Law / United States / 
New Mexico
Data Breach Notification Act, security and disposal duties
Laws 2017, ch. 36, House Bill 15, Sections 3 to 5 (NMSA 1978, Secs. 57-12C-3 to 57-12C-5)
In force since .
A security baseline statutes rule binding private bodies.
- Obligation class
- Security
What it requires
- This binds any person that owns or licenses records containing the personal identifying information of a New Mexico resident, or that discloses that information to a service provider under contract; it does not bind the State of New Mexico or any of its political subdivisions.
- Implement and maintain reasonable security procedures and practices, appropriate to the nature of the personal identifying information held, to protect it from unauthorized access, destruction, use, modification, or disclosure.NIST CSF 2.0PR.DS-01
- Arrange for proper disposal, shredding, erasing, or otherwise rendering the information unreadable or undecipherable, of records containing personal identifying information once they are no longer reasonably needed for business purposes.NIST CSF 2.0ID.AM-08
- Where personal identifying information is disclosed to a service provider under a contract, require by that contract that the service provider also implement and maintain reasonable security procedures and practices appropriate to the nature of the information.NIST CSF 2.0GV.SC-05
- There is no private right of action; only the Attorney General may enforce this duty, seeking an injunction, damages for actual costs or losses, and, where the violation was knowing or reckless, a civil penalty of $25,000. A separate, higher penalty schedule tied to a count of failed notifications governs this Act's notification duty alone, this jurisdiction's privacy row, and does not apply to a violation of the security or disposal duty described here.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
NMSA 1978 Sec. 57-12C-11(C) makes this $25,000 civil penalty available only where the court finds the violation knowing or reckless; an ordinary violation draws only the injunction and actual-costs-or-losses damages available under Sec. 57-12C-11(B). The same subsection also lets the court impose, in the case of failed notification, $10 per instance up to $150,000 in place of the flat $25,000 if that figure is greater; that per-instance alternative has no application to a violation of the security-procedures or disposal duty described here, which involves no notification to count, and it governs this Act's own notification duty, this jurisdiction's privacy row, instead.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 25,000
Who enforces it
Enforcement body
New Mexico Attorney General; NMSA 1978 Sec. 57-12C-11(A) confines standing to the Attorney General, acting on behalf of individuals and in the name of the state, with no dedicated regulator distinct from that authority and no published enforcement record located for this duty specifically.
What this law does
A person that owns or licenses personal identifying information of a New Mexico resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect it from unauthorized access, destruction, use, modification, or disclosure.
The same person must arrange for proper disposal, meaning shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable, of records containing personal identifying information once they are no longer reasonably needed for business purposes.
Where a person discloses personal identifying information to a service provider under contract, that contract must require the service provider to implement and maintain the same reasonable security procedures and practices.
The Act exempts the State of New Mexico and its political subdivisions entirely, and enforcement is confined to the Attorney General, who may obtain an injunction, damages for actual costs or losses, and, for a knowing or reckless violation, a civil penalty of $25,000; the Act creates no private right of action. Enacted by Laws 2017, chapter 36 (House Bill 15); the Act took effect on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .