New Mexico

The Sexual Exploitation of Children Act defines a visual or print medium to include a computer diskette, videotape, videodisc, or any computer or electronically generated imagery (Section 30-6A-2(B)), so the Act's coverage is not limited to a photograph of a real event.

Section 30-6A-3(F) makes it unlawful to intentionally manufacture an obscene visual or print medium depicting a prohibited sexual act if the person knows or has reason to know that a real child under eighteen, who is not a participant, is depicted as a participant in that act, a fourth degree felony. Section 30-6A-3(G) makes distributing such a medium a third degree felony.

Neither subsection requires that any child actually engaged in the depicted conduct; both reach a medium, including one that is computer or electronically generated, that depicts an identifiable real child as if they were a participant in a prohibited sexual act when they were not, which covers an artificial-intelligence-generated or artificial-intelligence-altered image or video inserting or morphing a real child's likeness into sexually explicit content.

Section 1-19-26.4, as amended by 2024's HB 182, requires a person who creates, produces or purchases a campaign advertisement containing materially deceptive media to include a disclaimer stating that the content has been manipulated or generated by artificial intelligence, displayed legibly for the duration of a video and spoken clearly at the start and end of an audio message (and at least every two minutes if longer than two minutes).

Materially deceptive media is defined as an image, video or audio that depicts an individual engaged in conduct or speech in which they did not engage, published without the depicted individual's consent, and produced in whole or in part using artificial intelligence.

The duty does not apply to a bona fide news broadcast that discloses the manipulation, a broadcaster that supplied and disclosed its own disclaimer requirements to advertisement purchasers, or an advertisement that reasonably constitutes satire or parody if it includes the required disclaimer.

A new Section 1-19-26.8, also enacted by HB 182, separately makes it a violation of the Campaign Reporting Act to distribute, or to agree with another person to distribute, materially deceptive media, and allows the attorney general, a district attorney, a falsely depicted individual, an injured or likely-to-be-injured candidate, or a voter-representing organization to seek injunctive relief.

A first conviction under Section 1-19-26.8 is a misdemeanor and a second conviction is a fourth degree felony. Failing to include the Section 1-19-26.4(D) disclaimer is separately subject to a civil penalty of up to one thousand dollars per violation, capped at twenty thousand dollars in total, under Section 1-19-34.6(C).

HB 182 carried no separate effective-date clause, so it takes effect under Article IV, Section 23 of the New Mexico Constitution: a law without an emergency clause takes effect ninety days after the adjournment of the legislature that enacted it. The 2024 legislative session adjourned sine die on February 15, 2024, placing the Act's commencement, ninety days later, at May 15, 2024.

A person that owns or licenses computerized data including a New Mexico resident's personal identifying information must notify each affected resident of a security breach in the most expedient time possible and no later than 45 calendar days after discovery, and a breach affecting more than 1,000 New Mexico residents also triggers notice to the Attorney General's office and major consumer reporting agencies.

Personal identifying information includes biometric data, defined as a record generated by automatic measurement of fingerprints, a voiceprint, iris or retina patterns, facial characteristics, or hand geometry used to authenticate access to a physical location, device, system, or account, alongside a Social Security number, a driver's license number, and financial account information, and excludes information lawfully obtained from publicly available sources or government records.

The Act exempts the State of New Mexico and its political subdivisions entirely. The Attorney General has sole authority to bring an action for a violation, may obtain an injunction and damages for actual costs or losses, and may seek a civil penalty of the greater of $25,000 or $10 per failed notification up to $150,000; the Act creates no private right of action.

Enacted by Laws 2017, chapter 36 (House Bill 15); the enrolled bill text does not itself print an explicit commencement sentence, and secondary reporting gives June 16, 2017 without independent primary confirmation, so no effective date is recorded here.

No person may obtain genetic information or samples for genetic analysis from an individual, or perform genetic analysis or collect, retain, transmit, or use genetic information, without first obtaining the individual's or their authorized representative's informed, written consent, subject to nine numbered exceptions covering law enforcement, newborn screening, de-identified use, medical repositories, and research.

Person is not limited to government or insurers; a separate section prohibits genetic discrimination specifically by insurers. Enacted in 1998 (House Bill 331) and amended in 2015 (House Bill 369, which replaced person with individual in the penalties subsection); the enrolled bill text for neither version prints an explicit commencement sentence, so no effective date is recorded here.

The Computer Crimes Act's definitions section, Section 30-45-2, defines access, computer, computer network, computer property, computer service and related terms broadly, and the Act then creates three offenses. Section 30-45-3 punishes computer access with intent to defraud or embezzle.

Section 30-45-4 punishes computer abuse: altering, damaging, disrupting or destroying computer property or a computer service, or introducing data known to be false with intent to harm another's property or financial interests.

Section 30-45-5 separately punishes unauthorized computer use: knowingly, willfully and without authorization, or exceeding the scope of an authorization obtained, accessing, using, taking, transferring, concealing, obtaining, copying or retaining possession of a computer, computer network, computer property, computer service or computer system.

Each of these three offenses is graded solely by the dollar value of the damage to the computer property or computer service, from a petty misdemeanor at two hundred fifty dollars or less through a misdemeanor, a fourth degree felony, a third degree felony, up to a second degree felony above twenty thousand dollars; the Act does not add a separate, higher-graded bare-access offense the way some peer states do.

Section 30-45-6 allows prosecution under other law in addition to the Act and requires restitution for financial loss in addition to any other punishment. Section 30-45-7 subjects computer property, equipment, materials, conveyances and proceeds used in a violation to forfeiture under the Forfeiture Act.

No New Mexico case was located applying the Act to an automated web-scraping or bulk-data-collection fact pattern, and nothing in the Act's text exempts ordinary, non-disruptive automated access to a publicly available page from the authorization requirement.

A person that owns or licenses personal identifying information of a New Mexico resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect it from unauthorized access, destruction, use, modification, or disclosure.

The same person must arrange for proper disposal, meaning shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable, of records containing personal identifying information once they are no longer reasonably needed for business purposes.

Where a person discloses personal identifying information to a service provider under contract, that contract must require the service provider to implement and maintain the same reasonable security procedures and practices.

The Act exempts the State of New Mexico and its political subdivisions entirely, and enforcement is confined to the Attorney General, who may obtain an injunction, damages for actual costs or losses, and, for a knowing or reckless violation, a civil penalty of $25,000; the Act creates no private right of action. Enacted by Laws 2017, chapter 36 (House Bill 15); the enrolled bill text does not itself print an explicit commencement sentence, so no effective date is recorded here.