Mexico has officially implemented a digital identification system following the enactment of a law that transforms the previously optional biometric citizen code into a mandatory identification document for all residents.
In a significant legislative development, lawmakers greenlit changes to a law governing the 18-character personal identifier, known as [1] the Unique Population Registry Code or CURP. The amendments were officially enacted through a formal decree. The updated CURP [2] will now include essential personal and biometric information, featuring a photograph and a QR code that stores biometric fingerprint and iris data. The implementation of this mandatory identifier is set to roll out to all citizens of Mexico by February 2026.
The issue of biometric data security has emerged as a controversial topic within Mexican political discourse. In 2021, the Supreme Court [3] ruled that a national registry of mobile phone users relying on biometric data was unconstitutional. Media outlet Expansión has raised concerns that consolidating biometric information through the Unique Population Registry Code could create a vulnerable target for cyberattacks and facilitate widespread biometric surveillance.
Privacy advocates [4] have expressed skepticism regarding the implementation of the mandatory biometric ID, highlighting potential risks related to surveillance and data security associated with the CURP. Critics point out that the new legislation lacks provisions requiring authorities to notify citizens when their personal information is accessed or reviewed. José Flores, a director of [5] digital rights group R3D, “This puts us in a massive surveillance ecosystem with no provisions to identify wrong use of data, data breaches, identity theft or acts of corruption," said Flores.
Rights organization Article 19 have expressed concerns that the identification system will [6] enable intelligence agencies to access data without oversight or transparency. Mexican national security entities, including the National Intelligence Centre and the National Guard, are set to obtain permissions to access this biometric information. “Illegal and abusive surveillance by the armed forces is a repeated practice that we have strongly warned about and documented as revealed by the Spy Army investigation and that has been carried out selectively against journalists, human rights defenders, researchers and even public officials. In such cases, impunity is absolute,” said Article 19 ina statement.
Rand Hammoud [7] a surveillance campaigner at Access Now, has described surveillance technology as “weaponry” in [8] her column for Context. “Surveillance technology is weaponry it targets, tracks, invades, and decimates and its unbridled use is a far-reaching, destructive violation of human rights. It is an assault rifle in the sustained global offensive on civic space, and we need a global moratorium on its export, sale, transfer, servicing, and use,” said Hammoud, “Governments routinely use vague and ill-defined laws, especially in authoritarian regimes, as gateways to stifle activists and journalists. This technology infringes on our rights in a way that contravenes any alleged benefits. Through their aggressive, rampant use of spyware, governments are violating our fundamental rights to privacy, freedom of expression, assembly, and opinion, when they have the obligation to respect, protect, and fulfill them. The false narrative that we have to make a choice between privacy and security must be retired.
Political opposition members contend that consolidating biometric data via the CURP may lead to a vulnerable single point for cyberattacks and raise concerns about potential mass surveillance. In June the Senate's joint committees on Government and Legislative Studies approved amendments to the General Population Law and the General Law on Enforced Disappearances. These changes would enable the Mexican government to consolidate citizen identity codes into a unified identity platform within a timeframe of 90 days. This new platform will facilitate connections to multiple state databases and administrative records, including the National Registry of Missing and Unlocated Persons and the National Forensic Data Bank. According to El Financiero, [9] it will link to employer databases and social security registries, as well as various other registries tied to sectors such as finance, transportation, health services (both physical and mental), telecommunications, education, private assistance, and parcel and delivery services.