Law note · New Hampshire
Notice of Security Breach
A person doing business in New Hampshire that owns or licenses computerized data including personal information must, on becoming aware of a security breach, determine the likelihood of misuse and notify affected individuals and the Attorney General's office as soon as possible, with notice to consumer reporting agencies required once more than 1,000 residents are affected. "Personal information" excludes information lawfully made available to the public from government records.
The codified text's own source note dates this subdivision to 2006, 242:1, effective January 1, 2007. Unlike the comprehensive act, this statute arms an injured person with a private right of action, including treble damages for a willful or knowing violation.
What it asks of an app
- Notify affected New Hampshire residents and the Attorney General's office as soon as possible on determining a security breach of personal information occurred.
- Notify consumer reporting agencies once notice is required for more than 1,000 residents.
- Expect an injured individual to be able to sue for damages, including treble damages for a willful or knowing violation, unlike New Hampshire's comprehensive privacy act.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official New Hampshire statute text, RSA chapter 359-C, New Hampshire General Court website