New Hampshire’s New Law is on the Books

2023 was a record-breaking year, with legislators in Delaware, Indiana, Iowa, Montana, Oregon, Tennessee and Texas passing comprehensive data privacy laws, joining California, Colorado, Connecticut, Utah and Virginia. Already 2024 is on pace to beat 2023’s record year, as New Hampshire (New Hampshire Privacy Act, SB 255-FN), New Jersey (New Jersey Privacy Act, SB 332) and Kentucky (HB 15) lawmakers have already passed comprehensive privacy laws.

This post will provide the details and information you and your business need to know about the New Hampshire Privacy Act (NHPA), signed into law by Governor Sununu in March. 

Applicability Criteria

The NHPA applicability criteria mirrors the Virginia law and applies to any business or person that produces products or services that are targeted to residents of New Hampshire, and either: (i) controls or processes the personal data of at least 35,000 unique New Hampshire consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (ii) controls or processes the personal data of at least 10,000 unique New Hampshire consumers and derives more than 25% of its gross revenue from the sale of personal data. In passing this law, New Hampshire becomes the first state to add the “unique” descriptor to consumers in this context (though most practitioners have read this qualifying language into other state privacy laws.

The notion of “consumer” as used in the NHPA means an individual who is a resident of New Hampshire. It does not include individuals acting in a commercial or employment context. This important distinction is the predominant approach we are seeing adopted by the states, with the notable exception being California.

Exemptions

The NHPA does not apply to:

• New Hampshire government entities (or of any political subdivision of New Hampshire)
• Financial institutions and affiliates, or data subject to the federal GLBA
• National securities associations registered under the Exchange Act
• Covered entities or business associates governed by certain rules under HIPAA
• Nonprofit organizations
• Institutions of higher education
• Public utilities or service companies affiliated with a public utility
• Certain research data or employment-related information; and
• Information governed by federal laws, such as HIPAA, Driver’s Privacy Protection Act, the Airline Deregulation Act, the Controlled Substances Act, the Family Educational Rights and Privacy Act, the Fair Credit Reporting Act or the Farm Credit Act

Consumer Rights

Consumers who are New Hampshire residents will be able to exercise the following rights under the NHPA:

• Right to confirm whether or not their personal data is processed (unless such confirmation or access would require the controller to reveal a trade secret)
• Right to access their personal data
• Right to correct inaccuracies in their personal data (limited to data the consumer previously provided)
• Right to deletion of their personal data
• Right to portability of their personal data
• Right to opt-out of the processing of their personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling through automated means

Business Obligations to Consumers

The NHPA looks a lot like the business-friendly regulation enacted in Virginia two years ago, Here are some of the compliance obligations on the horizon for those businesses:

• Respond to consumer requests under the NHPA without undue delay, but not later than 45 days of receipt of such request (may be extended an additional 45 days when reasonably necessary so long as the controller notifies the consumer of their intent to extend)
• Provide required information to consumers free of charge, once per twelve-month period