Law / United States / 
New Hampshire
New Hampshire Data Privacy Act, consumer rights
In force since .
A data subject rights rule binding private bodies.
- Audit expectation
- none
What it requires
- Give a New Hampshire consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.NIST Privacy FrameworkCT.PO-P3
- Offer a New Hampshire consumer an opt-out of targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects.NIST Privacy FrameworkCT.PO-P3
- Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 45-day extension available, and decide an appeal of a refusal within 60 days.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7
These lines are LexLint's reading of the law's text. Also read by: New Hampshire Department of Justice, Consumer Protection and Antitrust Bureau (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.doj.nh.gov/data-privacy-enforcement
- Guidance body
- New Hampshire Department of Justice, Consumer Protection and Antitrust Bureau
- Open questions
- Does profiling that feeds a decision which a person reviews or finalizes fall within 'profiling in furtherance of solely automated decisions' in RSA 507-H:4, I(e)?
What it makes you log
What the log must hold
Decision basis
Logging duty
A controller may deny an opt-out request only on a good faith, reasonable and documented belief that the request is fraudulent, which cannot be shown without a written record of the belief, and a controller that charges for or declines a request as manifestly unfounded, excessive or repetitive bears the burden of demonstrating that nature. The text names no field of the record, sets no retention period and sets no audit schedule. RSA 507-H:4, III(e) treats a controller as compliant with a deletion request if it retains a record of the request and the minimum data needed to keep the data deleted, which is one of two routes and an option, not a duty. The appeal decision in RSA 507-H:4, IV must be given to the consumer in writing, which is a notice and not a kept record. The scope clause in RSA 507-H:2 and the consumer definition in RSA 507-H:1 are not cited, so no territorial hook is taken.
- Kind
- Implicit
- As of
- Provision
- RSA 507-H:4, III(d) (a good faith, reasonable and documented belief that an opt-out request is fraudulent) and III(c) (the controller bears the burden of demonstrating that a request is manifestly unfounded, excessive or repetitive)
- Trigger
- consent_or_optout
What this law does
NHDPA gives a New Hampshire consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects.
A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available if the controller informs the consumer within the initial period, and must offer an internal appeal of a denial, decided within 60 days, after which the consumer may complain to the Attorney General.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .