New Mexico recently became the 48th state to enact a data breach notification law.  This continues the accelerated pace of state data breach legislative activity in the last two years.  Since 2015, at least 41 states have considered legislation relating to data security incidents, and at least 16 states have enacted or amended such laws.

Among the most significant aspects of New Mexico’s brand new “Data Breach Notification Act” is its definition of “Personal Identifying Information.”  The Act follows a growing state trend by including “biometric data” in its definition of “personal identifying information.  In addition, “security breach” is defined as the acquisition of—but not mere access to—unencrypted computerized data or encrypted data if the encryption key is also acquired.  The Act contains an exemption from the requirement to provide notice within 45 calendar days after discovery of the breach for persons subject to the Gramm-Leach-Bliley Act or the Health Insurance Portability and Accountability Act of 1996.

For more information on the new law, see our legal alert.