Case Summary and Outcome

The Mexican National Supreme Court of Justice ruled that the amendment to the Federal Telecommunications and Broadcasting Law, which created a National Registry of Mobile Telephone Users (PANAUT), was unconstitutional because it violated the rights to privacy, intimacy, and the protection of personal data. The amendment conditioned access to a cell phone line to the delivery of sensitive data, such as biometrical information, to assist with the investigation and prosecution of crimes. The National Institute for Transparency, Access to Information and Personal Data Protection of Mexico (INAI), and a group of 48 Senators of the Mexican National Congress, both filed unconstitutionality actions. They argued that the proposed Registry entailed a compulsory and indiscriminate collection of personal information without a proper justification. They also claimed that the amendment violated the right to access information and communications technologies (ITC) and to freedom of expression because a large part of the population has access to the internet only through their mobile devices. Moreover, they affirmed that the Registry would create a system of permanent surveillance over society, which could have a chilling effect on the exercise of criticism and social protests. The Court held that the Registry, indeed, interfered with the rights to privacy, intimacy, and the protection of personal data, and after conducting a proportionality test, it concluded that the restriction of these human rights was unconstitutional because other less restrictive measures were equally suitable for strengthening public security. Additionally, the Tribunal acknowledged that mass surveillance, and possible interferences to private life, may have a negative effect on the right to freedom of expression.

---

Facts

On 16 April 2021, a legislative decree amended the Federal Telecommunications and Broadcasting Law. It created a National Registry of Mobile Telephony Users (Padrón Nacional de Usuarios de Telefonía Móvil or PANAUT) and established the obligation for telecommunications companies to collect personal data from users, such as mobile telephone number, name, nationality, official ID, and biometrical data. If a person denied the requested information, they would not be able to access the service. The purpose of the decree, according to the government, was to contribute to the national security and the prevention of crimes.

On May 13, 2021, the National Institute for Transparency, Access to Information and Personal Data Protection of Mexico (INAI) filed an unconstitutionality action before the National Supreme Court of Justice against the Decree because it considered that the amendment violated the rights to privacy, access to information and freedom of expression, among others.

On May 14, 2021, 48 Senators of the Mexican National Congress (a 37.5% of the Chamber) also filed an unconstitutionality action against the same Decree before the same tribunal, on similar grounds.

On February 3, 2022, an amicus curiae was presented by the following civil society organizations: Red en Defensa de los Derechos Digitales (R3D), Article 19, Observatel A.C., Asociación TEDIC, Derechos Digitales, Asociación por los Derechos Civiles (ADC), Instituto Brasileiro De Defesa Do Consumidor, Access Now, Hiperderecho, Fundación Karisma, Fundación Internetbolivia.org, Redes por la Diversidad, Equidad y Sustentabilidad A.C. (REDES AC), and Privacy International. They argued that the Decree violated the rights to privacy, the protection of personal data, and the right to access information, among others.

---

Decision Overview

Judge Norma Lucía Piña Hernández delivered the opinion for the National Supreme Court of Justice. The main issue before the Tribunal was whether the creation of the National Registry of Mobile Telephone Users (PANAUT) violated the human rights to privacy and freedom of expression, by collecting personal data as a condition to access a cell phone line.

Petitioners alleged that the Legislative Decree violated the National Constitution and international treaties such as the American Convention on Human Rights and the International Covenant on Civil and Political Rights. For them, the amendment jeopardized the rights to privacy and the protection of personal data because it ordered the compulsory and indiscriminate collection of personal information without a proper justification. In this sense, they considered that there was no evidence that having a database with the personal information of mobile telephone users was a useful tool to fight crime. Moreover, they emphasized that there were already other measures for such purposes that were less restrictive to the rights in question.

The INAI also claimed that requiring users to register in the PANAUT, and threatening to cancel their service if they didn’t, violated the right to access information and communications technologies (ITC) and freedom of expression. It argued that ITCs play a crucial role in the exercise of various human rights, especially considering that a large part of the population has access to the internet only through their mobile devices. In its opinion, the contested decree imposed illegitimate barriers to access these services.

The group of senators, for its part, similarly alleged that the indiscriminate storage of data (especially biometrical data) violated the rights to freedom of expression, the protection of personal data, and the secrecy of personal communications. In their opinion, the PANAUT was a system of permanent surveillance of citizens. Moreover, they argued that the creation of a biometric database that could be used for the investigation of any crime would create a hostile environment for the exercise of criticism. In this sense, the PANAUT would have a chilling effect, particularly among journalists—which could even amount to a prior restraint—, and on social protests. The senators also held that by conditioning access to a cell phone line to the provision of personal data, the government would violate its duty to promote access to ITC, which must be freely accessible without arbitrary interferences.

An amicus curiae was presented by several civil society organizations: Red en Defensa de los Derechos Digitales (R3D), Article 19, Observatel A.C., Asociación TEDIC, Derechos Digitales, Asociación por los Derechos Civiles (ADC), Instituto Brasileiro De Defesa Do Consumidor, Access Now, Hiperderecho, Fundación Karisma, Fundación Internetbolivia.org, Redes por la Diversidad, Equidad y Sustentabilidad A.C. (REDES AC), and Privacy International. They argued that the Decree violated the rights to privacy, the protection of personal data, and the right to access information, among others.

Their main argument regarding the right to freedom of expression was that the amendment conditioned access to information and communications technologies (ITC) on the disclosure of personal data, including sensitive data. They claimed that the right to access to ITC is recognized in the Mexican National Constitution and other laws, in Article 19 of the International Covenant on Civil and Political Rights, and in Article 13 of the American Convention on Human Rights. In this sense, the organizations argued that internet access is a pre-requisite for the effective exercise of human rights such as the rights to freedom of expression and opinion. Hence, States must take actions to progressively promote universal access to the internet and to eliminate arbitrary barriers to access to infrastructure, technology, and online information. For them, the decree’s restriction was not necessary nor proportional. They also claimed that the contested decree would have a particularly discriminatory effect on historically disadvantaged population groups, such as indigenous people.

A second argument related to freedom of expression was that creating the PANAUT would produce a chilling effect that would affect this right because it could link cell phone lines to the person’s identity. Recalling reports and cases of the Inter-American Court of Human Rights, the Inter-American Commission on Human Rights, the UN Special Rapporteur on Freedom of Opinion and Expression, and the European Court of Human Rights, among others, they considered that there is a human right to anonymous freedom of expression and that the contested decree would jeopardize this right. The civil society organizations held that measures that have a generalized and indiscriminate effect of threatening anonymity are not compatible with the principle of proportionality, and that measures that seek to identify a person using ICT must be authorized by a judicial authority. They also quoted a UN Special Rapporteur’s report where it was recommended that States should refrain from making user identification a condition for access to digital communications and online services. They highlighted that the PANAUT would be a specific risk for journalists, whistleblowers who report on corruption and human rights violations, and human rights defenders.

The Mexican National Supreme Court of Justice considered that at the core of both unconstitutionality claims was the notion that the restrictions of the PANAUT could harm the rights to privacy, intimacy, and the protection of personal data. The judges explained that, in general, a proportionality test is needed to determine whether limitations to human rights are valid. In an ordinary test, firstly, the Court should analyze whether the restriction has a negative impact on the scope or content of the human right at stake; if that is the case, secondly, the judges should examine whether there is a legitimate aim, and whether the measure is suitable, necessary, and proportionate. Nevertheless, the Court also recalled the existence of a strict proportionality test, for those cases that involve “suspicious categories” or particularly sensitive fundamental rights that benefit from enhanced protection. In these cases, the restriction should have an imperative purpose and not just a legitimate aim; the measure should be closely linked with its purpose—instead of being only suitable; and it must be the least restrictive alternative—not merely proportional.

Here, the Supreme Court made a distinction between the different human rights and concluded that it should conduct both tests: first, an ordinary proportionality test for the right to privacy and the protection of personal data; then, a strict proportionality test for the right to intimacy and the protection of sensitive data. A strict proportionality test was required for the second group of rights because, in the case of sensitive data, the restriction affected the most personal and intimate aspects of people, which could result in serious intrusions to their private lives, or even entail a serious risk to persons. The judges held that “potential violations to the right to privacy have been recognized as of enormous relevance not only from an individual point of view, but also from a collective one, since this sphere provides the adequate conditions for people to adequately develop their individuality, autonomy, and freedom; hence, its protection has an important role for the development of democratic societies, since it is an indispensable prerequisite for the exercise of the rest of human rights.” [para. 218]

Regarding the ordinary proportionality test, the Court concluded that the decree had, indeed, an intense impact on the rights to privacy and the protection of personal data because it imposed on cell phone users the obligation to deliver their personal information. This was established in the Decree as a mandatory condition to be able to acquire or maintain a mobile telephone service. In the judges’ opinion, the amendment had a legitimate aim because the PANAUT was created as a tool that would help investigate and prosecute crimes, which contributes to public order and national security. For the Court, the measure was also suitable because there was a means-end relationship between the creation of the PANAUT and the fight against crimes committed using mobile devices: the Registry could facilitate the identification of line holders. However, the Supreme Court found that the amendment was not necessary because there were other measures equally suitable for strengthening public security that were less restrictive to the rights to privacy and protection of personal data (for example, targeted interception of private communications, and the delivery of geolocation and other data from ICT providers). Hence, it ruled that the creation of the PANAUT was unconstitutional and explained that it was not necessary to conduct the strict proportionality test since the result would obviously be the same.

Regarding freedom of expression, even if the Court did not make an exclusive analysis of the violation of this right, it acknowledged that, nowadays, ICTs pose serious and growing challenges to privacy, data protection, and reputation, as well as to the crucial need to protect and promote freedom of expression and the free flow of information. Following the report of the United Nations High Commissioner for Human Rights—titled “The right to privacy in the digital age”—, the judges argued that surveillance and possible interferences with an individual’s private life “may have a negative effect on rights such as the right to freedom of expression and association.” [para. 198] Furthermore, the Tribunal said that “mass surveillance, the interception of digital communications and the collection of personal data are likely to affect not only the right to privacy of individuals, but also other rights such as, for example, the right to freedom of opinion and expression, and to seek, receive and impart information (…) These rights are closely related to the right to privacy, and are increasingly being exercised through digital media.” [para. 199]

The Court also recalled a report from the UN Special Rapporteur on Freedom of Opinion and Expression, who said that since the rights to privacy and freedom of expression are so fundamental to human dignity and democratic governance, restrictions must be closely examined, and they should be provided by law and applied strictly and only in exceptional circumstances. Additionally, the Court noted that the UN Special Rapporteur had explicitly mentioned that “States should refrain from establishing user identification as a condition for accessing digital communications and online services, and from requiring cell phone users to register their SIM card.” [para. 207] In this case, the Tribunal reported that, in Mexico, there were “98 cell phone lines for every 100 persons,” [para. 188] so the creation of the PANAUT, which would collect data indiscriminately, would entail collecting sensitive information of nearly the whole population, thus creating a real risk of permanent and generalized surveillance.

Concurring Opinions

7 of the 11 judges of the Supreme Court presented concurring opinions.

Judge Aguilar Morales insisted that requiring the disclosure of personal and sensitive data as a condition to access a cell phone line would intensively affect the rights to freedom of expression and access to information. He recalled the Inter-American Commission on Human Rights’ report titled “Standards for a Free, Open and Inclusive Internet”, where it was stated that access to the internet is a condition sine qua non for the effective exercise of human rights, such as the rights to freedom of expression and opinion, association and assembly, and that the lack of Internet access increases vulnerability and exacerbates inequality, perpetuating exclusion. Judge Aguilar Morales also highlighted that, according to the UN Special Rapporteur on Freedom of Opinion and Expression, the mandatory registration of SIM cards provided governments with the ability to surveil individuals and journalists beyond any legitimate interest, and undermined anonymity. In this sense, he argued that anonymity provides individuals with a private zone to hold opinions and exercise their freedom of expression without interference and arbitrary or unlawful attacks.

Judge Zaldívar agreed with the fact that collecting biometrical data affects not only the rights to privacy and the protection of personal data but also the rights to freedom of expression and access to information. He emphasized that privacy is necessary for the communication of ideas and that anonymity plays an important role in freedom of expression, especially in the case of social networks.

Judge Gutiérrez Ortiz referred to the decree’s legislative process and the proportionality test and also noted that the PANAUT would go against the government’s duty to guarantee access to telecommunication services.

Judge Ortiz Ahlf made considerations about the rights to privacy, intimacy, and the protection of personal data, and about the proportionality tests used; however, she made no references to the right to freedom of expression.

Judge González Alcántara questioned the efficacy of this kind of registry to combat organized crime and focused on procedural and methodological issues of the judgment. He did not expand on the right to freedom of expression.

Judge Pardo Rebolledo explained the necessity of establishing judicial oversight over this kind of registry but did not elaborate on the right to freedom of expression.

Judge Ríos Farjat criticized the methodology used by the Court in its judgment and did not refer to freedom of expression either.

---