Data Privacy Interactive Map - New Hampshire

Highlights

Covered Entities: Any person, business, government entity doing business in this state who owns or licenses computerized data that includes personal information. A “person” includes any individual, corporation, trust, partnership, incorporated or unincorporated association, limited liability company, or other form of entity, or any agency, authority, board, court, department, division, commission, institution, bureau, or other state governmental entity, or any political subdivision of the state.

Consumer Notification: When a covered entity becomes aware of a breach and they “promptly determine the likelihood the information has been or will be misused.” If PI has been, is reasonably likely to be misused, or it cannot be determined, the entity “shall notify the affected individuals as soon as possible….”

Regulatory Notification: Must notify New Hampshire Attorney General if one person in New Hampshire is notified.

Notification Timeline: “As soon as possible…”

Data Format: Electronic

Citations: N.H. Rev. Stat. §§ 359-C:19-21

More Details

Definitions:

• Breach: “unauthorized acquisition of computerized data from compromises the security or confidentiality of personal information” except for a good faith acquisition of that data.
• Personal Information (PI):  First name or initial and last name in combination with any one or more of the following data elements when either the name or data elements are unencrypted:
  • Social Security number;
  • Driver’s License number or other government identification number;
  • Account number, credit card number, or debit card number in combination with a code or password allowing access to an individual’s financial account; or
  • Personal information does not include public data gathered from federal, state, or local government records.

Safe Harbors:

• Encryption: Personal information that is encrypted is not subject to notification, so long as the encryption keys were not also acquired and “would permit access to the encrypted data.”
• Good Faith: When PI is acquired by an employee or agent of a person for “the purposes of the person’s business” so long as that PI is “not used or subject to further unauthorized disclosure.”
• Risk of Harm: There is no notification required if the entity can promptly determine it is reasonably unlikely that personal “information has been or will be misused.”
• Law Enforcement Delay: May delay reporting if “a law enforcement agency, or national or homeland security agency determines that the notification will impede a criminal investigation or jeopardize national or homeland security.”
• Public Record: Personal information does not include information that is lawfully made available to the general public from federal, state, or local government records.
• Compliance: Certain finance-related covered entities subject to N.H. RSA § 358-A:3(I) that maintain and comply with procedures for security breach notification under other laws, rules, regulations, guidance, or guidelines issued by a state or federal regulator will be deemed in compliance with the data breach notification law. The section also does not apply to any financial institution subject to Title V of the Gramm, Leach-Bliley Act.

Direct Notice:

• Timing: “As soon as possible”
• Format: N/A
• Content:
  • General description of the incident
  • Approximate date of the breach
  • Personal information obtained from the breach
  • Telephonic contact information of the covered entity reporting the breach
• Method:
  • Written
  • Electronic, if the affected entity’s “primary means of communication” with impacted individuals is electronic
  • Telephonic, provided a log is kept of the notification

Substitute Notice:

If the cost of noticing affected individuals exceeds $5,000 or it is more than 1,000 people, or there is not “sufficient contact information or consent to provide” written, electronic, or telephonic notice then may provide substitute notice by the doing all the below:

• Email notice when an email address is known
• Conspicuous website posting
• “Notification to major statewide media”
• Notification pursuant to international procedures set up in “an information security policy for the treatment of personal information”

Remediation Services:

N/A

Regulatory Notice:

Notification to include “anticipated date of the notice to the individuals and the approximate number of individuals” in New Hampshire who will be notified.

Credit Reporting Agencies Notice:

If more than 1,000 consumers are notified, the entity “shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis” of the anticipated date consumer will be notified, approximately how many will be notified, and the content of the notification. This does not apply if the entity is subject to GLBA.

Third-Party Notice:

Any person or business that maintains computerized data that includes personal information that the person or business does not own shall notify and cooperate with the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was acquired by an unauthorized person. Cooperation includes sharing with the owner or licensee information relevant to the breach; except that such cooperation shall not be deemed to require the disclosure of confidential or business information or trade secrets.

HIPAA:

N/A

Private Action:

Yes, any person injured by a violation may bring an action for damages and equitable relief. If successful, plaintiffs may recover actual damages. If the violation was willful or knowing, a court may award no less than 2 and no more than 3 times the amount of actual damages. A successful plaintiff may also be awarded attorney’s fees and costs.

Associated Regulations:

• Insurance Data Security (N.H. Rev. Stat. §§ 420-P:1 - 420-P:14)

Highlights

Covered Entities (Licensee): Any entity licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered pursuant to the insurance laws of this state but shall not include a purchasing group or a risk retention group chartered and licensed in a state other than this state or a person that is acting as an assuming insurer that is domiciled in another state or jurisdiction.

Security Standard: Each licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment; the program must contain administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system. The information security program shall be commensurate with the size and complexity of the licensee, the nature and scope of the licensee's activities, including its use of third-party service providers, and the sensitivity of the nonpublic information used by the licensee or in the licensee's possession, custody, or control. The insurer will annually submit to the insurance commissioner a written statement certifying compliance.

Consumer Notification: A licensee shall notify consumers by complying with RSA 359-C:20V, and VI, I(a) and (c), II-I, which requires notification “as soon as possible”, and providing a copy of the notice sent to consumers under that statute to the commissioner, when a licensee is required to notify the commissioner

Regulatory Notification: A licensee shall notify the commissioner within 3 business days that a cybersecurity event has occurred if the licensee is domiciled in NH and the incident has a reasonable likelihood of materially harming a consumer or reasonably believes more than 250 residents are affected and the incident impacts the licensee or is reasonably likely of materially harming state residents or material parts of the licensee’s normal operations.

Notification Timeline: The licensee must notify the Commissioner within three business days of a cybersecurity event, and must notify consumers “as soon as possible” per N.H. Rev. Stat. §§ 359-C:20(I)(a)

Citations: N.H. RSA §§ 420-P:1 to 420-P:14

More Details

Definitions:

• Consumer: An individual, including, but not limited to, an applicant, policyholder, insured, beneficiary, claimant, and certificate holder, who is a resident of this state and whose nonpublic information is in a licensee's possession, custody, or control.
• Cybersecurity Event: An event resulting in unauthorized access to, disruption or misuse of, an information system or nonpublic information stored on such information system. The term shall not include: (i) the unauthorized acquisition of encrypted nonpublic information if the encryption, process, or key is not also acquired, released, or used without authorization; and/or (ii) the nonpublic information accessed by an unauthorized person has not been used or released and has been returned or destroyed.
• Third-party service provider: An entity, not otherwise defined as a licensee, that contracts with a licensee to maintain, process, store or otherwise is permitted access to nonpublic information through its provision of services to the licensee.
• Nonpublic Information: Information that is not publicly available information and is:
  
  • Any information concerning a consumer which because of name, number, personal mark, or other identifier can be used to identify such consumer, in combination with any one or more of the following data elements:
    
    • Social Security number;
    • Driver’s license number or non-driver identification card number;
    • Financial account number, credit or debit card number;
    • Any security code, access code, or password that would permit access to a consumer’s financial account; or
    • Biometric records.
  • Any information or data, except age or gender, in any form created by or derived from a health care provider or a consumer, that can be used to identify a particular consumer, and that relates to:
    
    • The past, present, or future physical, mental or behavioral health or condition of any consumer or a member of the consumer’s family;
    • The provision of health care to any consumer; or
    • Payment for the provision of health care to any consumer.
• Publicly available information: any information that a licensee has a reasonable basis to believe is lawfully made available to the general public from: federal, state, or local government records; widely distributed media; or disclosures to the general public that are required to be made by federal, state, or local law. For the purposes of this paragraph, a licensee has a reasonable basis to believe that information is lawfully made available to the general public if the licensee has taken steps to determine:
  
  • That the information is of the type that is available to the general public; and
  • Whether a consumer can direct that the information not be made available to the general public and, if so, that such consumer has not done so.

Regulatory Notice:

A licensee shall notify the commissioner within 3 business days of a determination that a cybersecurity event has occurred, when either of the following criteria has been met:

• New Hampshire is the licensee's state of domicile, in the case of an insurer, or this state is the licensee's home state, in the case of a producer, as those terms are defined in RSA 402-J, and the cybersecurity event has a reasonable likelihood of materially harming a consumer residing in this state or reasonable likelihood of materially harming any material part of the normal operations of the licensee; or
• The licensee reasonably believes that the nonpublic information involves 250 or more consumers residing in New Hampshire and that the cybersecurity event:
  
  • Impacts the licensee, in which case notice shall be provided to any government body, self-regulatory agency, or any other supervisory body pursuant to any state or federal law; or
  • Has a reasonable likelihood of materially harming any consumer residing in this state or any material part of the normal operations of the licensee.

Content Requirements:

The licensee shall provide as much of the following information as possible. The licensee shall provide the information in electronic form as directed by the commissioner. The licensee shall have a continuing obligation to update and supplement initial and subsequent notifications to the commissioner regarding material changes to previously provided information relating to the cybersecurity event.

• Date of the cybersecurity event.
• Description of how the information was exposed, lost, stolen, or breached, including the specific roles and responsibilities of third-party service providers, if any.
• How the cybersecurity event was discovered.
• Whether any lost, stolen, or breached information has been recovered and, if so, how this was done.
• The identity of the source of the cybersecurity event.
• Whether the licensee has filed a police report or has notified any regulatory, government, or law enforcement agencies and, if so, when such notification was provided.
• Description of the specific types of information acquired without authorization. Specific types of information means particular data elements including, for example, types of medical information, types of financial information, or types of information allowing identification of the consumer.
• The period during which the information system was compromised by the cybersecurity event.
• The number of total consumers in this state affected by the cybersecurity event. The licensee shall provide the best estimate in the initial report to the commissioner and update this estimate with each subsequent report to the commissioner pursuant to this section.
• The results of any internal review identifying a lapse in either automated controls or internal procedures, or confirming that all automated controls or internal procedures were followed.
• Description of efforts being undertaken to remediate the situation which permitted the cybersecurity event to occur.
• A copy of the licensee's privacy policy and a statement outlining the steps the licensee will take to investigate and notify consumers affected by the cybersecurity event.
• Name of a contact person who is both familiar with the cybersecurity event and authorized to act for the licensee.

Third-Party Notice Requirements:

In the case of a cybersecurity event in a system maintained by a third-party service provider, of which the licensee has become aware, the licensee shall treat such event as though it experienced the cybersecurity event itself and must notify individuals and the insurance commissioner, unless the third-party service provider provides the notice required to the commissioner.

Penalties:

The commissioner shall have power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of this chapter. This is in addition to the commissioner’s powers under RSA 400-A:16 and RSA 400-A:37. Additionally, whenever the commissioner has reason to believe that a licensee has been or is engaged in conduct in this state which violates this chapter, the commissioner may take action that is necessary or appropriate to enforce the provisions of this chapter.

Any other licensee may be subject to the suspension or revocation of the license or certificate of authority of the licensee or, in lieu thereof and at the discretion of the Commissioner, subject to a fine of up to $10,000 per violation.

Associated Regulations:

N/A

N.H. RSA §§ 507-H:1 to 507-H:12

Highlights

Applicability:

The New Hampshire Data Privacy Act (“NHDPA”) applies to persons that conduct business in New Hampshire or persons that produce products or services that are targeted to New Hampshire residents that, during a one-year period:

• Controlled or processed the Personal Data of not less than 35,000 unique consumers, excluding Personal Data controlled or processed solely for the purpose of completing a payment transaction; or
• Controlled or processed the Personal Data of not less than 10,000 unique consumers and derived more than 25% of their gross revenue from the sale of Personal Data.

However, certain entities are excluded from the scope of the NHDPA. Among other exclusions, the act excludes state and local governmental agencies, nonprofit organizations, institutions of higher education, registered national securities associations, financial institutions subject to the Gramm-Leach-Bliley Act (“GLBA”), and covered entities and business associates as defined and governed by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act. The NHDPA also excludes certain categories of information, such as protected health information under HIPAA, data subject to the GLBA, patient identifying information, and information regulated by the Health Care Quality Improvement Act of 1986, the Patient Safety and Quality Improvement Act, the Fair Credit Reporting Act, the Driver’s Privacy Protection Act of 1994, the Family Educational Rights and Privacy Act, and the Farm Credit Act of 1971, as well as employment-related data and business-to-business data.

Controller Obligations:

• Limit the collection of Personal Data to what is adequate, relevant, and reasonably necessary to the purposes for which the data is processed as disclosed to the consumer.
• Refrain from processing Personal Data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes for which the Personal Data is processed as disclosed to the consumer, unless the Controller obtains the consumer's consent.
• Establish, implement, and maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the Personal Data at issue to protect the confidentiality, integrity, and accessibility of Personal Data.
• Not process Personal Data in violation of New Hampshire and federal laws that prohibit unlawful discrimination against consumers and not discriminate against consumers who exercise such rights.
• Not process Sensitive Data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of Sensitive Data collected from a known child, process the data in accordance with the federal Children's Online Privacy Protection Act.
• Provide a mechanism for a consumer to revoke the consumer’s consent that is at least as easy as the mechanism by which the consumer provided the consumer’s consent and, upon revocation of the consent, cease to process the data as soon as practicable but not later than 15 days after the receipt of the request.
• Refrain from processing the Personal Data of a consumer for targeted advertising or the sale of Personal Data without the consumer’s consent when the Controller has actual knowledge or willfully disregards that the consumer is at least 13 years old but younger than 16 years old.
• Provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes the categories of Personal Data processed by the Controller, the purpose for processing Personal Data, how consumers may exercise their consumer rights including how a consumer may appeal a Controller's decision with regard to the consumer's request, the categories of Personal Data that the Controller shares with third parties, if any, the categories of third parties, if any, with whom the Controller shares Personal Data, an email address of other online mechanism that a consumer may use to contact the Controller, and the date the privacy notice was last updated.
• If a Controller sells Personal Data to third parties or processes Personal Data for targeted advertising, the Controller shall clearly and conspicuously disclose such activity, as well as the manner in which a consumer may exercise the right to opt out of processing.
• Establish and describe in a privacy notice, one (1) or more secure and reliable means for consumers to submit a request to exercise their consumer rights, including providing a clear and conspicuous link on the Controller’s website to a webpage that allows a consumer to opt-out of targeted advertising or sale of Personal Data through an opt-out preference signal.
• Conduct and document a data protection impact assessment of certain types of processing activities involving Personal Data that present a heightened risk of harm to consumers, such as for:

• • Targeted advertising.
  • Selling Personal Data.
  • Profiling that presents a reasonably foreseeable risk of: unfair or deceptive treatment of or unlawful disparate impact on consumers; financial, physical, or reputational injury to consumers; a physical or other intrusion on consumers' solitude, seclusion, private affairs, or private concerns, if it would offend a reasonable person; or another substantial consumer injury.
  • Processing Sensitive Data.
• Act on and respond to consumers’ requests to exercise their Personal Data rights.
• If a Controller possesses de-identified data, take reasonable measures to ensure the data cannot be associated with an individual, publicly commit to maintaining and using de-identified data without attempting to reidentify the data, and contractually obligate any recipients of the deidentified data.

Consumer Rights:

A Controller must respond without undue delay and within forty-five (45) days to verified consumer requests regarding the processing of Personal Data and Sensitive Data, including consumers’:

• Right to know and access Personal Data;
• Right to correct inaccurate Personal Data;
• Right to request deletion of Personal Data;
• Right to obtain Personal Data in a format that is generally portable, readily usable, and transmittable;
• Right to opt out of Personal Data sales, targeting advertising, and profiling for decisions producing legal or other similarly significant effects concerning the consumer.
• Right to non-discrimination for exercising their consumer rights.

Additionally, a Controller shall establish a process for the consumer to appeal the Controller’s refusal to take action on a request. The appeal process must be made conspicuously available and similar to the process for submitting requests to initiate action. The Controller is required to inform the consumer in writing of any action taken or not taken in response to the appeal within sixty (60) days of receipt of an appeal and include a written explanation of the reasons for the decisions. If the appeal is denied, the Controller must also provide an online mechanism, if available, for the consumer to contact the Attorney General to submit a complaint.

More Details

Definitions:

• Consumer: An individual who is a New Hampshire resident. Consumer does not include an individual acting in a commercial or employment context.
• Controller: An individual who, or legal entity that, alone or jointly with others determines the purpose and means of processing Personal Data.
• Personal Data: Any information that is linked or reasonably linkable to an identified or identifiable individual. Personal data does not include de-identified data or publicly available information (defined as information that is lawfully made available through federal, state, municipal government records, or widely distributed media, and a Controller has a reasonable basis to believe a consumer has lawfully made available to the general public).
• Profiling: Any form of automated processing performed on Personal Data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location or movements.
• Sale of Personal Data: The exchange of Personal Data for monetary or other valuable consideration by the Controller to a third party. The definition excludes the following disclosures:  (i) disclosure to a processor for processing on behalf of the Controller; (ii) disclosures to a third party to provide a product or service requested by the Consumer; (iii) disclosures to an affiliate of the Controller; (iv) disclosures of Personal Data where the consumer directs the Controller to disclose the Personal Data or intentionally uses the Controller to interact with a third party; (v) disclosures made by a Consumer to the general public via mass media (vi) a disclosure or transfer as an asset in a merger or other transaction in which the third party assumes control of all or part of the Controller’s assets.
• Sensitive Data: Personal Data that includes data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation or citizenship or immigration status; the processing of genetic or biometric data for the purpose of uniquely identifying an individual; Personal Data collected from a known child; or, precise geolocation data.
• Targeted Advertising: Displaying to a consumer advertisement based on Personal Data obtained or inferred from the consumer’s activities over time and across nonaffiliated websites or applications to predict their interests or preferences. Excludes: (i) advertisement based on activities within the Controllers websites; (ii) advertisement based on the context of consumers current search query or visit to a website/application; (iii) advertisement directed to the consumer in response to their request; or (iv) Personal Data processed solely for measuring or reporting advertisement performance.

Penalties:  

Violations of the NHDPA constitute unfair competition or an unfair or deceptive trade practice and may be enforced by the Attorney General. From January 1, 2025 to December 31, 2025, if the New Hampshire Attorney General deems a cure is possible, it must issue a notice of violation to the Controller with a 60-day period to cure the alleged violation before initiating an action. After January 1, 2026, the Attorney General may grant the opportunity to cure an alleged violation after considering a number of factors, including the number of violations and the nature and extent of the processing activities. The maximum civil penalty for violations is $10,000 per violation plus legal costs and expenses.

Private Action:

No.

Enforcement Action:

Yes, there have been enforcement actions including administrative fines, cease and desist orders, requirements for compliance enhancements and reporting obligations for entities found in violation of supervisory and compliance requirements related to data privacy and security.

Associated Regulations & Rulemaking:

There are associated regulations and rulemaking by the Department of Health and Human Services’ adoption of rules on records, reports and additional licensees and registrants handling sensitive information

Notes on AI Related Regulations:

New Hampshire has a governance framework for AI by state agency (RSA § 5-D:3-4) and has also issued sector-specific guidance for insurers. . New Hampshire has also taken enforcement action against AI-related entities without proper licensure in regulated sectors.

Effective Date:

January 1, 2025