Bill > HB410

This bill establishes the Consumer Information and Data Protection Act, which creates comprehensive regulations for how businesses collect, process, and protect personal data in New Mexico. The bill defines key terms like personal data, sensitive data, and consumer rights, and establishes a framework requiring businesses (called "controllers") to obtain consumer consent before processing certain types of data, limit data collection to what is necessary, and provide clear privacy notices. Consumers gain specific rights, including the ability to access, correct, delete, and opt out of data processing for targeted advertising or sales. The law applies to businesses operating in New Mexico or targeting New Mexico residents, with several exemptions for entities like government agencies, financial institutions, healthcare providers, and nonprofit organizations. Controllers must implement reasonable data security practices, cannot discriminate against consumers who exercise their rights, and are prohibited from using "dark patterns" to manipulate consent. The Attorney General has exclusive enforcement authority, with the ability to issue investigative demands and impose civil penalties of up to $10,000 per violation, but the law does not create a private right of action for consumers to sue directly. Notably, the bill includes special protections for children's data and sensitive information like health data, requiring additional consent and limiting processing purposes.