican driver's licenses, 5 of which contain the holder's home address, and 3 of which do not [2] (Keesing Reference Systems n.d.).

In correspondence with the Research Directorate, a professor at the Faculty of Law at the Autonomous Technical Institute of Mexico (Instituto Tecnológico Autónomo de México, ITAM), stated that some driver's licenses include the CURP (Professor 16 June 2018). The representative from INAI indicated that if a driver's license has the information required by the web portal of the Ministry of the Interior, a third party may be able to access someone's CURP (Mexico 21 June 2018).

2. Protection of Personal Data

According to the Managing Partner, it is [translation] "very common" that driver's licenses are lost or stolen, and used by third parties to sell personal information or commit illicit acts such as identity theft (Managing Partner 10 June 2018). The INAI representative indicated that when an identity document is lost or stolen, the person must report it to the competent authorities of the state (Mexico 21 June 2018). The same source indicated that, in the case of Mexico City, complaints can be filed with a civil judge (Juez Cívico) and the claimant must produce either official identification or two witnesses in order to establish their identity (Mexico 21 June 2018). Sources indicated that thefts can be reported to a state Prosecutor General's Office (Fiscalía General) (Managing Partner 10 June 2018; Professor 16 June 2018). According to the Managing Partner, in cases where the driver's license is lost, [translation] "it is important to report said loss to the relevant state Motor Vehicle Control Institute (Instituto de Control Vehicular) in order to deregister said license and to process a new one through the driver's license replacement procedure" (Managing Partner 10 June 2018).

According to the INAI representative, filing a report [translation] "does not protect personal data per se; rather, it is only a way to prevent a potential identity theft, that is to say, against the misuse of the lost or stolen document, as the affected person can demonstrate that he or she was not the one who used it in this way" (Mexico 21 June 2018). Other sources similarly indicate that with the record of the report, the affected person can protect themselves against legal responsibility for any improper use of their stolen license (Managing Partner 10 June 2018; Professor 16 June 2018). The Managing Partner stated that these protection measures are therefore [translation] "effective" because of the protection they afford from "any type of civil and/or penal responsibility" (Managing Partner 10 June 2018). The Professor indicated that the effectiveness of filing a report [translation] "is subject to the type of claim or illegal act that was committed using the license" (Professor 16 June 2018). The same source also indicated, without providing further details, that [translation] "if someone's personal information is used without their consent, they can approach the [INAI], either at the national or local level, to ask that they oblige the holder of the illegally acquired information to remove it from the database" (Professor 16 June 2018). According to the same source, this means of defence is [translation] "effective" (Professor 16 June 2018). Corroborating information could not be found among the sources consulted by the Research Directorate within the time constraints of this Response.

This Response was prepared after researching publicly accessible information currently available to the Research Directorate within time constraints. This Response is not, and does not purport to be, conclusive as to the merit of any particular claim for refugee protection. Please find below the list of sources consulted in researching this Information Request.

Notes

[1] The Agreement for the Adoption and Use by the Federal Public Administration of the Unique Population Registration Code (Acuerdo para la Adopción y Uso por la Administración Pública Federal de la Clave Unica de Registro de Población) provides the following:

[translation]

ARTICLE 2. The unique population registration code shall contain eighteen characters, defined as follows:

1. The first four places shall be letters and shall be obtained as follows: the first two shall be the initial and first internal vowel of the first surname, in that order; the third shall be the initial of the second surname and the fourth shall be the initial of the first given name.
   When the first or second surname is hyphenated, only the portion before the hyphen shall be used for inclusion in the code.
   When the name of a physical person includes articles, prepositions, conjunctions or contractions, these shall not be included in the code.
   For women, maiden names only must be used;
2. The next six places shall be numbers, indicating the year, month and day of birth, in that order.
   The year shall be rendered with the last two digits; when the month or day are a number less than ten, they shall have a leading zero;
3. The next place shall be a letter, "H" for male and "M" for female;
4. The next two places shall indicate, in the case of individuals born in Mexico, the federative entity in which they were born. For this purpose, the codes appearing in Annex I, which forms part of this Agreement, shall be taken into consideration. For individuals not born on Mexican territory, these places shall be filled with the codes provided in the regulatory instruction issued by the Ministry of the Interior;
5. The next three places shall be letters, corresponding to the first internal consonants of the first surname, second surname and first given name, in that order;
6. The next place shall be either a number or letter, and shall be used to differentiate the codes in cases of homonymy. This place shall be progressive in nature and shall be assigned by the Ministry of the Interior.
   This place shall be a number for persons born 31 December 1999 and earlier, with a leading zero, and a letter for persons born 1 January 2000 and later, with a leading A, and
7. The last place shall be a number, a verification digit assigned by the Ministry of the Interior.

Specific cases not covered in this Article must be resolved in accordance with the regulatory instruction issued by the Ministry of the Interior. (Mexico 1996)

[2] The 5 samples that contain the holder's home address are from the following states: Nuevo León (expires in 2013), Guanajuato (expires in 2016), Jalisco (expires in 2012), Puebla (expires in 2010), and Veracruz (expires in 2012); the 3 samples that do not contain the holder's home address are from Mexico City (expires in 2013), Baja California (expires in 2013) and the state of Mexico (expires in 2008) (Keesing n.d.).

References

Associate Professor, University of Colorado Denver. 16 June 2018. Correspondence with the Research Directorate.

Keesing Reference Systems. N.d. "Mexico - MEX - Driving Licence." [Accessed 28 June 2018]

Managing Partner, law firm in Mexico. 10 June 2018. Correspondence with the Research Directorate.

Mexico. 21 June 2018. Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI). Correspondence from a representative to the Research Directorate.

Mexico. 1996. Acuerdo para la Adopción y Uso por la Administración Pública Federal de la Clave Unica de Registro de Población. Excerpt translated by the Translation Bureau, Public Services and Procurement Canada. [Accessed 25 June 2018]

Professor, Instituto Tecnológico Autónomo de México. 16 June 2018. Correspondence with the Research Directorate.

Additional Sources Consulted

Oral sources: Academic specializing in corruption in Mexico; Instituto Nacional de Desarrollo Jurídico; Instituto para la Seguridad y la Democracia A.C.; law firm specializing in criminal law; Mexico – Instituto Nacional de Ciencias Penales, Plataforma Nacional de Transparencia, Secretaría de Gobernación; Universidad Nacional Autónoma de México — Instituto de Investigaciones Jurídicas; World Bank.

Internet sites, including: ecoi.net; Mexico – Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales; Mexico News Daily; Reforma; UN – Refworld; World Bank.

Attachment

Mexico. N.d. Secretaría de Gobernación. "Consulta curp." [Accessed 21 June 2018]