Bill > HB1694

This bill requires data brokers operating in New Hampshire to register annually with the secretary of state, creating a comprehensive framework for personal data protection and consumer privacy. Specifically, the bill defines a data broker as a controller or processor that knowingly collects, aggregates, or sells personal data of state residents without a direct business relationship, and who derives more than 25 percent of their gross revenue from selling personal data. Registered data brokers must pay a $300 registration fee and provide detailed information about their data collection practices, including the categories of data processed, security breaches experienced, and policies regarding children's data. The secretary of state will establish an online, searchable registry of these data brokers and create an online portal that allows individuals to request copies of their data, request deletion, and opt-out of future data processing. Data brokers must develop and maintain a comprehensive information security program with specific safeguards, including employee training, risk assessment, encryption protocols, and monitoring systems. The bill also establishes civil penalties for violations, with fines up to $10,000 per year, and considers violations to be deceptive trade practices. Notably, the bill provides consumers with expanded rights to control their personal data, such as the ability to opt-out of data processing for any purpose, and requires data brokers to confirm data deletion or opt-out requests within 15 days. The law is set to take effect on January 1, 2027.

Justice

https://gc.nh.gov/bill_Status/billinfo.aspx?id=1817&inflect=2