RELATING TO COMMERCIAL INSTRUMENTS AND TRANSACTIONS; RESTRICTING THE CREDIT CARD ACCOUNT NUMBER INFORMATION THAT CAN BE DISCLOSED; ENACTING THE PRIVACY PROTECTION ACT.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:

Section 1. SHORT TITLE.--Sections 1 through 3 of this act may be cited as the "Privacy Protection Act".

Section 2. DEFINITIONS.--As used in the Privacy Protection Act:

A. "business" means a commercial enterprise that:

(1) sells or leases or intends to sell or lease products, goods or services to consumers;

(2) is an agent of a business described in Paragraph (1) of this subsection; or

(3) is an agent of a nonprofit organization selling marketing services to that organization; and

B. "consumer" means a natural person, who is a resident of New Mexico, and who purchases, leases or otherwise contracts for products, goods or services within New Mexico that are primarily used for personal, family or household purposes.

Section 3. DISCLOSURE OF SOCIAL SECURITY NUMBER.--

A. Except as provided in Subsection B of this section, no business shall require a consumer's social security number as a condition for the consumer to lease or purchase products, goods or services from the business.

B. Nothing in this section prohibits a business from requiring or requesting a consumer's social security number if the number will be used in a manner consistent with state or federal law or as part of an application for credit or in connection with annuity or insurance transactions.

C. Nothing in this section prohibits a business from acquiring or using a consumer's social security number if the consumer consents to the acquisition or use.

D. A company acquiring or using social security numbers of consumers shall adopt internal policies that:

(1) limit access to the social security numbers to those employees authorized to have access to that information to perform their duties; and

(2) hold employees responsible if the social security numbers are released to unauthorized persons.

Section 4. A new section of the Credit Card Act is enacted to read:

"PROHIBITED DISCLOSURE OF CREDIT CARD NUMBER.--A person who accepts a credit card from a cardholder shall not issue a receipt that lists more than five numbers from the cardholder's credit card account number."

Section 5. EFFECTIVE DATE.--The effective date of the provisions of this act is January 1, 2004.