Processes biometric data, in New Mexico

Laws 2017, ch. 36, House Bill 15, Sections 1 to 12 (NMSA 1978, Secs. 57-12C-1 to 57-12C-12) · Read the law's page

• Notify each affected New Mexico resident of a security breach involving their personal identifying information in the most expedient time possible and no later than 45 calendar days after discovery.
• Notify the New Mexico Attorney General's office and the major consumer reporting agencies that compile files nationwide of a security breach affecting more than 1,000 New Mexico residents in the most expedient time possible and no later than 45 calendar days, and tell the Attorney General how many residents were notified and send it a copy of the resident notice within 45 calendar days following discovery of the breach (Section 10).
• If you maintain or are licensed to possess data you do not own or license, notify the owner or licensee of a security breach in the most expedient time possible and no later than 45 calendar days following discovery of the breach (Section 6).
• Treat a fingerprint, voiceprint, iris or retina pattern, facial characteristic, or hand geometry record used to authenticate access to a location, device, system, or account as biometric data covered by this notice duty. A bare identifier extracted from a public recording for identification, rather than authentication, purposes may fall outside this statute's own biometric-data definition, which the text does not resolve either way.

Laws 2017, ch. 36, House Bill 15, Sections 3 to 5 (NMSA 1978, Secs. 57-12C-3 to 57-12C-5) · Read the law's page

• This binds any person that owns or licenses records containing the personal identifying information of a New Mexico resident, or that discloses that information to a service provider under contract; it does not bind the State of New Mexico or any of its political subdivisions.
• Implement and maintain reasonable security procedures and practices, appropriate to the nature of the personal identifying information held, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Arrange for proper disposal, shredding, erasing, or otherwise rendering the information unreadable or undecipherable, of records containing personal identifying information once they are no longer reasonably needed for business purposes.
• Where personal identifying information is disclosed to a service provider under a contract, require by that contract that the service provider also implement and maintain reasonable security procedures and practices appropriate to the nature of the information.
• There is no private right of action; only the Attorney General may enforce this duty, seeking an injunction, damages for actual costs or losses, and, where the violation was knowing or reckless, a civil penalty of $25,000. A separate, higher penalty schedule tied to a count of failed notifications governs this Act's notification duty alone, this jurisdiction's privacy row, and does not apply to a violation of the security or disposal duty described here.