Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party collaboration tools that collect personal information in New Mexico? What are the requirements?

Use of Third-Party Collaboration Tools in New Mexico

If you are using third-party collaboration tools that collect personal information in New Mexico, you must comply with the state’s laws and regulations regarding the use and protection of personal identifying information.

Personal Identifying Information

Under New Mexico law, personal identifying information (PII) is defined as “information that identifies an individual, including the individual’s name, social security number, driver’s license number, government-issued identification number, account number, credit or debit card number, passport number, biometric data, or any other unique identifier” [1.1][1.3].

Security Measures

If you disclose PII of a New Mexico resident to a service provider, you must require the service provider to implement and maintain reasonable security procedures and practices appropriate to the nature of the PII to protect it from unauthorized access, destruction, use, modification, or disclosure [1.1].

If you own or license PII of a New Mexico resident, you must implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect it from unauthorized access, destruction, use, modification, or disclosure [1.3].

Use of Social Security Numbers

New Mexico law restricts the use of social security numbers (SSNs) by businesses. Businesses are prohibited from making the entirety of an SSN available to the general public, requiring the use of an SSN over the internet without a secure connection or encryption security, printing an SSN on materials mailed to a consumer unless authorized or required by federal or state law, transmitting material that associates an SSN with an account number for a bank, savings and loan association, or credit union, or refusing to transact business because of a refusal to provide an SSN for use of that number in a manner prohibited by the law [3.1].

Disposal of Personal Identifying Information

If you own or license records containing personal identifying information of a New Mexico resident, you must arrange for proper disposal of the records when they are no longer reasonably needed for business purposes. Proper disposal means shredding, erasing, or otherwise modifying the personal identifying information contained in the records to make the personal identifying information unreadable or undecipherable [1.2].

Conclusion

To use third-party collaboration tools that collect personal information in New Mexico, you must comply with the state’s laws and regulations regarding the use and protection of personal identifying information. You must require service providers to implement and maintain reasonable security procedures and practices appropriate to the nature of the PII, implement and maintain reasonable security procedures and practices appropriate to the nature of the information if you own or license PII, comply with the restrictions on the use of SSNs, and arrange for proper disposal of records containing personal identifying information when they are no longer reasonably needed for business purposes.

Source(s):
Jurisdiction

New Mexico