Accountability of CDDBMs in Mexico

• Pages: 132-156
• Author: Vivian Newman-Pont,Daniel Ospina-Celis,Juan Carlos Upegui

132 Data Feast: Enterprises and Personal Data in Latin America

ACCOUNTABILITY OF CDDBMs IN MEXICO

Milan Trnka Osorio

In this document, we review the privacy policies of four companies with

data-driven business models (CDDBM) operating in Mexico, following

the standards set in the report Accountability of Google and Other Businesses

in Colombia: Data Protection in the Digital Age (Newman and Ángel 2019).

1. Selection of CDDBMs

From the “large Internet companies” category, which groups the ve

companies commonly referred to with the acronym GAFAM (Google,

Amazon, Facebook, Apple, and Microso), we chose Amazon due to

its presence in the Mexican market. e arrival of Amazon’s services to

Mexico was announced in July 2015 through its website (www.amazon.

com.mx). It is considered the most ambitious launch of the company in

20 years (CNN Español2015). Amazon’s largest distribution centre for

Latin America is located in Mexico (Milenio2019).

As an intermediate company, we selected Snap Inc. and its product

Snapchat. is platform oers social media services growing in popularity

in Mexico, as shown by the ranking of the applications information and

market company App Annie as per the top downloaded applications from

Mexico’s App Store and Google Play.167

In the start-up category, that is, companies dened for their early

age, scalability, and exponential growth, we chose the company Payclip

S. deR . L. deC. V. and its product Clip, which provides the user with

the tools to make payments with their credit or debit cards from their

mobile phone or tablet. At the time, the launch of this application was a

167. See https://www.appannie.com/en

BACK TO TOC

133

Working Paper 10

signicant breakthrough. It is considered one of the most successful start-

ups in the country because of its practicality, ease of use, and because it

sparked investors’ interest, which led to a massive inux of capital from

Silicon Valley to Mexico (Küfner2018).

Finally, as an established company, we looked for the biggest compa-

ny in the telecommunications sector. In the case of Mexico, this company

is Radio Móvil Dipsa S.A. deC.V., the owner of the leading mobile carrier

of the country and its product, Telcel.

Just like in the Report, there will be four analysis categories for each

CDDBM to determine how they operate: 1) data sources, 2) processing,

3) purpose of data processing, and 4) relationship with GAFAM. en,

we will study how appropriate the Mexican legal regime is and evaluate

the authority responsible for data protection.

2. Characterization of the CDDBMs’ Operations

Based on a review of the privacy policies oered by the four companies in-

cluded in the sample, below we analyze their operations based on the fol-

lowing four analysis categories: 1) data sources, 2) processing, 3) purpose

of data processing, and 4) relationship with GAFAM. Annex1 contains

the systematization of this analysis.

2.1. Data Source

Both Amazon and Snapchat divide their data sources into three catego-

ries: 1) data provided by the user/customer, 2) information generated

automatically as a result of the provision of the service, and collected

through web tracking and crowdsourcing techniques, and 3) information

collected from third parties. However, while Snapchat includes dierent

sections related to its privacy policy, it is more understandable and more

comfortable to read (Our Privacy Principles; Your Privacy, Explained;

Privacy by Product; How We Use Your Information; and a Transparency

Report. Furthermore, it provides a link to contact the area in charge of

privacy and a dedicated cookies policy). For its part, Amazon only pres-

ents an example per type of information it collects from each source. Spe-

cically, the ve paragraphs explaining the information it collects use the

phrase “for example” or similar ve times (a clear breach of guideline22

for privacy notices).168

168. Guideline 22: “The privacy notice shall specify the personal data that the

controller will process to achieve the purposes for which data is obtained,

BACK TO TOC