Yucatán Court Suspends Biometric CURP Over Private Data Concerns

Courts across Mexico are halting the government's ambitious biometric identification program as privacy advocates challenge the mandatory collection of fingerprints and iris scans

A federal tribunal in Yucatán has suspended the Mexican government’s requirement that citizens provide biometric data for the new Biometric CURP system. This move joins similar legal challenges mounting across the country as privacy advocates contest the mandatory collection of personal biological data.

The Collegiate Tribunal for Criminal and Administrative Matters in Yucatán granted a provisional suspension that prevents authorities from mandating biometric data for the Unique Population Registry Code (CURP). The decision came after a citizen filed a complaint following an initial denial by a federal judge.

The ruling targets reforms to Mexico’s General Population Law that were published July 16, 2025. These changes aim to strengthen databases used to locate missing persons by requiring all Mexicans to provide fingerprints, photographs, and iris scans for a new biometric version of their CURP.

Nationwide Legal Resistance

Yucatán’s suspension mirrors similar court decisions across Mexico. The First Collegiate Tribunal for Administrative and Civil Matters in Querétaro also granted provisional suspensions that prevent authorities from requiring biometric data—fingerprints, photographs, and even iris scans—for the procedure.

Federal Judge Oswaldo Rivera González in Mexico City has also issued suspensions in response to amparo suits filed by citizens Víctor Manuel Carrillo Solís and Alejandro García Lumbreras. The judge sustained that while delivering biometric data can be irreversible, the provisional suspension can be revoked if it is determined that the reform meets constitutional criteria.

The courts emphasized that while the legislation seeks to strengthen databases for locating disappeared persons, it must also protect citizens’ rights to safeguard their personal and sensitive information.

What Is Biometric CURP?

Under the new law, the CURP will incorporate biometric data, including a facial photograph and fingerprint templates, replacing its former status as a purely alphanumeric code. The enhanced system will include iris scans, all ten fingerprints, and facial recognition data encoded in a QR code.

The original CURP, introduced in 1996, is an 18-character code used for tax filings, school enrollment, passport applications, and other government services. The biometric version transforms this into Mexico’s universal identification document, both digital and physical.

The reform establishes that the new CURP, which will include fingerprints and photography, will be the mandatory national identification document throughout Mexico. These changes are designed to facilitate real-time cross-checks between government databases, providing authorities with more precise tools for identifying individuals.

Privacy Advocates Sound Alarm

Digital rights organizations have raised serious concerns about the surveillance implications of centralizing all Mexican citizens’ biometric data. “This puts us in a massive surveillance ecosystem with no provisions to identify wrong use of data, data breaches, identity theft or acts of corruption,” said José Flores, director of local digital rights group R3D.

Rights groups such as Article 19 believe the ID will give intelligence services access to data without restrictions or transparency. Mexico’s national security agencies, such as the National Intelligence Centre and the National Guard, are among the government bodies that will gain access to the biometric data.

The system creates what critics describe as a detailed map of citizens’ daily activities. The biometric ID card will grant authorities access to a detailed footprint of a citizen’s activities, without requiring a court order, according to José Flores. These activities include visiting healthcare clinics and opening bank accounts.

International Context

Mexico’s biometric ID program follows a global trend toward enhanced digital identification systems, though with varying levels of privacy protection. The European Union’s GDPR provides strict regulations for handling biometric data, while many developing nations lack comprehensive privacy frameworks.

Government-mandated biometric systems are invasive and costly, and damage the right to privacy and free expression. They also violate the potential for anonymity, which is crucial for whistleblowers, investigators, journalists, and political dissidents.

Privacy advocates worldwide have noted that, unlike passwords or traditional identification, biometric data cannot be changed if compromised, making data breaches particularly dangerous for citizens’ long-term security.

Implementation Timeline Under Question

The identifier is expected to be introduced gradually to all Mexicans by February 2026. However, the mounting legal challenges could significantly delay this timeline.

President Claudia Sheinbaum has maintained that providing biometric data will remain voluntary, though the law makes the biometric CURP mandatory for accessing most government and private services. The government says that the misuse of sensitive data, including biometrics, is regulated by existing data privacy laws.

The current legal challenges represent just the beginning of what could be a lengthy court battle. A hearing is scheduled for September 1, when judges will determine whether to grant definitive suspensions for the plaintiffs. These suspensions would remain in effect throughout the entire legal process, which could extend for months or even years.

The biometric CURP controversy highlights the ongoing tension between technological advancement and privacy rights. Mexico’s Supreme Court of Justice may ultimately decide the program’s constitutionality.