Mexico’s Federal Institute for Access to Information and Data Protection (IFAI) published the new Federal Law on Protection of Personal Data held by Private Parties, making it effective July 6th, 2010.

The landmark legislation provides for penalties up to $1.5 million for violations under the law. The new Federal Law for the Protection of Personal Data, la Ley Federal de Protección de Datos Personales en posesión de los particulares), prescribes, among other things, the manner with which both private and public entities must treat the collection, use, and disclosure of personal data relating to Mexican citizens.

Companies must essentially have permission from Mexican citizens whose information they’re processing and inform them of the reason for their access. People have the right to access their data, have any inaccuracies corrected, deny transfers of their data and have their data be deleted from a system for “legitimate reasons.” A lack of response to any notice is considered to be tacit consent.

While the law does not prescribe how to protect data, it does require that companies use security measures to protect the data that is not “inferior to those they keep to manage their own information.” Companies are obligated to “immediately” notify a citizen “significantly” affected by a data breach.

While the law envisions IFAI taking a leading role in conducting inspections to ensure compliance under the law and issuing monetary penalties when it concludes that an entity has failed to comply with the law, the Institute noted in a press releae that it does not bear the sole responsibility to do so. Rather, various other Mexican agencies (such as those in charge of the economy, health, and telecoms) will work in tandem with the Institute in order to resolve complaints and discipline for violations under the new law.