Law note · New Mexico
Data Breach Notification Act
A person that owns or licenses computerized data including a New Mexico resident's personal identifying information must notify each affected resident of a security breach in the most expedient time possible and no later than 45 calendar days after discovery, and a breach affecting more than 1,000 New Mexico residents also triggers notice to the Attorney General's office and major consumer reporting agencies.
Personal identifying information includes biometric data, defined as a record generated by automatic measurement of fingerprints, a voiceprint, iris or retina patterns, facial characteristics, or hand geometry used to authenticate access to a physical location, device, system, or account, alongside a Social Security number, a driver's license number, and financial account information, and excludes information lawfully obtained from publicly available sources or government records.
The Act exempts the State of New Mexico and its political subdivisions entirely. The Attorney General has sole authority to bring an action for a violation, may obtain an injunction and damages for actual costs or losses, and may seek a civil penalty of the greater of $25,000 or $10 per failed notification up to $150,000; the Act creates no private right of action.
Enacted by Laws 2017, chapter 36 (House Bill 15); the enrolled bill text does not itself print an explicit commencement sentence, and secondary reporting gives June 16, 2017 without independent primary confirmation, so no effective_date is recorded here.
What it asks of an app
- Notify each affected New Mexico resident of a security breach involving their personal identifying information in the most expedient time possible and no later than 45 calendar days after discovery.
- Notify the New Mexico Attorney General's office and major consumer reporting agencies if the breach affects more than 1,000 New Mexico residents.
- Treat a fingerprint, voiceprint, iris or retina pattern, facial characteristic, or hand geometry record used to authenticate access to a location, device, system, or account as biometric data covered by this notice duty. A bare identifier extracted from a public recording for identification, rather than authentication, purposes may fall outside this statute's own biometric-data definition, which this document cannot resolve either way from the text.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, processes_biometrics, processes_voice
Primary source: official New Mexico enrolled bill text
House Bill 15 of 2017 (Laws 2017, ch. 36), New Mexico Legislature. The codified section numbers cannot be verified against this source: New Mexico's codified-statute portal (nmonesource.com) is client-rendered and returns no text at any crawler tier including STEALTH_PLUS (#7952), and the enrolled bill prints neither its own bill number nor the NMSA numbers its sections became, so the citation anchors appear nowhere in it. The section-by-section correspondence was verified by hand: each "SECTION N" of the bill maps 1:1 onto the codified section of the same ordinal.