What does New Mexico's data breach law ask a business to do?

Who does this law apply to?

A person that owns or licenses personal identifying information of a New Mexico resident must notify each resident whose information is reasonably believed to have been subject to a security breach.

No notice is owed if, after an appropriate investigation, the person decides the breach does not create a significant risk of identity theft or fraud.

a person that owns or licenses elements that include personal identifying information of a New Mexico resident shall provide notification to each New Mexico resident whose personal identifying information is reasonably believed to have been subject to a security breach.

Notwithstanding Subsection A of this section, notification to affected New Mexico residents is not required if, after an appropriate investigation, the person determines that the security breach does not give rise to a significant risk of identity theft or fraud.

What counts as personal information?

Personal identifying information is a person's name together with a Social Security number, a driver's licence number, a government ID number, an account or card number with any code or password that would open the account, or biometric data.

(a) social security number; (b) driver's license number; (c) government-issued identification number; (d) account number, credit card number or debit card number in combination with any required security code, access code or password that would permit access to a person's financial account; or (e) biometric data;

How fast must people be told?

The law says notice must be made in the most expedient time possible and no later than forty-five calendar days after the breach is discovered.

The act allows a delay for a law enforcement investigation or to find the scope of the breach and restore the system.

Notification shall be made in the most expedient time possible, but not later than fortyfive calendar days following discovery of the security breach, except as provided in Section 9 [57-12C-9 NMSA 1978] of the Data Breach Notification Act.

Who else must be told?

When more than one thousand New Mexico residents are notified because of a single breach, the person must also notify the office of the attorney general and the major nationwide consumer reporting agencies, no later than forty-five calendar days.

A person that is required to issue notification of a security breach pursuant to the Data Breach Notification Act to more than one thousand New Mexico residents as a result of a single security breach shall notify the office of the attorney general and major consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. Section 1681a(p), of the security breach in the most expedient time possible, and no later than forty-five calendar days, except as provided in Section 9 [57-12C-9 NMSA 1978] of the Data Breach Notification Act.

Is encrypted information treated differently?

A security breach covers unencrypted data. Encrypted data counts only when the key or confidential process used to decrypt it was taken as well.

"security breach" means the unauthorized acquisition of unencrypted computerized data, or of encrypted computerized data and the confidential process or key used to decrypt the encrypted computerized data, that compromises the security, confidentiality or integrity of personal identifying information maintained by a person.

What if a vendor holds the data?

A person that keeps personal identifying information it does not own or license must tell the owner or licensee in the most expedient time possible, and no later than forty-five calendar days after discovering the breach.

Any person that is licensed to maintain or possess computerized data containing personal identifying information of a New Mexico resident that the person does not own or license shall notify the owner or licensee of the information of any security breach in the most expedient time possible, but not later than forty-five calendar days following discovery of the breach,

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.