Thirteen years after the first state data breach notification
law was enacted, New Mexico has finally decided to join the other
47 states with such laws, sending HB15 in mid-March to Gov. Susana
Martinez for signature.
New Mexico's data breach law makes two notable departures
from the laws in 47 other states. First, and what is perhaps the
biggest step from the statutory norm, is its timeline. HB15 states
that "[n]otification shall be made in the most expedient time
possible, but not later than forty-five calendar
days following discovery of the security breach."
Currently, Florida is the only state with a stricter (30-day
deadline) but that state allows for a 15-day extension for good
cause. There are only a handful of other states that have the same
45-day deadline. Second, New Mexico defines "security
breach" as the "unauthorized acquisition
of unencrypted computerized data" (emphasis
added). This narrows the scope of the legislation beyond some of
the other
