Source: https://www.natlawreview.com/article/new-mexico-to-become-48th-state-to-enact-data-breach-notification-statute
Timestamp: 2019-04-19 05:09:28+00:00

Document:
The Data Breach Notification Act, House Bill 15, passed New Mexico’s House and Senate on February 15 and March 15, 2017, respectively, without any opposition. New Mexico Governor Susana Martinez has until April 7, 2017 to sign the act into law, or it will be pocket vetoed.
Once the bill is signed, 48 states, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands will have enacted some version of a data breach no tification law. These statutes mandate that an entity notify residents when there has been unauthorized access or use of the individuals’ personally identifiable information (PII). With the passage of New Mexico’s statute, Alabama and South Dakota will be the only two remaining states without equivalent laws.
The statute uses a common definition of PII, defining it as an individual’s first name or first initial and last name in combination with one or more of the following data elements that relate to the individual, when the data elements are not protected through encryption or redaction or otherwise rendered unreadable or unusable: (a) social security number; (b) driver’s license number; (c) government-issued identification number; (d) account number, credit card number or debit card number in combination with any required security code, access code or password that would permit access to a person’s financial account; or (e) unique biometric data, including the person’s fingerprint, voice print or retina or iris image.
The New Mexico law does not follow the recent trend of including usernames or email addresses in combination with passwords or security questions and answers that has recently been added to the definition of PII in several jurisdictions.
The statute also does not provide for an explicit private right of action. Instead, it gives the New Mexico attorney general the right to bring an action on behalf of affected individuals and in the name of the state for any violations of the Data Breach Notification Act. In such an action, the court could issue an injunction, award damages for costs (including consequential financial losses), and impose a civil penalty for knowing or reckless violations.
While there are many similarities among the jurisdictions’ notification statutes, all 52 jurisdictional statutes are unique, creating a complicated and oftentimes contradictory system. US Congress has yet to institute an overarching federal standard, so multijurisdictional companies are forced to navigate the intricacies of all the jurisdictions, with New Mexico now potentially added to the mix. Based on the many variations under individual state data breach laws, some have called for enactment of a uniform federal standard concerning data breach notification requirements.
As discussed above, New Mexico provides a harmless exemption to notification. The majority of jurisdictions also provide harmless exemptions, but each jurisdiction’s standard for this exemption differs. Companies with residents in all jurisdictions will be forced to make potentially 52 separate assessments regarding the possible harm and impact of a data breach. Therefore each case involving a potential data or security breach requires a careful assessment of the facts and circumstances and consideration of any legal consequences, including whether notification is mandated in each applicable jurisdiction.
 See House Bill 15 (HB 15).
 HB 15, §§ 6(A), (C).
 See M. Krotoski, S. Tester, LawFlash: Three States Join Others to Expand Personal Information Definition to Include Usernames or Email Addresses (Jan. 3, 2017).
 HB 15, § 7; 10 Me. Rev. Stat. Ann. § 1348(4); R.I. Gen. Laws § 11-49.3-4(d)(1).
 HB 15, § 7; Mass. Gen. Laws ch. 93H, § 3(a); 815 Ill. Comp. Stat. § 530/10(a).
Jenny Harrison is an associate Morgan Lewis's Litigation Practice. The lawyers in our Litigation Practice provide services in a wide range of areas including business and corporate disputes, corporate investigations and criminal defense, environmental, international arbitration, patent and trademark, securities, toxic tort, and product liability.
Ms. Harrison received her J.D. from the University of California, Berkeley School of Law in 2012, where she worked for the Berkeley Journal of International Law. While in law school, she served as a judicial extern for Judge Joseph H. Huber of the Superior Court of California, County of Santa Clara. Ms. Harrison received her B.A. in economics from Cornell University in 2008.
Ms. Harrison is admitted to practice in California.

References: § 7
 § 1348
 § 11
 § 7
 § 3
 § 530