Law / United States / 
New Hampshire
New Hampshire Data Privacy Act, de-identified and pseudonymous data
RSA 507-H:1, XIV and XXV; RSA 507-H:9
In force since .
A de-identification rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- To hold data as de-identified under the New Hampshire Data Privacy Act, take reasonable measures to ensure the data cannot be associated with an individual (RSA 507-H:9, I(a)).
- Publicly commit to maintaining and using de-identified data without attempting to reidentify it (RSA 507-H:9, I(b)).
- Contractually obligate every recipient of de-identified data to comply with all provisions of the chapter (RSA 507-H:9, I(c)).
- When you disclose pseudonymous or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments attached to it, and take appropriate steps to address any breach of those commitments (RSA 507-H:9, V).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
RSA 507-H:1, XIV and RSA 507-H:9 set the conditions for holding data as de-identified and a controller's oversight of recipients' contractual commitments. They state no log or record duty and no retention period.
- Kind
- None
- As of
What this law does
A controller that holds de-identified data must take reasonable measures to ensure that the data cannot be associated with an individual. A controller that holds de-identified data must publicly commit to maintaining and using it without attempting to reidentify the data. A controller that holds de-identified data must contractually obligate any recipients of the data to comply with all provisions of the chapter.
De-identified data is data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such individual, if the controller that possesses it takes reasonable measures to ensure the data cannot be associated with an individual, publicly commits to process it only in a de-identified way and not to re-identify it, and contractually obligates any recipients to satisfy the same criteria.
A controller that discloses pseudonymous data or de-identified data must exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and must take appropriate steps to address any breach of those commitments.
The consumer rights in RSA 507-H:4, I(a) to (d) do not apply to pseudonymized data where the controller can demonstrate that the information needed to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing it. Nothing in the chapter requires a controller or processor to re-identify de-identified data or pseudonymous data. The section took effect on .
When LexLint raises it
When your app profile says your app processes de-identified data or processes personal data.
Back to the example · Lint your app
Page updated .