New Mexico Becomes 48th State To Enact Data Breach Notification Law

On April 6, 2017, New Mexico became the 48th state to enact a data breach notification law, leaving Alabama and South Dakota as the only two states without such a law. The New Mexico law goes into effect June 16, 2017.

Who Is Covered? Defining "Personal Identifying Information"

The new law applies to any "person that owns or licenses elements that include personal identifying information of a New Mexico resident[.]" The definition of "personal identifying information" largely tracks the definitions adopted by sister states, and includes an individual's first name or first initial and last name in combination with one or more of the following data elements, when such data elements "are not protected through encryption or redaction or otherwise rendered unreadable or unusable:"