Archivos Mensuales: septiembre 2014

Card&Phone - CopyThe position of the United States at the vanguard of fields such as finance and technology may lend itself to create the impression that its legal framework is as progressive as its companies in those lines of business. However that’s not always the case; following are three instances where Mexico actually moved ahead of the USA, regulation-wise:

  • Mexico created an agency mandated to protect users of financial services in instances where their purveyors of financial services were not compliant with the law.

Following the financial meltdown nearly 20 years ago interest rates for financial products, whether credit cards, car loans or mortgages, skyrocketed in Mexico; people were unable to comply with their financial commitments and lost their homes, had their cars repossessed or their assets garnished. Of course this prompted widespread protests, and many politicians reaped dividends by demonizing financial institutions, but the national conversation on those issues brought about the creation of an “Ombudsman” in the financial services industry: the National Commission for the Protection and Defense of Users of Financial Services (CONDUSEF as per its acronym in Spanish).

This agency has faced many challenges, and still does; mainly its “teeth” are not sharp enough, its last three Chairs have steered it more towards facilitating financial education and information to the public. For instance, it recently instituted a Financial Institution Rating Website, where users can check for information on how the banks to which they would apply for credit rate relative to each other compliance-wise, sort of in the same way those institutions can assess applicants based on their credit rating.

Apparently such legislative developments are only brought about by widespread financial turmoil: conversely the United Stated created its financial services Ombudsman, the Bureau of Consumer Financial Protection (CFPB) after the Dodd–Frank Wall Street Reform and Consumer Protection Act was passed in 2010, and began working until 2011 following heated debates over President Obama’s proposal to appoint Harvard Law Professor Elizabeth Warren, who first proposed one such agency, to Chair it.

In sum, Mexico has been over a decade ahead of the United States as concerns the enforcement of financial regulations relative to the public.

  • Banks in Mexico are obligated to issue credit cards which are safer than those issues by banks in the USA. Bank cards the world over are made following ISO 7810 and ISO 7813 standards; that’s how come it’s possible for your card to be swiped at point-of-sale terminals and work in ATMs the world over. Those standards cover aspects such as toxicity of materials, flammability, stiffness (how much the card should bend), how characters (your name, the issuer’s identification number) are embossed onto it, their magnetic stripes, integrated circuits and the track data in them, etc.

Disclosures on data breaches at large retailers such as Target, last year, and more recently The Home Depot, have put credit card and point-of-sale terminal technology on the spotlight. In addition to apparent negligence in implementing security controls, one rather large issue is also the common denominator: that bank cards issued by banks in the United States still rely on magnetic stripes for the storage of data that authenticates the transaction, and that is easily copied or stolen by thieves or hackers. As WIRED Magazine explains in a recent piece:

The fatal problem with the credit card magstripe is that it’s only a container for unchanging, static data. And if static data is compromised anywhere in the processing chain, it can be passed around, copied, bought and sold at will.

Now, after resisting it for 10 years because of the formidable transition costs, the US is about to finally embrace the secure chip-based authentication system called EMV—the standard was pioneered by Europay, MasterCard, and Visa—that the rest of the world has already adopted. Pushed by mounting fraud costs, credit card companies have crafted incentives for merchants to switch to the sophisticated readers needed to accept the cards.

While the New York Times piece in the link above on the Target breach underscores that “The new debit and credit card technology, called chip and PIN, is widely used in Europe and considered to be far more secure than most cards used in the United States, which rely on magnetic strips,” it should be noted that Mexico’s National Banking and Securities Commission has steered banks towards substituting magnetic stripe with integrated circuits for over 4.8 years now: as per its General Provisions Applicable to Credit Institutions that approve transactions made without the use of integrated circuits, whether in ATMS or point-of-sale terminals are bound to agree with their Users (in their respective service agreements) that they (the banks) shall undertake the risks, and therefore the costs, of transactions disavowed by said Users when using such cards, and that the claims from such transactions shall be credited to those Users, at the latest, 48 hours after the filing of the respective claim.

The flip side is that the banks are allowed by regulation to regard the information in such integrated circuits as a Category-3 Authentication Factor for transactions made through ATMs and POS terminals, which obtain the cards’ information through such circuits; that is to say, transactions which require for the card with the circuit to have been present in the moment of the transaction. At that point one could assume that the situation would be no different from one in which a card with a magstripe were involved; however the key here is that information in the circuits is not static and is encrypted, so that even if it had been copied during one transaction it still could not be used for others afterwards.

So to that regard Mexico will have been a good 5 years ahead of the United States in credit card security by the time the US transitions from magstripe cards to cards with integrated circuits.

  • Mexico passed regulations making unlocking of mobile phones legal before the USA did.

For years now mobile carriers have entrenched themselves by offering handsets which price is bundled with the fee for their service plans; but once the mandatory term for the plan is over the user is faced with the choice between continuing to cope with her former carrier, usually upgrading to a newer (and hopefully) better handset (which Apple facilitates a lot by releasing a new iPhone every year and a half or so), or moving onto another carrier and having to procure another handset from it, as the old one would only work in the network of the previous carrier. That is evidently a pain and unfair to consumers; after all, one the term for the plan is over and done, the handset has been paid for (often in excess), so the user ought to be able to keep using it, even with a competitor of the carrier.

For sure “jailbeaking” has been possible for awhile now, and even ruled by the Copyright Office of the United States to be an exception to the Digital Millennium Copyright Act (the DMCA). but it is not without risk, as it may impair you from access to essential updates or applications, and removing the protections originally put in place by the developer can put the device and information contained in it at significant risk. However unlocking your device is an entirely different proposition.

Acknowledging a basic right of consumers, Mexico’s Ministry of Economy passed on August 28th, 2012, Mexican Official Norm NOM-184-SCFI-2012, an administrative regulation whereby carriers are under obligation to inform if the handset provided to the consumer is blocked to only be used in its network, and how it can be unlocked, at no additional cost, to be used on other networks once the consumer has acquired title to the handset, whether for the mandatory term of the service agreement having lapsed or having paid for it in full. For sure, as in many other instances, at the outset and notwithstanding there were hurdles to overcome in getting a device unlocked, such as alleged ignorance or misinformation at service centers.

Conversely, it wasn’t until after a long time of public comment and the EFF’s activism that this year President Obama signed into law the “Unlocking Consumer Choice and Wireless Competition Act“, which affords users the right to have their handsets unlocked to be further used on another carrier’s network.

Overall, at least in these three items Mexico moved way ahead of the United States.


applewatch - CopyTuesday September 9th was the day that follower of Apple’s hoopla looked forward to, as the company from Cupertino had, as customary, gotten folks the world over hooked on its ballyhoo (performance and release of album by U2 included) over the iPhone 6 and its wearable device, which everybody expected would be named as “iWatch”, following the branding convention set since the iMac, the first iPhone, the iPod (which will now be laid to rest -apparently Apple finally conceded that its devices were overlapping-), the iPad, and the service platform attached to them, such as the desecrated (since the “#CelebGate”) iCloud and even the “iForgot” password retrieval feature.

However this wearable device, the thing of science fiction less than 30 years ago (when the Dick Tracy film was released), did not follow that branding convention. The New York Times ran a piece on it today, and so did I over a year ago. It essentially boils down to a matter of intellectual property, more specifically of trademark prosecution: the Times reports that since Apple was about to launch its TV product and Steve Jobs hinted it might be called “iTV”, the British broadcaster ITV PLC would oppose it. Apparently now Swatch followed suit and took preemptive measures with the trademark offices of the world to make it known that Apple’s attempts to brand this device as an “iWatch” could lead to confusion relative to their iSwatch product (registered with Mexico’s Trademark Office “IMPI” -you can look them up through their MARCANET service-) for products under NCL 14 (clocks and watches), 35 (advertising and retail sales thereof) as well as 37 (repair thereof),

In the case of Mexico, as noted in that post herein from July 4th, 2013 and reported by news journal Reforma, a third party filed to register iWatch in advance of Apple, and ultimately both ran into a prior registration granted in 2011 to an Italian company “I’m, SpA”, which began selling its I’m Watch in 2013. And that has not been the only case in which Apple found such obstacles to the pursuit of its naming convention; since last year the press in Mexico reported extensively on the case that mobile carriers here lost against a Mexican company that had secured the registration for “iFone” since 2002, under which resolution hefty fines were assessed against all three then-major carriers but not against Apple, as iFone, S.A. de C.V., had secured said registration for the head-class of Telecomm Services (NCL 38), but apparently not for equipment therefor (NCL 9).

In sum this case illustrates quite clearly how challenging it can be for a global company to follow and implement a branding convention the world over. For sure a company can file for “preemptive” or “defensive” registrations, but unlike domain names trade and service marks cannot be stockpiled indefinetly; both US and Mexican trademark law provide for a term of 3 years for a registered trade or service mark to be effectively used in commerce, or otherwise registrations thereof may be cancelled. It may be difficult for design and development departments to meet with that time window in getting products or services to the market.

Also it often happens that legal and marketing don’t see eye-to-eye, and that is generally a matter of mindsets. Whereas MKT would love for its brands to be the top of mind of consumers in their market niche, for legal that would mean risking the loss of registrations thereof on account of such marks becoming generic, and that would result in loss of valuable intangible assets. This day in age its essential for MKT to regard legal as an allied and an enabler, and for legal to guide MKT through the intricacies and nuances of intellectual property law in a way that affords the company’s intangible assets the best protection possible.

This video from “Magic Circle” London firm Freshfields, Bruckhaus, Deringer illustrates how and why privacy compliance is much less costly than risking a cyber-attack, and some preemptive measures against such attacks.

Steps outlined to be taken are the following:

  1.  Assess your businesses’s relevant information, where it’s at and how it is protected;
  2. Be joined (by a cross-functional committee) in managing risk;
  3. Have contractual protections, allocating and excluding liability if and where applicable, including insurance if possible;
  4. Readiness: rehearse responses.

The dire consequences of cyber-attacks have been illustrated in current affairs media by Sony’s settlement of a class action suit for the breach of its PlayStation userbase, as well as by the attack against Target, which even lead to the ousting of Board members, and more recently Home Depot’s.

You try and do the math as to which is more costly between investing in privacy compliance and having your business take its chances in an equation where the variable for the cost (financial and reputational) of a breach cannot be determined ex ante, but the laws do provide for parameters to assess fines.


logoBanorte - CopyHace 9 meses escribí en este Blog sobre la multa de $1’246,000.00 que el IFAI impuso a la Administradora de Fondos para el Retiro de Grupo Financiero Banorte con motivo del traspaso ilegal de un derechohabiente del SAR hacia dicha AFORE, práctica que lamentablemente fue y sigue siendo muy común en el mercado de tales servicios. Por alguna razón el caso motiva gran interés, pues las estadísticas muestran que ha sido la entrada más consultada aquí, pues al día de hoy ha sido leída por 973. Tal vez también se deba a que Afore XXI Banorte encabeza la estadística de reclamaciones presentadas por usuarios de afores ante la CONDUSEF, según reporta en su Buró de Entidades Financieras.

El caso se repite, pues conforme al expediente PS.0018/13 en marzo de este año dicha autoridad de protección de datos impuso a esa AFORE 2 multas por una situación similar:

  • $1’558,250.00, por recabar datos personales patrimoniales y financieros sin el consentimiento requerido, y
  • $1’246,000.00 (nuevamente), por trangredir los artículos 6, 7 y 8 de la Ley, debido a la transgresión de los principios que informan la Ley.

De acuerdo con el expediente, el caso fue originado por la denunicia de un cuenthabiente de Afore Inbursa, quien manifestó haber dado seguimiento a la omisión en la entrega de sus estados de cuenta mediante SARTEL, con lo cual descubrió que había sido transferido, sin su consentimiento o conocimiento, a Afore XXI Banorte, de quien obtuvo un estado de cuenta con información que no cumplía con el principio de calidad que informa a la Ley, y cuyo Gerente alegó que los hechos serían imputables a un “JACKER” (sic).

La responsable respondió negando el tratamiento de los datos personales del titular denunciante, pues habría recibido su solicitud por Procesar, S.A. de C.V, empresa operadora de la base de datos nacional del SAR, para el traspaso de su cuenta, lo cual conlleva la transferencia de dichos datos, habiendo sido dicha transferencia consecuencia del cumplimiento de una obligación derivada de la LFPDPPP, por lo que devendrían aplicables las excepciones al principio del consentimiento previstas en las fracciones I, IV y VII de la referida Ley. El IFAI le negó la razón al respecto exponiendo un criterio que resulta relevante en la práctica para estimar la eficacia y alcance de dichas normas:

…del (sic) articulado de la LFPDPPP y su Reglamento, en ninguna parte prevé que dicha excepción sea aplicable per se a la información transferida, es decir, que no exceptúa a la Afore receptora (Afore XXI Banorte…) de obtener el consentimiento expreso para el tratamiento de datos personales patrimoniales y financieros. Si bien es cierto que la Afore receptora… no puede negarse a tratar la información… dicho hecho no lo (sic) excluye de cumplir también con la LFPDPPP, por lo cual también tiene que observar su deber de obtener el consentimiento expreso para el tratamiento de datos personales patrimoniales y financieros… es necesario resaltar el hecho que el Responsable qu transfiere los datos personales… trata los mismos… para realizar el traspaso de la cuenta individual, mientras que la Afore receptora… evidentemente los tratará para una finalidad distinta… administrar la cuenta individual… De tal forma, el cambio de finalidad refuerza el hecho de que la presunta infractora debió obtener el consentimiento expreso del Titular… no existe ningún impedimento legal para obtener el consentimiento expreso del titular para el tratamiento de sus datos personales… por el contrario, está obligada a obtener dicho consentimiento expreso previo a su tratamiento, para que éste sea lícito.

A dicho respecto debería ser obvio el incumplimiento de lo previsto por el párrafo segundo del artículo 14 y la fracción II del artículo 29 del Reglamento de la Ley, conforme a los cuales En los casos en que los datos personales se obtengan de manera indirecta del titular y tenga lugar un cambio de las finalidades que fueron consentidas en la transferencia, el responsable deberá poner a disposición del titular el aviso de privacidad previo al aprovechamiento de los datos personales.

Consecuentemente el IFAI encontró que Afore XXI Banorte no había observado los principios de consentimiento y licitud previstos por la Ley y su Reglamento, conducta sancionable conforme al artículo 63, fracción IV, de la propia Ley.

Conviene notar que ante el alegato de dicha Afore en el sentido que el titular habría otorgado su consentimiento a través de la solicitud de traspaso en el sistema METI operado por PROCESAR, el IFAI estimó que ello no constituía una manifestación de consentimiento libre, específica e informada ni inequívoca de parte de aquél, sino “…un mero elemento de soporte y trámite para la solicitud de traspaso…”, y que “…las medidas impelmentadas en el sistema METI no pueden ser equiparadas al consentimiento…toda vez que la normativa que rige ese sistema y sus operaciones, así como la que regula la protección de datos personales… son diversas”, lo cual remite a los comentarios anteriormente hechos por el suscrito tanto en el proceso de comentarios públicos al proyecto de Regalmento como sobre aspectos de la prestación de servicios e investigación en materia de salud, respecto de la concurrencia de diversos ordenamientos en materia del consentimiento necesario para el tratamiento de sus datos personales en distintas materias, y hace necesario enfatizar que el principio de información no admite excepciones; es indispensable poner un aviso de privacidad a disposicion del titular aun a pesar de que dicho tratamiento de datos sea realizad con motivo del cumplimiento de una obligación establecida en un ordenamiento que rija a otra materia.

Precisamente por ello el IFAI destaca que “…En ningún momento ninguna de las dos personas morales mencionadas (PROCESAR y Afore XXI Banorte) manifestó que a través de dicho sistema (el Sistema METI) se comunicaba el aviso de privacidad en el cual se indicaran las finalidades del tratamiento de los datos personales, por lo cual es evidente que el consentimiento otorgado a través del sistema referido, no es un consentimiento para el tratamiento de datos personales, sino únicamente para el traspaso de la cuenta individual”. Con relación a ello no debe dejar de tomarse en cuenta que conforme los artículos 20 y 31 del Reglamento, la carga de la prueba para demostrar tanto la obtención del consentimiento como la puesta a disposición del aviso de privacidad recae, en todos los casos, en el responsable.

Analizando, para efectos de determinar la sanción, la intencionalidad de la acción u omisión constitutiva de la infracción, el IFAI encontró que Afore XXI Banorte se ubicó en las hipótesis de las fracciones IV y XIII, por transgredir los artículos indicados en la segunda viñeta de esta entrada, pues a pesar de conocer sus obligaciones en la materia transgredió esas normas.

Algo más que vale la pena destacar es que al igual que muchos otros responsables sujetos a verificación por el IFAI, Afore XXI Banorte omitió exhibir ante dicho Instituto documentación que acreditara su situación financiera actual… como si ello impidiera a dicha autoridad allegarse de elementos para determinarla, más aun en el caso de responsables cuyas actividades se enmarcan en sectores regulados y/o que cotizan en mercados bursátiles.

Igualmente destacable es la labor de la Dirección General de Sustanciación y Sanción, que recurre a todos los medios posibles para obtener la información requerida a pesar de tales omisiones, y que en este caso nuevamente (vid. caso de Telcel) accedió a la misma a través de la página Web de la responsable a ser sancionada, a través de la cual obtuvo los estados financieros de dicha Afore al 30 de septiembre de 2013, que procesalmente son documentos provenientes de dicha parte y, por lo tanto, cuyo contenido se tiene por confesado por ella y le perjudica, en donde consta un capital contable de $23,835’254,225.00 M.N.

Adicionalmente el IFAI consideró a Afore XXI Banorte como reincidente, en virtud de las resoluciones dictadas en su contra en el expdiente citado en el primer párrafo de la presente entrada, sin poder tomarlo en cuenta en el caso que se refiere en virtud de la defensa del caso que esa institución financiera lleva a cabo. Sin embargo, si consideró la infracción cometida por esa responsable como de gravedad alta, por la afectación que causó al titular al tratar sus datos personales financieros y patrimoniales sin su consentimiento, y a la omisión en observar los principios de licitud y consentimiento como de gravedad media.

Algo del caso que llama poderosamente la atención es la referencia en la denuncia del titular afectado en el sentido que, a decir del personal de Afore Inbursa, “…el personal de correos tiene vínculos con personal de otras afores y estos les están entregando los estados de cuenta para jalar a las personas que les conviene monetariamente hablando.” Al respecto es relevante considerar que el Capítulo II del Título Primero de la Ley del Servicio Postal Mexicano, relativo a la Inviolabilidad y Sigilo, prevé que la correspondencia estará libre de todo registro y no deberá ser violada, prihibiendo a quienes intervengan en la prestación del servicio de correos y de los servicios diversos, proporcionar informes acerca de las personas que los utilizan, salvo por aquellos casos en que se acaten órdenes judiciales o del Ministerio Público, al rendir datos estadísticos requeridos por las leyes o en otros casos previstos legislativamente.

Además, el Título Quinto, Capítulo II, del Código Penal Federal prevé como pena jornadas en favor de la comunidad para quien(es) abran indebidamente una comunicación escrita que no esté dirigida a ellos y a quien(es) indebidamente intercepten una comunicación escrita que no esté dirigida a ellos, aunque la conserven cerrada y no se impongan de su contenido. Y también debe atenderse al hecho que conforme a la antedicha Ley del Servicio Postal Mexicano, la recepción, transportación y entrega de la correspondencia, está a cargo del Gobierno Federal, de manera que los empleados de su organismo descentralizado denominado Servicio Postal Mexicano son servidores públicos, de acuerdo con el Título Cuarto de la Constitución, la Ley Orgánica de la Administración Pública Federal y la Ley Federal de Entidades Paraestatales, de tal forma que aquellos que hubieran incurrido en las conductas descritas en la narración contenida en la relatoría contenida en la denuncia que motivó el expediente analizado no sólo podrían haber incurrido en violación de correspondencia, sino en alguno de los tipos previstos en el Título Décimo del Código Penal Federal, además de la responsabilidad administrativa prevista en la Ley de la materia.

Sin embargo, y a pesar de la atención mediática que atrae la actividad del IFAI tanto en materia de transparencia y acceso a la información pública como de protección de datos, no parece que las demás autoridades estén al pendiente ni le den seguimiento a ésta última, no obstante que más de una de las denuncias presentadas ante dicho organismo autónomo refirieran hechos que pudieran haber sido materia del ejercicio de facultades por parte de la CONDUSEF, la CNBV o, como en este caso, el Ministerio Público de la Federación, ocupado como está.


Compliance Report

Compliance and Ethics Powered by Advanced Compliance Solutions


Startup and Technology News

Xavier Ribas

Derecho de las TIC y Compliance

Marcus Kazmierczak

Take To Task

Analyzing the Nonsense

Business & Money

The latest news and commentary on the economy, the markets, and business


Canal de difusión con los medios.

Martha Salamanca Docente

Blog de TICs, Redes Sociales y Multimedia Educativo

Devil's Advocate Crib

Just another site

Investigating Internet Crimes

An Introduction to Solving Crimes in Cyberspace