06-03-2025
Legislative committee advances privacy bill aimed at protecting consumers
Mar. 5—One app to talk to friends in another country, another to clock in at work or pay for the laundry machine at an apartment complex — the ubiquity of internet services is growing ever more. So, too, is the personal data shared freely across the web.
While skimming through a long terms of service agreement might not cause the average user much heartburn, the information being shared or misused just might — especially concerning data about a person's health or children.
One bill making its way through the New Mexico Legislature seeks to address that problem.
House Bill 410, the Consumer Information and Data Protection Act, would align New Mexico with similar laws in 22 other states.
According to the bill's sponsor, Rep. Linda Serrato, D-Santa Fe, it also gives the New Mexico Department of Justice more teeth in punishing bad actors. Serrato said the time to pass this legislation was now because law enforcement can do little to help people when their data is compromised.
"It really leaves all New Mexicans vulnerable to the fact that we can't protect our data," Serrato said during the first of two hearings in the House Commerce and Economic Development Committee.
After the bill was amended, the committee passed the bill on an 8-0 vote during a March 3 hearing, sending it to the House Judiciary Committee for review.
Serrato told the Journal the enforcement component was among the bill's most important changes. The Consumer Information and Data Protection Act gives the attorney general the power to investigate and fine businesses out of compliance, she added.
If passed, businesses could not sell or offer to sell consumer health data without first obtaining consent. They also cannot share health data with employees or contractors unless confidentiality agreements bind those individuals.
Additionally, businesses cannot use deceptive or manipulative user interface designs that make it harder for consumers to exercise their data rights, such as pre-ticked boxes, unclear language and no reject button. They also cannot ignore or delay consumer requests to access, correct or delete personal data, opt out of data processing for targeted advertising or profiling, or obtain a copy of their data.
Restrictions would also apply to geofencing, a targeted marketing practice that sends tailored advertising to people when they enter a geographic area or, more specifically, mental health, reproductive health or sexual health facilities.
Lastly, the bill would require businesses to use assessments to ensure that data is processed in compliance with the law. Serrato noted that this was a piece that other states do not have.
The bill would not apply to nonprofit groups and colleges. It would only affect businesses that handle the data of at least 35,000 consumers or have processed data from at least 10,000 consumers and made over 20% of their total income from selling personal data.
Most of the bill components are standard among the 22 states with similar laws. But for critics of the bill, that's exactly the problem.
Caitriona Fitzgerald, a national advocate for data privacy, testified that measures like this around the U.S. don't go far enough.
"They do little to change the status quo of companies being able to collect and use personal data however they like as long as they tell us what they are doing in a privacy policy that nobody reads," Fitzgerald said.
Fitzgerald's organization, the Electronic Privacy Information Center, sent a letter to the House Commerce and Economic Development Committee denouncing the bill.
"The bill seeks to provide to New Mexico consumers the right to know the information companies have collected about them, the right to access, correct and delete that information, as well as the right to stop the disclosure of certain information to third parties," the letter said. "However, in its current form it would do little to protect New Mexico consumers' personal information, or to rein in major tech companies like Google and Facebook."
The letter also called for stronger protections, something Serrato described as unrealistic.
When asked if she thought there would be enough time for the bill to pass through both houses before the session's end, Serrato said she's optimistic the bill will pass.
