Law / United States / 
New Mexico
Genetic Information Privacy Act
Laws 1998, Chapter 77, House Bill 331, Sections 1 to 7 (NMSA 1978, Secs. 24-21-1 to 24-21-7)
In force.
A sensitive categories rule binding private bodies.
- Obligation class
- Consent, Retention, Prohibition
- Audit expectation
- none
What it requires
- Obtain a person's informed, written consent before obtaining their genetic information or samples for genetic analysis, or before performing genetic analysis or collecting, retaining, transmitting, or using their genetic information, unless a statutory exception applies.
- Expect an individual whose rights under this Act are violated to be able to sue directly for damages or other relief, in addition to Attorney General or district attorney enforcement.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Statutory damages
The court may order, in addition to actual damages, damages of up to $5,000 where the violation results from willful or grossly negligent conduct, plus reasonable attorney fees and appropriate court costs. Each instance of wrongful collection, analysis, retention, disclosure, or use of genetic information is a separate, actionable violation. The Act states no separate, regulator-only civil penalty distinct from this court-ordered relief.
- As of
- Currency
- USD
- Per person reckless
- 5,000
Who enforces it
Enforcement body
New Mexico Attorney General or a district attorney; also enforceable through a private civil action by an injured individual. No dedicated regulator civil-penalty schedule distinct from the court-ordered relief in Sec. 24-21-6(C).
Settledness
- As of
- Open questions
- Does a consumer ancestry or wellness DNA test count as 'genetic analysis' under Section 2 of the Genetic Information Privacy Act, which reaches only a test that 'indicates a propensity for or susceptibility to illness, disease, impairment or other disorders' or 'carrier status'?
What it makes you log
Logging duty
The Act requires informed and written consent to obtain, retain, transmit or use genetic information (sections 3 and 5), prompt destruction on request unless an exception applies, and a written notice from an insurer that uses genetic information for life, disability income or long-term care underwriting (sections 3(D) and 5(C)). A consent that must be given in writing is a condition of processing, and the Act does not say the person must be able to show it or keep it; destruction duties limit the data and not a record; the notice is a notice. No log or record duty, audit or regulator access appears, and the Attorney General or district attorney may sue but is given no right to a record. The Act has no territorial clause; its insurer definition is tied to licensing in the state, which is not coded as a hook value.
- Kind
- None
- As of
What this law does
No person may obtain genetic information or samples for genetic analysis from an individual, or perform genetic analysis or collect, retain, transmit, or use genetic information, without first obtaining the individual's or their authorized representative's informed, written consent, subject to eleven numbered exceptions covering law enforcement, newborn screening, de-identified use, medical repositories, research, and laboratory analysis ordered in writing by a health care practitioner.
Person is not limited to government or insurers; a separate section prohibits genetic discrimination specifically by insurers. Enacted in 1998 (House Bill 331) and amended in 2015 (House Bill 369, which replaced person with individual in the penalties subsection); the enrolled bill carries no commencement clause, and no page stating the day the Act came into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .