Digital CURP and mobile registration: Are we being watched in Mexico?

The digitization of the CURP (National Registry of Civil Registry) and the creation of a mobile phone user registry in Mexico have raised alarm bells. Civil organizations like R3D warn of the risks of mass surveillance. We explain the facts.

In an effort to modernize public administration and strengthen citizen security, the Mexican government has promoted initiatives such as the digitalization of the Unique Population Registry Code (CURP) and the implementation of a National Registry of Mobile Telephone Users (PANAUT).

However, these measures have generated considerable controversy and concern among civil society organizations and digital rights experts, who warn of the potential risks of enabling mass surveillance mechanisms and violating citizens' privacy.

The digital CURP seeks to facilitate procedures and access to government services by providing an electronic version of the unique population identifier. The PANAUT (National Identity Document) was conceived with the primary objective of combating crimes such as extortion and kidnapping by requiring mobile phone users to register their lines with personal data, including, in its original design, biometric data.

Despite the stated objectives, organizations such as the Network in Defense of Digital Rights (R3D) have pointed out that the implementation of these tools, especially the PANAUT, could open the door to mass surveillance by the State, without adequate safeguards for the protection of personal data.

The controversy surrounding the digital CURP (National Identity Number) and the telephone registry in Mexico is a clear example of the global dilemma between state security and individual privacy, a conflict that has been exacerbated in the digital age.

The argument of "national security" or "fighting crime" is often used to justify the implementation of measures that could erode fundamental rights. The key is not to oppose technological modernization or efforts to combat crime per se, but to demand that these initiatives be designed and implemented with a "privacy by design and default" approach.

This requires the incorporation of robust safeguards, transparent and effective citizen oversight mechanisms, and a rigorous assessment of the actual impact of these measures on human rights before their implementation. Citizen mistrust, often justified by a history of opacity or abuse, can only be mitigated with transparency and accountability.

From the government's perspective, these initiatives are presented as necessary to:

• * Modernize administration: The digital CURP would streamline procedures and improve the efficiency of public services.
• * Combating crime: The PANAUT would allow authorities to track and identify criminals who use mobile phones to commit crimes, especially extortion and kidnapping.
• * Strengthening public safety: By having more complete and accessible databases, the response capacity of security forces is expected to improve.

Civil society organizations and privacy experts have raised serious objections, focusing on the following risks:

• * Mass and Indiscriminate Surveillance : The main concern is that these centralized databases allow the State to monitor the activities and communications of innocent citizens without a court order or reasonable suspicion, violating the right to privacy.
• * Excessive Collection of Sensitive Data: The PANAUT, in particular, contemplated the collection of biometric data (such as fingerprints or facial recognition). The concentration of this type of information, which is unique and irreplaceable, in a government database exponentially increases the risk in the event of leaks or abuse.
• * Lack of Legal Certainty and Insufficient Controls: The legislation accompanying these initiatives is often ambiguous regarding who will have access to the data, under what circumstances, and what oversight and accountability mechanisms will be in place to prevent abuse.
• * High Risk of Leaks and Misuse: Mexico, like many other countries, has a history of leaks of sensitive government databases. A database containing information on millions of phone users or CURP data linked to other records would be a very attractive target for malicious actors, both internal and external.
• * Questionable Effectiveness in Combating Crime: Many experts argue that telephone user registries are ineffective in combating organized crime, as criminals often use stolen, cloned, or registered SIM cards with false identities or from other countries. Therefore, these measures would end up primarily affecting compliant citizens without significantly hindering criminal activity.

"The creation of large centralized databases containing sensitive personal information, such as those proposed with the PANAUT and the extensive digitization of the CURP, always carries an inherent risk of abuse and surveillance, especially if not accompanied by robust democratic controls and effective independent oversight."

The implementation of digital identification systems and telephone registries is not unique to Mexico. Countries like India, with its Aadhaar system (which has also faced criticism for privacy and exclusion issues), have followed similar paths.

In Europe, there have been intense debates about telecommunications data retention and the limits of state surveillance. Lessons learned elsewhere often point to the importance of establishing very strict legal and technical safeguards to protect citizens' rights.

These initiatives must be analyzed in light of the Federal Law on the Protection of Personal Data Held by Private Parties and the General Law on the Protection of Personal Data Held by Obligated Subjects. These laws establish the principles and obligations for the processing of personal data, including consent, purpose, fairness, proportionality, and accountability.

The National Institute for Transparency, Access to Information, and Protection of Personal Data (INAI) plays a crucial role as the guarantor of these rights, and has in the past questioned the constitutionality of measures such as the PANAUT.

In this context, citizens have an active role to play:

• * Get informed: Understand these initiatives, their implications, and the rights you have regarding personal data protection.
• * Support Civil Society: Support the work of organizations like R3D and others that defend digital rights and privacy in Mexico.
• * Demand Transparency and Accountability : Demand that authorities ensure that any data collection system is implemented with complete transparency, with clear oversight mechanisms, and strict accountability for abuse or security breaches.
• * Adopt Digital Protection Measures : While they don't solve the systemic problem of state surveillance, tools like Virtual Private Networks (VPNs) and end-to-end encrypted messaging can offer an additional layer of protection for personal communications.

The debate over the digital CURP (National Population Registry) and the telephone registry reflects the fundamental tension between the pursuit of security and the preservation of individual freedoms in the 21st century. A democratic society must find a balance that does not sacrifice fundamental rights in the name of security, which could prove illusory if the measures are not effective and proportionate.