Will Mexico's new biometric ID card harm digital privacy?

MEXICO CITY - Mexico last month approved changes to existing laws that pave the way for a mandatory biometric ID card for citizens, raising concerns among digital rights activists about the collection, use, sharing and storage of personal data.

The law allows the government to collect biometric data, such as fingerprint and iris scans, and gives law enforcement agencies access to databases containing sensitive personal information.

The government has said these reforms were introduced to help fight organised crime and drug trafficking and to search for missing people.

But rights groups worry the changes will enable a mass surveillance system with little accountability.

President Claudia Sheinbaum has said the biometric data will not be used for surveillance under the law, which opposition lawmakers have dubbed the Spy Bill.

"The government will not spy on anyone," said Sheinbaum at a July press conference.

What do the laws allow?

Every Mexican will have to provide their biometrics for a new official identify document, which determines their access to public and private services, such as health and aid programmes.

The data will be stored in a "Unique Identity Platform" and connect to other government databases that contain information ranging from tax contributions to missing persons data.

Authorities such as the National Intelligence Centre, the government agency that investigates national security risks, and the National Guard, a branch of the military, will have access to the biometric data.

Existing data-privacy laws, which ban the misuse of sensitive data including biometrics, will regulate the information.

The new ID card has been rolled out in a few municipalities and will be gradually brought into use across Mexico. 

Why are activists worried?

The biometric ID card will grant authorities access to a detailed footprint of a citizen's activities, without requiring a court order, according to José Flores, director of local digital rights group R3D.

These activities include visiting a public health clinic and opening a bank account.

"This puts us in a massive surveillance ecosystem with no provisions to identify wrong use of data, data breaches, identity theft or acts of corruption," said Flores.

The new laws do not outline how citizens can be notified when their data is viewed by authorities, according to rights campaigners.

This means card holders do not know who is accessing their personal data or how it is being used.

Digital rights group Article 19 said Mexico's new laws give intelligence institutions in Mexico access to data "without restrictions, transparency and the possibility of accountability."

Sheinbaum has said private communications are protected by Mexico's constitution and violations of citizen privacy will be prosecuted.

Flores also said the laws would allow the Mexican Security Minister to establish agreements on data sharing with other countries.

This could include a deal with U.S. law enforcement agencies as President Donald Trump ramps up mass deportation.

In a March interview with Fox News, U.S. Secretary of Homeland Security Kristi Noem said she requested that Sheinbaum share biometric information of migrants as part of an agreement to stop the imposition of trade tariffs.

At the time, Sheinbaum said she did not sign the agreement because "Mexico does not have a biometric data ID system."

The United States wants countries in Latin America to share data to facilitate repatriations of migrants. Several of the countries have introduced biometric ID cards used by citizens to travel, vote and register for government assistance.

In March, the United States announced it had signed "a statement of intent for biometric cooperation" with Colombia.

What is Mexico's record on surveillance?

Since 2017, digital rights groups like R3D and the Citizen Lab have documented Mexico's use of spyware against journalists, human rights defenders and even a high-ranking Mexican official.

Documents from social media company Meta's U.S. lawsuit against NSO Group, an Israeli cyberintelligence firm that makes the Pegasus spyware, showed that 456 people in Mexico were spied on between April and May 2019, during former President Andrés Manuel López Obrador's administration, whose party remains in power.

State-owned surveillance technology has also been used by criminal organisations in Mexico.

In a June report, the U.S. Justice Department said a hacker working for the Sinaloa drug cartel obtained an FBI official's phone data and used Mexico City's surveillance cameras to track and kill the agency's informants in 2018.

(Reporting by Diana Baptista; Editing by Anastasia Moloney and Ayla Jean Yackley.)