Personal Digital Sovereignty In Mexico And The Biometric CURP

When a company collects biometric data in Mexico, one important question that is often asked is how Mexico’s evolving privacy framework treats that information, and what obligations or risks come with it. The concern is well founded, because biometric data is one of the most sensitive categories of personal information, and Mexico’s recent changes to implement the biometric CURP to citizens have only increased discussion around the topic.

This particular decision has been heavily criticized, especially when considering the evolving AI space and the increasing risk of deepfakes and other concerns. Even if the reason to implement the biometric CURP is well founded (it was proposed to support in missing persons cases), the specific worry here is that state surveillance may only increase because of this decision, especially in connection to the new requirement to link your telephone number with your CURP.

On June 26, 2026, a federal collegiate court (the Twentieth Collegiate Court in Administrative Matters of the First Circuit) published new criteria stating that the constitutional right to privacy must be understood as a “personal digital sovereignty”. The criteria appeared in the Semanario Judicial de la Federación and, while they are not specifically binding, they offer an early signal of how Mexican courts may approach the handling of biometric data going forward.

The Case Behind the Decision

These criteria came from an amparo proceeding against Article 91 bis of the General Population Law (Ley General de Población), which was added by a decree published on July 16, 2025. This provision created the biometric CURP (Mexico’s Unique Population Registry Code), supported by biometric data as a mandatory national identity document, and contemplates a single identity platform where all the citizens’ biometric data would be consolidated.

It is worth noting that this court did not rule on whether the biometric CURP is constitutional, only on the suspension itself. The court did however use the term “personal digital sovereignty”, describing it as an emerging human right against biometric monitoring.

It is important to clarify a key point in order not to overstate the criteria of the court. This is an isolated thesis (tesis aislada), which consists of an interpretation that may be used to guide or help interpret certain decisions, but does not bind other courts, and is issued by a collegiate court rather than by the Supreme Court of Justice (SCJN). Even so, it carries a significant value. Regardless, it is an important sign that can help businesses understand how biometric data regulation may be enforced in the near future.

The court’s criteria is one that any company handling this information will recognize. Biometric identifiers have an increased risk of potential leaks and accidental exposures, because a face, a fingerprint or an iris is unique and permanent and cannot be changed. This means that, if these biometric identifiers are exposed or leaked, the harm cannot be undone. For that reason, the court concluded that conventional data protection tools fall short, and that individuals need effective control over their biological and behavioral identity across both physical and digital spaces.

The language of the thesis itself is also worth noting. The thesis speaks of a “surveillance capitalism”, of “biometric monitoring” and “personal digital sovereignty” framed as an emerging human right. The heading of the leading thesis, just like the related criteria published alongside it, reads less as a neutral description of a legal issue but rather as a statement that privacy must be reconceived.

For companies, this framing signals that courts are starting to see biometric collection not just as a routine data protection question, but as a matter of who ultimately controls a person’s identity in an age of increased monitoring and evolving technology.

What This Means for your Company

For businesses that collect or process biometric data in Mexico, whether it is from employees, visitors or customers, these criteria signal growing judicial skepticism toward large-scale biometric processing and a readiness to apply increased measures to protect sensitive personal information. Practical steps to consider at this early stage include the following:

• Mapping and documenting biometric data: identify what biometric information your company collects, for what purposes, and on what legal basis.
• Test necessity and proportionality: confirm that biometric collection is genuinely necessary and that no less intrusive alternative would achieve the same result.
• Strengthen security and retention controls: apply strict safeguards, clear retention limits, and a tested breach-response protocol to any biometric dataset.
• Review the current and evolving privacy measures: privacy is a constantly evolving landscape in Mexico’s legal framework, so understanding the current regulations is key to understanding the necessary changes your company must make.

Mexico’s legal framework for biometric data is still evolving, and this recent decision suggests that the courts are prepared to demand more from those who collect it. Companies that anticipate these expectations, rather than react to them, will be better positioned as the rules become clearer.

For now, businesses operating in Mexico should interpret these criteria as an early indicator of the direction where the courts may go in the near future, and to align their biometric data practices accordingly.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.