Crawls the web, in New Mexico

Laws 2017, ch. 36, House Bill 15, Sections 3 to 5 (NMSA 1978, Secs. 57-12C-3 to 57-12C-5) · Read the law's page

• This binds any person that owns or licenses records containing the personal identifying information of a New Mexico resident, or that discloses that information to a service provider under contract; it does not bind the State of New Mexico or any of its political subdivisions.
• Implement and maintain reasonable security procedures and practices, appropriate to the nature of the personal identifying information held, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Arrange for proper disposal, shredding, erasing, or otherwise rendering the information unreadable or undecipherable, of records containing personal identifying information once they are no longer reasonably needed for business purposes.
• Where personal identifying information is disclosed to a service provider under a contract, require by that contract that the service provider also implement and maintain reasonable security procedures and practices appropriate to the nature of the information.
• There is no private right of action; only the Attorney General may enforce this duty, seeking an injunction, damages for actual costs or losses, and, where the violation was knowing or reckless, a civil penalty of $25,000. A separate, higher penalty schedule tied to a count of failed notifications governs this Act's notification duty alone, this jurisdiction's privacy row, and does not apply to a violation of the security or disposal duty described here.

N.M. Stat. Ann. § 30-45-5 · Read the law's page

• Do not knowingly, willfully and without authorization, or in excess of an authorization obtained, access, use, take, transfer, conceal, obtain, copy or retain possession of a computer, computer network, or computer property or service connected to New Mexico; a violation is graded by the dollar value of the resulting damage, from a petty misdemeanor at two hundred fifty dollars or less up to a second degree felony above twenty thousand dollars.
• Do not alter, damage, disrupt or destroy computer property or a computer service, or introduce data known to be false with intent to harm another's property or financial interests.
• Nothing in the Act's own text exempts ordinary, non-disruptive automated access to a publicly available page from the authorization requirement.
• A person found guilty must also pay restitution for financial loss, in addition to any other punishment, forfeiture or fine.