Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I skip obtaining consent to sell personal information in New Mexico? What are the requirements?

Based on the provided context documents, you cannot skip obtaining consent to sell personal information in New Mexico.

Requirements for selling personal information in New Mexico

According to the New Mexico Statutes Annotated, Section 57-12C-4, a person that owns or licenses personal identifying information of a New Mexico resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal identifying information from unauthorized access, destruction, use, modification or disclosure. Additionally, Section 57-12C-3 requires that a person that owns or licenses records containing personal identifying information of a New Mexico resident shall arrange for proper disposal of the records when they are no longer reasonably needed for business purposes. As used in this section, “proper disposal” means shredding, erasing or otherwise modifying the personal identifying information contained in the records to make the personal identifying information unreadable or undecipherable.

Exemptions

However, it is important to note that the State of New Mexico and political subdivisions are exempted from the Data Breach Notification Act [1.4].

Additional Requirements

According to [2.1], all electronic access to vehicle registration, driver’s license or other data collected and maintained by the department pursuant to the Motor Vehicle Code that contains “personal information” must utilize a data delivery system that meets the minimum requirements established by the department. The department may also require any person outside the department seeking electronic access to vehicle registration, driver’s license or other data collected and maintained by the department pursuant to the Motor Vehicle Code that contains “personal information” to sign a written agreement regarding minimum technical requirements, the segregation and, where appropriate, suppression of personal information and creation of audit reports and other information so that the department may verify compliance with the requirements agreed to.

According to [1.3], a person that discloses personal identifying information of a New Mexico resident pursuant to a contract with a service provider shall require by contract that the service provider implement and maintain reasonable security procedures and practices appropriate to the nature of the personal identifying information and to protect it from unauthorized access, destruction, use, modification or disclosure.

According to [3.1], unless the person in charge of the premises so consents in writing, regulations shall not extend to financial data; pricing data; or sales data other than shipping dates.

According to [4.2], the governing authority of each state agency, local public body, school district and state educational institution may dispose of any item of tangible personal property belonging to that authority and delete the item from its public inventory upon a specific finding by the authority that the item of property is of a current resale value of five thousand dollars ($5,000) or less and worn out, unusable or obsolete to the extent that the item is no longer economical or safe for continued use by the body.

Therefore, if you are not a state agency or political subdivision, you must comply with the requirements for selling personal information in New Mexico, including obtaining consent and implementing reasonable security procedures and practices appropriate to the nature of the information to protect the personal identifying information from unauthorized access, destruction, use, modification or disclosure.

Source(s):
Jurisdiction

New Mexico