Bill would require data brokers to register and process deletion requests

Data brokers would have to register with the Economic Development Department and pay a registration fee. A data broker is a person who knowingly collects and sells personal information about a New Mexico consumer without a direct relationship with that consumer. Federal credit reporting and financial privacy laws exclude people to the extent those laws cover them. The fee could not exceed the reasonable costs of the department's website and deletion system.

Data brokers would have to report yearly deletion-request counts and response times in their privacy policies. The report covers requests made under the proposed deletion process, including requests granted in full or in part and denied requests. Brokers would have to give reasons for requests denied because they could not be verified, came from someone who was not a consumer, sought information exempt from deletion, or were denied for another reason. By July 1 each year, brokers would report figures for the previous calendar year.

The department would have to provide an online system for consumers to ask data brokers to delete personal information. Brokers would have to process eligible requests and tell their service providers and contractors to delete the information. The system would cover personal information about New Mexico consumers held by data brokers and their associated service providers or contractors. Consumers could leave out specific brokers, use an authorized agent, and change a previous request after at least 45 days. The system would be free to consumers and usable in any language spoken by a consumer whose information brokers collected, and by consumers with disabilities. After deleting a consumer's information, a broker would have to delete that consumer's information at least every 45 days and could not sell or share new information about the consumer unless the consumer asked otherwise. Brokers would have 45 days after receiving a request to act. Beginning January 1, 2028, they would have to undergo an independent compliance audit every three years.

The department could seek administrative fines and costs from data brokers that fail to register or delete information as required. The penalties would apply to a data broker's failure to register or delete personal information as required. The department would have to bring an administrative action. A broker could owe a $200 fine for each day of failure, registration fees due during its unregistered period, and the department's investigation costs.