ETD

• Algorithmic accountability
• artificial intelligence
• artificial intelligence governance
• Biometric and genetic data
• enforced disappearance
• EU Artificial Intelligence Act
• Facial recognition
• Functional comparative law
• Fundamental Rights Impact Assessment
• GDPR
• High-risk AI systems
• Institutional interoperability and data sharing
• Jalisco
• Law Enforcement Directive
• Mexico
• Missing persons
• Public procurement of technology
• Regulation (EU) 2024/1689

Jalisco searches for its disappeared through an apparatus of computational systems that has grown without a corresponding legal architecture. Facial recognition operates against passers-by, a deep-learning retrieval system compares tattoo images of the dead, a private association processes reserved criminal investigation files, a geospatial model has since March 2026 originated search deployments rather than supporting them, and genetic and fingerprint databases confront profiles taken from human remains against samples given by the families searching for them. This thesis asks which obligations the European Union's data and artificial intelligence framework would impose on that apparatus, which of its systems it would capture and which would escape, and how far its mechanisms could be adapted as controls operating before acquisition and before deployment rather than after harm.
The method is functional comparison, applied to the systems. Chapter 1 maps the institutions and inventories the technologies employed in or adjacent to the search for missing persons, classifying them by whether they infer within the meaning of Article 3(1) of Regulation (EU) 2024/1689. It rests substantially on primary evidence obtained through freedom of information requests to the state search commission, the forensic institute and the surveillance centre, several of which remained unanswered; the thesis asserts throughout what the available sources reveal rather than what exists.
Chapter 2 applies the Union framework. Section 2.1 finds that the Artificial Intelligence Act would capture a minority of the inventory and would capture it well, imposing conformity assessment, declared accuracy metrics, event logging, human oversight and a fundamental rights impact assessment on the facial recognition systems, while a threshold defined by internal architecture remains unusable by the persons whose data are processed, since that architecture is not disclosed to them. The divergence is sharpest at acquisition: Article 73(III) of Jalisco's procurement statute permits direct award on public-security grounds without independent verification of efficacy, whereas under the Union model a system's error characteristics are owed to the acquiring authority by law rather than negotiated as a commercial concession. Section 2.2 finds that the General Data Protection Regulation leaks at two thresholds, both excluding precisely what the inventory makes most sensitive. Article 2(2)(d) divides the apparatus along lines that do not follow the domestic organic classification, so that a secretariat which state law constitutes as administrative would, on the Union's functional test, fall largely outside the Regulation; and recital 27 excludes the personal data of deceased persons, so that where Member States have legislated they have extended rights rather than the regime, relocating the gap from protection to standing. The result is an asymmetry the apparatus cannot avoid: the person searched for falls outside, the mother who gives the reference sample falls inside, and a single act of comparison straddles the boundary. Section 2.3 examines Directive (EU) 2016/680, whose stricter necessity test and express logging duty reach part of what the Regulation does not.
The final part of the thesis brings the two analyses together, it contrasts Jalisco's ex post, reactive approach with the Union's ex ante model, and argues that the operational shortcomings documented in Chapter 1 are attributable to structural gaps in the legal framework rather than to the performance of the software (both can be true at the same time). On that basis it proposes reforms to the procurement regime, the institutionalisation of a mandatory impact assessment within the local search ecosystem, and a model of legal interoperability capable of resolving the friction between the duty to share data and the secrecy of the criminal investigation file.
The thesis makes three contributions. It assembles, from institutional sources obtained through transparency requests rather than from public reporting, a system account of an apparatus not previously documented, correcting the record on what several of these systems are and on what their operators can demonstrate about them. It shows that the protective reach of the Union framework is set not by risk but by three definitional thresholds indifferent to it (inference, law-enforcement purpose and death) so that transposing the rules alone would reproduce the gaps rather than close them, and reform must be designed around them. And it argues that the point of leverage lies at acquisition and deployment rather than after harm, and that the controls examined serve the positive duty to search as much as they constrain it, since a system whose error characteristics no one can state is not only a hazard to those it processes but an unreliable instrument for finding the people it exists to find.