Bill > SB192

This bill, known as the Data Broker Privacy Act, establishes regulations for "data brokers," which are defined as entities that collect and sell personal information of New Mexico residents to third parties without a direct relationship with those individuals, with exceptions for entities covered by federal laws like the Fair Credit Reporting Act and the Gramm-Leach-Bliley Act. The act requires data brokers to register with the Economic Development Department, pay a registration fee to a newly created "data broker privacy fund," and disclose specific details about their data collection practices, including whether they collect sensitive information like that of minors, precise geolocation data, or reproductive health data, and provide consumers with clear instructions on how to exercise their privacy rights without using "dark patterns," which are deceptive user interface designs. Furthermore, data brokers must implement an accessible deletion mechanism, allowing consumers to request the removal of their personal information, and report annually on the number of deletion requests received and processed, as well as the time taken to respond. The bill also mandates that data brokers delete personal information at least every forty-five days after a deletion request and refrain from selling or sharing new personal information of a consumer who has made such a request, with penalties for non-compliance including daily fines and reimbursement of departmental expenses, and sets an effective date of July 1, 2026.

https://www.nmlegis.gov/Legislation/Legislation?chamber=S&legtype=B&legno=192&year=26