- with readers working within the Retail & Leisure industries
- within Intellectual Property, Government, Public Sector and Antitrust/Competition Law topic(s)
On July 12, 2026, the Secretariat of Anti-Corruption and Good Governance imposed a fine of 42.8 million pesos on the Mexican Football Federation (FMF) for various irregularities in the handling of personal data collected through the FAN ID system, the biometric identification mechanism created to control the entry of fans into stadiums.
Beyond the attention it draws for involving one of the country's most visible sports institutions, the case offers a relevant lesson for practically any company that processes personal data in Mexico. The penalty did not stem from a data breach or a cyberattack, but from something far more ordinary: the way in which individuals' consent was obtained.
Where Did the Problem Arise?
According to the resolution, the FMF, in its capacity as data controller, committed two infractions deemed serious.
The first was failing to properly inform fans that the photographs used to generate the FAN ID constituted sensitive personal data. The privacy notice did not explain to fans that biometric data would be collected, which prevented data subjects from understanding the true scope of the processing.
The second, and perhaps the most illustrative, was failing to obtain the express, written consent that the law requires for processing sensitive data. Added to this conduct was the breach of the principles of accountability and lawfulness, as the necessary measures were not adopted to align the processing with the applicable legal framework.
Why Biometric Data Demands a Higher Standard
Not all personal data is treated the same way. Mexican law distinguishes a special category —sensitive data— which comprises information that may reveal intimate aspects of a person or whose misuse carries a greater risk of discrimination. Biometric data, such as the facial features captured by the FAN ID, fall within this category.
To process sensitive data, tacit consent or a generic authorization is not enough. The law requires express, written consent, supported by mechanisms that unequivocally demonstrate the data subject's will.
The conduct flagged by the authority offers a fairly precise map of what is worth reviewing today, without waiting to become the subject of an audit.
Lessons for Any Company That Processes Data in Mexico
The first step is to identify whether the organization processes biometric or other sensitive data—sometimes without realizing it—through access controls, facial recognition, applications, or devices.
Second, the privacy notice must clearly describe what data is collected, its sensitive nature where applicable, and the purposes of the processing, and it must be made available from the first point of contact. A notice inherited from another jurisdiction and translated without adjustments rarely satisfies these requirements.
Finally, complying with the accountability principle means being able to demonstrate compliance, not merely assert it: internal policies, consent records, and security measures that can withstand review by the authority. The fine imposed on the FMF is not merely a sporting anecdote, but a reminder that personal data protection has ceased to be a mere formality and has become a real operational and financial risk when the right advice is not in place.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
