NOTE:  As provided in LFC policy, this report is intended only for use by the standing finance committees of the legislature.  The Legislative Finance Committee does not assume responsibility for the accuracy of the information in this report when used for other purposes.

 

The most recent FIR version (in HTML & Adobe PDF formats) is available on the Legislative Website.  The Adobe PDF version includes all attachments, whereas the HTML version does not.  Previously issued FIRs and attachments may be obtained from the LFC in Suite 101 of the State Capitol Building North.

 

F I S C A L   I M P A C T   R E P O R T

 

 

SPONSOR:

Picraux

 

DATE TYPED:

3/12/03

 

HB

905/aHBIC

 

SHORT TITLE:

Privacy Protection Act

 

SB

 

 

 

ANALYST:

Maloy

 

APPROPRIATION

 

Appropriation Contained

Estimated Additional Impact

Recurring

or Non-Rec

Fund

Affected

FY03

FY04

FY03

FY04

 

 

 

NFI

 

NFI

 

 

 

SOURCES OF INFORMATION

 

Responses Received From

Office of the Attorney General

 

SUMMARY

 

     Synopsis of HBIC Amendment

 

The House Business and Industries Committee has amended HB 905 to reduce the bill from 10 sections to three.

 

The three remaining sections address:

 

·        The creation of the Privacy Protection Act to provide that protected information of a consumer who has purchased, leased, or otherwise contracted for products, goods or services in New Mexico may not be required.  For instance, a business may not require a consumer’s social security number as a condition to lease of purchase.  However, a social security number may  required or requested if the number is to be used in a manner  required by state and/or federal law; and a consumer may consent to giving his or her social security number, or  to its use.

 

  • Amendment of the Credit Card Act to state that a person / entity accepting a credit card may   not issue a receipt that shows the credit card’s expiration date, or that reveals more than the last 5 embossed numbers (rather than 4 as original bill stated) of the account number.

 

    


Synopsis of Original Bill

 

  • House Bill 905 enacts a new law, the Privacy Protection Act.  This law prohibits individuals from selling, conveying, receiving, or using a consumer’s protected information (i.e., behavior information, financial records, genetic information or personal identifying information) to a business knowing that the protected information will be used by a business to encourage the consumer to buy or lease property, goods or services, or to contribute money. 

 

HB905 provides two exceptions that would allow disclosure of consumer protected information: (1) if the consumer consents to its conveyance and if such consent is given independent of a consumer transaction; and (2) for financial institutions, potential creditors, or credit bureaus that may otherwise be required under federal or other state laws to disclose a consumer’s credit history to one another.

 

  • HB 905 also prohibits individuals from monitoring or compiling a consumer’s behavior information (i.e., individual interests, buying preferences, habits or other individual behavior that a business could use to target specific individuals) to a business knowing that the protected information will be used by a business to encourage the consumer to buy or lease property, goods or services, or to contribute money. 

 

However, HB 905 provides two exceptions that would allow monitoring or compiling of consumer behavior information: (1) if the consumer consents to it and if such consent is given independent of a consumer transaction, and (2) if the information will not be used to target specific consumers as future clients but is used in an aggregate form with similar information about consumers to identify trends, populations or other like indicators of group consumer behavior.

 

·        HB 905 prohibits businesses from requiring a consumer’s social security number as a condition to lease or buy products, good or services from those businesses with two exceptions: (1) if the social security number is required under state or federal law; and (2) if the consumer consents to its use and consent is given independent of a consumer transaction. HB 905 further requires that businesses adopt internal policies that limit access to social security numbers to employees who need that information to perform their duties and hold these employees accountable if the social security numbers are released to third persons. 

 

 

·        Finally, the State Attorney General is charged with the enforcement authority to bring actions for injunctive and declaratory relief to ensure compliance with the Privacy Protection Act.  Consumers harmed by violations of the Act can bring civil actions and recover damages of up to $500 per offense and may recover actual and/or punitive damages, attorneys fees and any other equitable relief if deemed appropriate by a court to enforce the Act.  Individuals who knowingly violate provisions of the Act can also be charged with criminal fines, penalties or both.

 

HB 905 makes a violation of the Privacy Protection Act an unfair and deceptive trade practice under the Unfair Practices Act.

 

HB 905 also enacts a new section of the Credit Card Act (NMSA 1978, Section 56-4-1 et. seq.) that prohibits persons from issuing credit card receipts that show the expiration date or that reveals more than the last four digits of the cardholder’s credit card account number.

 

Significant Issues

 

1.  HB 905 makes a violation of the Privacy Protection Act an “unfair or deceptive trade practice” under the Unfair Practices Act, NMSA 1978, Section 57-12-1 et. seq.   The UPA may therefore need to be amended to include language in the definition of "unfair and deceptive trade practice" that would take into account an act specifically declared unlawful under the UPA.

 

2.  There may be federal and state laws that already afford similar privacy protections to consumers as provided under the Privacy Protection Act.  The Act, however, is not necessarily duplicative; rather it extends and confers added essential protections to consumers in areas that current New Mexico law does not address.

 

FISCAL IMPLICATIONS

 

There exist no direct fiscal implications for the state.  There may be secondary costs for the courts, public defenders offices, and district attorneys office.  There will be some additional administrative impact, both budget and staff, for the Office of the Attorney General if there were to be a number of cases pursued under this new law.

 

OTHER SUBSTANTIVE ISSUES

 

1.      HB 905 makes a violation of the Privacy Protection Act an “unfair or deceptive trade practice” under the Unfair Practices Act (UPA), NMSA 1978, Section 57-12-1 et. seq.  In particular, section 57-12-2(D) of the UPA defines and provides a laundry list of examples of what constitutes an “unfair and deceptive trade practice."  The definition however does not include "acts" that are specifically declared unlawful pursuant to the UPA as HB 905 would provide.  The UPA may therefore need to be amended to include language in the definition of "unfair and deceptive trade practice" that would take into account "an act specifically declared unlawful under the UPA."
 
Please Note:  Such language has already been introduced under SB 573 – Relating to Telecommunications and proposes to amend the UPA to add the phrase “an act specifically declared unlawful under the UPA.”      

 

2.  While there may be federal and state laws that already afford similar privacy protections to consumers as provided for under the Privacy Protection Act.  See e.g.  Driver's Privacy Protection Act, 18 USC Section 2721(prohibits state departments and motor vehicle departments from releasing personal information from driver's licenses and registration records); Fair Credit Reporting Act, 15 USC Section 1681(regulates the collection and use of personal data by credit reporting agencies); Gramm Leach Bliley Act, 15 USC Section 6801 et.seq. (regulates the privacy of personally identifiable, nonpublic financial information disclosed to non-affiliated third parties by financial institutions); Genetic Information Privacy Act, NMSA 1978, Section 24-21-1 et. seq.(prohibits the use of genetic information or analysis without the individual's consent); Health Care Purchasing Act, NMSA 1978, Section 13-7-1 et. seq. (prohibits public health care agencies and other persons who provide health care benefits from requiring use of participant's social security number).  The Act however is not necessarily duplicative; rather it extends and confers added essential protections to consumers in areas that current New Mexico law does not address.

 

SJM/sb/njw