América Móvil ranked eighth out of the 12 telecommunications companies we evaluated in 2020. The company made much-needed improvements to its governance and oversight but was particularly opaque on freedom of expression issues. It disclosed nothing about how it responds to government requests for content blocking or network shutdowns.

Key Takeaways

Despite some key improvements, América Móvil disclosed little about policies and practices affecting freedom of expression and privacy.

América Móvil disclosed almost nothing about its use of algorithmic systems and targeted advertising.

América Móvil was more clear about customer complaint channels for freedom of expression issues, but it was still unclear about how it handles government demands to block content or restrict accounts, to shut down the internet, or to hand over user information.

Key recommendations

Increase transparency on government requests. América Móvil should be more transparent about how it responds to government requests to block content, restrict user accounts, shut down networks, or provide user information.

Disclose human rights due diligence practices. América Móvil should disclose information about its human rights due diligence, including whether it conducts impact assessments.

Clarify security measures. América Móvil should clarify its policies for securing user information, including its procedures for handling data breaches.

Services evaluated:

Operating company evaluated: Telcel (Mexico)For telecommunications companies, the RDR Index evaluates relevant policies of the parent company, the operating company, and selected services of that operating company.
Market cap: $44.7 billion (as of February 4, 2021)
BMV: AMXL
Website: https://www.americamovil.com

The 2020 RDR Index covers policies that were active between February 8, 2019, and September 15, 2020. Policies that came into effect after September 15, 2020 were not evaluated for this Index.

Scores reflect the average score across the services we evaluated, with each service weighted equally.

Lead researchers: Zak Rogoff, Jan Rydzak

Download data and sources

Changes since 2019

América Móvil disclosed senior-level oversight on freedom of expression and privacy, and it clarified that all employees undergo training on freedom of expression issues.

América Móvil’s revised privacy policy weakened a previous commitment to purpose minimization.

The company improved by reporting more about the freedom of expression and privacy-related grievances it receives but did not explain its remedy procedures.

+ 3.15 points

Gained 3.15 points on comparable indicators since the 2019 RDR Index.

Governance

Freedom of expression

Privacy

We rank companies on their governance, and on their policies and practices affecting freedom of expression and privacy.

Governance 51%

América Móvil made key governance improvements, including clearer oversight of privacy and freedom of expression issues by senior leadership. However, it continued to lack any mechanism for due diligence or stakeholder engagement.

Human rights commitment: América Móvil made an explicit commitment to protect users’ freedom of expression and privacy rights (G1). But it failed to make a formal human rights commitment in its development and use of algorithmic systems (G1).

Human rights due diligence: The company did not disclose any evidence of conducting due diligence to assess privacy, expression, or discrimination risks associated with its services or activities (G4).

Stakeholder engagement: América Móvil disclosed no evidence of systematic engagement with stakeholders that represent, advocate on behalf of, or are people whose freedom of expression and information and rights of privacy are directly impacted by the company (G5).

Remedy: América Móvil enabled users to file privacy- and freedom of expression-related grievances, as required by Mexican law.^[1] It also released data about the volume of these complaints but did not say whether it provided remedy for them (G6a).

Indicators

G1. Policy commitment

67%

G2. Governance and management oversight

83%

G3. Internal implementation

100%

G5. Stakeholder engagement and accountability

56%

Freedom of expression 6%

América Móvil disclosed almost nothing about policies and practices affecting users’ freedom of expression and information rights.

Content blocking and account restrictions: The terms of service for América Móvil were difficult to find and understand (F1). The company did not explain its process for policy enforcement (F3a) or disclose data on content or account restrictions that it imposes in response to rule violations (F4a, F4b).

Advertising content and targeting: América Móvil did not disclose any advertising content or ad targeting policies (F1c, F1d). The company’s privacy policy says it performs “profiling” of users for the purpose of advertising.

Censorship demands: The company did not disclose a policy for responding to government and private demands to block content or restrict accounts (F5) nor did it provide data on the number of such demands it received or complied with (F6, F7).

Network management: Although it published a policy on net neutrality principles, it did not maintain this commitment in practice, due to its zero-rating program for WhatsApp, Uber, and other popular services (F9). The company had no policy for handling government demands to shut down the internet (F10).

Indicators

17%

13%

23%

F6. Data about government demands to restrict for content and accounts

F7. Data about private requests for content or account restriction

F8. User notification about content and account restriction

F9. Network management (telecommunications companies)

17%

F10. Network shutdown (telecommunications companies)

F11. Identity policy

F12. Algorithmic content curation, recommendation, and/or ranking systems

F13. Automated software agents (“bots”)

Privacy 22%

América Móvil failed to disclose sufficient information about policies and practices affecting privacy and security.

Handling of user data: América Móvil improved the readability of its privacy policy, but the policy disclosed incomplete information about what types of user information it collects and shares (P3, P4). América Móvil disclosed that it performs “profiling” of users (P3b) and that it collects data about them from third parties to use for advertising (P9).

Government and private demands for user information: While it disclosed that it carries out due diligence before responding to government demands for user data, it shared no other details about its process of responding to such demands (P10a), and it also failed to report any data on them (P11a). América Móvil did not commit to notify users when it provides their data to the government (P12).

Security: While América Móvil had internal measures limiting and monitoring employee access to user information (P13), it failed to disclose any information about how it addresses security vulnerabilities, including if it offers a bug bounty program for security researchers to submit vulnerabilities (P14). Mexican companies are required to notify users when a data breach “significantly affects” their rights. However, it failed to disclose what steps it takes to address the impact of the breach on its users (P15).^[2]