W7y8w3

process is mentioned in the constitution under asection entitled “Laws or acts issued by the authority,or omissions committed by the authority, whichinfringe the fundamental rights recognised and protectedby this Constitution”. 22 As the constitutionprotects the right to privacy, the legal basis uponwhich to file a constitutional adjudication wouldprecisely be the violation of this human right andthe absence of due process of law: the lack of awarrant by a judge authorising the interception ofcommunications. A constitutional adjudication canalso be founded on the rights protected under theinternational human rights treaties that Mexico hasratified. The jurisdiction that issues the decision ofthe constitutional adjudication is a federal court.Appeal of the ruling (recurso de revisión) is possiblebefore an appeals court. As a last resort, it isthe Supreme Court of Justice of the Nation (SCJN),Mexico’s highest federal court, that is competent tohear the case, but only on a discretionary basis andif the matter is significant (“asunto de importanciay transcendencia”). In case the complaint is granted,whether at a federal court or before the SCJN,the court would restore the right claimed by theplaintiff, but not issue any sanction to the agencyresponsible for violating the right.Another, completely different recourse wouldbe to reclaim the patrimonial accountability (responsabilidadpatrimonial) of the state. This is anadministrative procedure, not a judicial one, whichis designed for those individuals whose rightsand property have been infringed on as a resultof illegal or unconstitutional state administrativeactivity. 23 The judicial, legislative and executivebranches of the federation, constitutional autonomousagencies, units, entities of the Federal PublicAdministration, the Office of the Mexican AttorneyGeneral, federal courts, administrative and anyother public federal entity, are subject to this administrativeprocedure. A lawsuit of patrimonialaccountability is presented before the offendingagency and is aimed at determining if there was afault – in this case, the violation of a human right.It is possible to appeal the agency’s decision beforethe Federal Tax and Administrative Court. If the faultcan be demonstrated and expressed in monetaryterms, the plaintiff obtains relief through financialcompensation.22 Trife. (2013). Mexican Constitution. www.trife.gob.mx/sites/default/files/consultas/2012/04/cpeum_ingles_act_08_octubre_2013_pdf_19955.pdf23 Cámara de Diputados. (2014). Ley Federal de ResponsabilidadPatrimonial del Estado. www.diputados.gob.mx/LeyesBiblio/pdf/LFRPE.pdfThe IFAI is responsible for guaranteeing the dataowner’s right to the protection of his or her personaldata. In this case, however, its role is unclear. It caninvestigate, as it has already done, and issue fines.But there is no established procedure for a caseof government surveillance. Also, as the matter atstake is a violation of human rights, another institutioncould play a role: the National Human RightsCommission (CNDH). Nevertheless, that institutionmay only make recommendations that are not binding:it can determine whether there was a violationof human rights and who was responsible, but canonly issue recommendations to prevent it from happeningagain.ConclusionsMexico is facing a situation that is testing the strengthof its legal framework and the effectiveness of its administrativeand judicial institutions. The petition byContigenteMX, Propuesta Cívica and Al Consumidorcould prove to be a factor that triggers more complaintsaimed at ensuring transparency and respectof human rights by the Mexican government – in particularwith respect to the right to privacy.No matter whether, one day or another, someonewill demonstrate that the government used FinFisherand did it illegally, Mexico does have a legal frameworkin place that enables it to address the FinFishercase as a privacy violation and a breach of humanrights. However, the country does not have the legaland institutional framework that enables it to tacklegovernment surveillance cases effectively. Governmentespionage is a delicate issue because it is notalways clear whether government authorities are actingto protect national security interests and whetherthey are going beyond their obligations and startinfringing on citizens’ human rights. It is preciselybecause limits are not always clear and institutionsare fallible that there should be specific rules andprocedures to safeguard individual human rights, aswell as accountability and oversight rules that thegovernment must comply with.Action stepsThere should be a minimum number of principles,the goal of which should be to protect the right toprivacy and data protection, and to address governmentsurveillance. Analysing the FinFisher case inlight of existing legislation shows that the governmentis violating human rights, but is not revealingthat it is spying on individuals, nor its seriousness.The International Principles on the Application ofHuman Rights to Communications Surveillance(“the Principles”) are a good starting point toanalyse other aspects of similar cases. These principlesare the outcome of a global consultation withcivil society groups, industry and international expertsin communications surveillance law, policyand technology, and apply to surveillance conductedwithin a state or extraterritorially, regardless ofthe purpose of the surveillance. 24In order to guarantee privacy and data protection,ContingenteMX, Propuesta Cívica and Al Consumidorhave also proposed that competent authoritiesreconcile their legal framework with the Principles. 25However, the first seven of the 13 principles (legality,legitimate aim, necessity, adequacy, proportionality,competent judicial authority and due process) arein fact safeguards that can be found in the MexicanConstitution, which deals with human rights and thecases and circumstances in which the state is able tointerfere with them. Then, it would be more importantthat the government commit to comply with theother six principles (user notification, transparency,public oversight, integrity of communications andsystems, safeguards for international cooperation,safeguards against illegitimate access and right toeffective remedy) because they provide propositionsspecifically focused on wiretapping communicationsin the surveillance ambit.Aside from covering the legal aspect, it is alsonecessary to foresee the operative needs that thelaw requires to be enforced: there should be operativerules and procedures derived from the Principlesthat let the same principles work in practice. Then,once the government’s commitment is verified, thestate should determine the institutions and federalagencies that have to abide by those operativerules and procedures in order to protect individualsagainst surveillance. The compliance by the FederalInstitute of Telecommunications (Instituto Federalde Telecomunicaciones) with the above-mentionedoperative norms and procedures would, for instance,be necessary to guarantee the principles ofuser notification, but also the integrity of communicationsand systems. The Attorney General’s Office(Procuraduría General de la República), on theother hand, would help implement the principlesof legality, legitimate aim, necessity, adequacy, proportionality,competent judicial authority and dueprocess. In fact, since all the principles are relatedto each other, every institution and federal agencythat would commit to the objective of protecting24 https://en.necessaryandproportionate.org/text25 Robles, J. (2013, October 7). Comunicado de prensa sobre losavances en las investigaciones sobre #Finfisher en Mexico.ContingenteMX. contingentemx.net/2013/10/07/comunicado-deprensa-sobre-los-avances-en-las-investigaciones-sobre-finfisheren-mexicoindividuals against surveillance would contribute tocompliance with each of the 13 principles to variousdegrees. The state should also decide which specialisedinstitution could guarantee the compliancewith the applicable operative rules and procedures.In this sense, the IFAI is a good starting point becauseit is an autonomous institution that has ahigh level of public confidence. In this way, the principlesof transparency and public oversight wouldbe reinforced at the same time.It is important to underline that the Principleswould be worthless without an engaged societythat demands respect of its rights. We recommendthat from the Principles, we use the ones that canbe promoted and exercised by Mexican civil societyand non-profit organisations. As an example, theprinciple of legality suggests that, due to the rateof technological changes, limits to the right to privacyshould be subject to periodic review by meansof a participatory legislative or regulatory process.We recommend giving a role to civil society in thesereviews. Regarding the principle of user notification,which establishes that individuals should benotified of communications surveillance, and theprinciple of transparency, which establishes thatstates should be transparent about communicationssurveillance, both of them can be achieved ifcivil society is vigilant and continuously informedabout what the government is doing.As a result, the action steps we recommend arethe following:• Establish a clear legal framework for using espionagesoftware and other similar tools. Thereshould be specific rules for when the governmentwishes to use software like FinFisher. Therules would indicate the cases in which it is allowedand how the privacy of all the individualswho are not being investigated is safeguarded.• Ratify the United Nations Guidelines for the Regulationof Computerized Personal Data because,by doing so, individuals would be assured of obtaininga basic threshold of protection for theirprivacy and personal data. Mexico would alsoshow its commitment towards better protectingindividuals’ communications and internetprivacy.• Encourage Congress to discuss the topic ofgovernment surveillance, as well as protect theprivacy of communications.• Organise campaigns to make civil societyaware of the importance of privacy and howsurveillance puts freedom of expression and associationat risk.172 / Global Information Society Watchmexico / 173