Mexico's biometric CURP has been established as the official personal biometric identification in the country, although concerns regarding data privacy and security persist among rights advocates.
The national ID was officially implemented on October 16, and both public and private sector institutions are required to recognize it as the official form of identification for accessing services. Individuals in Mexico who took part in a pilot programme have begun receiving their IDs, [1] according to The Yucatan Times. The report cites Arturo Arce Vargas, head of the National Population Registry, stating that the biometric CURP will initially be optional.
The biometric CURP includes fingerprints and iris scans to function as a digital ID. The policy is currently required for various transactions, including access to medical services and patient records, the opening of bank accounts and loans, immigration and naturalization procedures, social protection programme, and school registration. However this has drawn criticism since its announcement by the government, some courts have [2] issued injunctions to suspend its issuance in certain regions, following petitions from concerned individuals.
The Mexican government argues that the system is essential for protecting personal identity and aiding in the search for missing persons, a significant issue in the country. In contrast, critics contend that, without adequate safeguards, the initiative could infringe upon human rights. A recent suspension has been issued by the Collegiate Tribunal for Criminal and Administrative Matters in Yucatán in response to a complaint filed by an individual. Similar suspensions regarding mandatory biometric collection have also been enacted by tribunals in Mexico City and Querétaro.
Digital rights organizations have expressed significant apprehensions regarding the surveillance potential associated with the centralization of biometric data for all Mexican citizens. José Flores, [3] the director of the local digital rights group R3D, stated, “This puts us in a massive surveillance ecosystem with no provisions to identify wrong use of data, data breaches, identity theft or acts of corruption.” Despite warnings from cybersecurity experts of centralizing sensitive biometric and biographic data the Mexican government [4] is proceeding with its plans to introduce the mandatory use of CURP as its national identification document, set to take effect in January 2026.
Mexico Business [5] reports that the country experienced 324 billion cyberattack attempts in 2024, with over 40 billion occurring in the first three months of this year alone. Experts indicate that these numbers highlight the necessity for strong cybersecurity measures to protect the new biometric identification system. The main issue is the state's capacity to safeguard a database of such size and significance. Ricardo Darling, Vice President of Cybersecurity at [6] C3ntro Telecom, said, “The government must implement security measures that enable data to be stored securely and reliably, while ensuring due confidentiality and integrity within the database.”