iOn March 6, 2024, Governor Chris Sununu signed into law SB 255, making New Hampshire the 15th state with a comprehensive privacy law.
Applicability
SB 255 applies to persons that “conduct business” in New Hampshire (“NH”) or persons that “produce products or services that are targeted to residents of” NH that, in the period of a year: (1) “controlled or processed the personal data of not less than 35,000 unique consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or” (2) “controlled or processed the personal data of not less than 10,000 unique consumers and derived more than 25 percent of their gross revenue from the sale of personal data.” The lower thresholds appear to be reflective of NH’s smaller state population. The thresholds are closer to those of, e.g., Delaware’s Personal Data Privacy Act (H.B. 154) (the “DPDPA”), rather than those of larger states such as Virginia and Colorado.
SB 255’s protections apply to NH residents acting outside of a commercial or employment context. These exemptions are found in almost every other comprehensive state privacy to date, with the notable exception of California.
Controller Obligations
Similar to most of the comprehensive state privacy laws, SB 255 contains fundamental data minimization, purpose limitation and data protection requirements. According to the final version of the bill, SB 255 requires controllers to limit the collection of personal data to what is “adequate, relevant and reasonably necessary” with respect to the purposes for which the data is processed and as described in the controllers’ privacy notices. Controllers are prohibited from using the data “for purposes that are neither reasonably necessary to, nor compatible with” those original purposes. SB 255 also requires controllers to implement “reasonable administrative, technical and physical data security practices to protect the confidentiality, integrity and accessibility of personal data,” taking into consideration the volume and nature of that data.
Further, SB 255 requires controllers’ privacy notices to be “reasonably accessible, clear and meaningful” and to meet the standards established by the secretary of state. According to the final version of the bill, this privacy notice should include: (1) the categories of personal data processed by the controller; (2) the purpose for processing personal data; (3) how consumers may exercise their consumer rights, including how to appeal a controller’s decision with regard to their request; (4) the categories of personal data that the controller shares with third parties, if any; (5) the categories of third parties, if any, with which the controller shares personal data; and (6) an active email address or other online mechanism by which to contact the controller.
Similar to almost all of the recently enacted comprehensive state privacy laws, the final version of SB 255 also requires controllers to perform data protection assessments for every processing activity that “presents a heightened risk of harm to a consumer.” The types of processing that present a heightened risk of harm, according to SB 255, mirror most of the other recent laws, including (1) the processing of sensitive data; and the processing of personal data for: (2) the purposes of targeted advertising; (3) the sale of personal data; (4) the purposes of profiling. Profiling carries a heightened risk of harm where the profiling presents a reasonably foreseeable risk of:
- unfair or deceptive treatment of consumers;
- unlawful disparate impact on consumers;
- financial, physical or reputational injury to consumers; and
- a physical or other intrusion upon the solitude, seclusion, or private affairs or concerns of consumers, in all cases where such intrusion would be offensive to a reasonable person.
Heightened risk also includes a reasonably foreseeable risk of other substantial injury to consumers.
Consumer Rights
SB 255 provides consumers with the same rights as almost all of the recently enacted state comprehensive privacy laws. California’s opt-out rights are slightly different than the majority of the states. These rights include:
- access: the right to confirm whether a controller is processing the consumer’s personal data and the right to access that personal data;
- correction: the right to rectify inaccuracies in the consumer’s personal data;
- deletion: the right to delete personal data provided by, or obtained about, the consumer;
- portability: the right to obtain a copy of the consumer’s personal data processed by the controller, in a portable and usable format; and
- opt-outs: the right to opt out of the processing for purposes of targeted advertising, sale, or profiling based on solely automated decisions that produce legal or similarly significant effects concerning the consumer.
As with the other state privacy laws, the consumer data rights are not absolute and there are various exceptions and limitations, including the exception to access and/or portability where the controller would have to reveal a trade secret.
A controller has 45 days to respond to a consumer rights request with a potential 45-day extension in circumstances where an extension is “reasonably necessary.” The controller must inform the consumer of an extension within the initial 45-day response period and explain the reason for the extension. These timeframes are similar to most of the other state privacy laws.
Enforcement
SB 255 does not contain a private right of action and would be enforced exclusively by the New Hampshire Attorney General. The NH legislature has reportedly allotted the state’s consumer protection division additional funds to support the enforcement of the law. The bill provides for a 60-day cure period, similar to many of the other comprehensive state privacy laws, however, there is a one-year sunset period on the broad right to cure provisions (as of January 1, 2026), where the Attorney General is free to consider the circumstances of a particular violation in determining whether it is appropriate to allow for the opportunity to cure.
Rulemaking
SB 255 provides a narrow rulemaking authority, unlike Colorado’s and California’s privacy laws, which set out broad rulemaking provisions. Rulemaking in SB 255 is currently limited to provisions for the secretary of state to establish requirements for privacy notices.
Effective Date
SB 255 is set to take effect on January 1, 2025.
