New Mexico Becomes 48th State To Enact Data Breach Statute

Recently the state of New Mexico enacted the Data Breach Notification Act, making it the 48th state in the United States to enact a statute requiring notice to individuals impacted by a data breach. In doing so, New Mexico follows some trends we've been predicting at the state level. These trends include covering encrypted data in the definition of personal information if the encryption key is accessed as well, and – importantly – requiring that companies engage in reasonable security measures to protect personal information in their possession. New Mexico also joins a handful of states that protect biometric information as personal information.

Here are some other highlights:

• Companies subject to the data breach notice requirements of GLBA and HIPAA are exempt;