Trains models, in New Mexico

Laws 2017, ch. 36, House Bill 15, Sections 3 to 5 (NMSA 1978, Secs. 57-12C-3 to 57-12C-5) · Read the law's page

• This binds any person that owns or licenses records containing the personal identifying information of a New Mexico resident, or that discloses that information to a service provider under contract; it does not bind the State of New Mexico or any of its political subdivisions.
• Implement and maintain reasonable security procedures and practices, appropriate to the nature of the personal identifying information held, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Arrange for proper disposal, shredding, erasing, or otherwise rendering the information unreadable or undecipherable, of records containing personal identifying information once they are no longer reasonably needed for business purposes.
• Where personal identifying information is disclosed to a service provider under a contract, require by that contract that the service provider also implement and maintain reasonable security procedures and practices appropriate to the nature of the information.
• There is no private right of action; only the Attorney General may enforce this duty, seeking an injunction, damages for actual costs or losses, and, where the violation was knowing or reckless, a civil penalty of $25,000. A separate, higher penalty schedule tied to a count of failed notifications governs this Act's notification duty alone, this jurisdiction's privacy row, and does not apply to a violation of the security or disposal duty described here.