Law / United States / 
New Mexico
Data Breach Notification Act
Laws 2017, ch. 36, House Bill 15, Sections 1 to 12 (NMSA 1978, Secs. 57-12C-1 to 57-12C-12)
In force since .
A breach notification rule binding private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Notify each affected New Mexico resident of a security breach involving their personal identifying information in the most expedient time possible and no later than 45 calendar days after discovery.
- Notify the New Mexico Attorney General's office and the major consumer reporting agencies that compile files nationwide of a security breach affecting more than 1,000 New Mexico residents in the most expedient time possible and no later than 45 calendar days, and tell the Attorney General how many residents were notified and send it a copy of the resident notice within 45 calendar days following discovery of the breach (Section 10).
- If you maintain or are licensed to possess data you do not own or license, notify the owner or licensee of a security breach in the most expedient time possible and no later than 45 calendar days following discovery of the breach (Section 6).
- Treat a fingerprint, voiceprint, iris or retina pattern, facial characteristic, or hand geometry record used to authenticate access to a location, device, system, or account as biometric data covered by this notice duty. A bare identifier extracted from a public recording for identification, rather than authentication, purposes may fall outside this statute's own biometric-data definition, which the text does not resolve either way.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- What must an 'appropriate investigation' establish under Section 6(B) of the Data Breach Notification Act for a person to conclude that a security breach 'does not give rise to a significant risk of identity theft or fraud'?
What it makes you log
Logging duty
The Act requires disposal of records when no longer reasonably needed (section 3), reasonable security procedures (sections 4 and 5), notice to each affected New Mexico resident within 45 calendar days (section 6), a notice with set contents (section 7) and notice to the Attorney General and consumer reporting agencies, with a copy of the resident notice, where more than 1,000 residents are notified (section 10). These are notifications and filings. The determination after an appropriate investigation that a breach poses no significant risk of identity theft or fraud (sections 6(B) and 6(C)) excuses notice but the Act does not require it to be documented or kept. No log or record duty, audit or regulator access to a record appears. The duties attach to a person that owns or licenses personal identifying information of a New Mexico resident, so the residence test is the hook; the Act exempts the State and its political subdivisions (section 12).
- Kind
- None
- As of
What this law does
A person that owns or licenses computerized data including a New Mexico resident's personal identifying information must notify each affected resident of a security breach in the most expedient time possible and no later than 45 calendar days after discovery, and a breach affecting more than 1,000 New Mexico residents also triggers notice to the Attorney General's office and major consumer reporting agencies.
Personal identifying information includes biometric data, defined as a record generated by automatic measurement of fingerprints, a voiceprint, iris or retina patterns, facial characteristics, or hand geometry used to authenticate access to a physical location, device, system, or account, alongside a Social Security number, a driver's license number, and financial account information, and excludes information lawfully obtained from publicly available sources or government records.
The Act exempts the State of New Mexico and its political subdivisions entirely. The Attorney General has sole authority to bring an action for a violation, may obtain an injunction and damages for actual costs or losses, and may seek a civil penalty of the greater of $25,000 or $10 per failed notification up to $150,000; the Act creates no private right of action. Enacted by Laws 2017, chapter 36 (House Bill 15); the Act took effect on .
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .