New Hampshire Makes Fourteen: State Data Privacy Law Update
Shortly following New Jersey, New Hampshire has become the fourteenth state to enact comprehensive data privacy legislation with the signing of Senate Bill 255 by NH Governor Chris Sununu. The law will with go into effect on January 1, 2025. This law, like most other states, does not directly address vehicle performance data (“VPD”), but it is implicated in several aspects.
VPD Provisions
SB 255 does not specifically define “vehicle information” or include any provisions specific to VPD. “Personal data” is defined as any information that is linked or reasonably linkable to an identified or identifiable individual. It does not include “de-identified” data or publicly available information. S.B. 255-FN, 2024 Sess. § 507-H:1(XIX) (NH 2024). “Sensitive data” is defined as “data revealing racial or ethnic origins, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation or citizenship or immigration status.” It also includes biometric data, data collected from a known child, or geolocation data. S.B. 255-FN, 2024 Sess. § 507-H:1(XXVIII) (NH 2024).
The bill restricts the processing of personal data unless the controller obtains consumer’s consent. S.B. 255-FN, 2024 Sess. § 507-H:4(I)(a)-(g) (NH 2024).
The bill further defines “biometric data” as “data generated by automatic measurements of an individual’s biological characteristics, such as fingerprint, a voiceprint, eye retinas, irises or other unique biological patterns or characteristics that are used to identify a specific individual.” It does not include photographs, videos, or audio recordings, unless the data is generated to identify an individual. S.B. 255-FN, 2024 Sess. § 507-H:1(IV) (NH 2024).
Additionally, the bill does not prohibit a controller or processor from using or retaining data for internal use to “[c]onduct internal research to develop, improve, or repair products, services, or technology,” to “effectuate a product recall,” or to “identify and repair technical errors that impair existing or intended functionality.” S.B. 255-FN, 2024 Sess. § 507-H:10(II)(a)-(c) (NH 2024).
SB 255 also specifically exempts from its scope “[p]ersonal data collected, processed, sold or disclosed in compliance with the Driver’s Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq., as amended.” S.B. 255-FN, 2024 Sess. § 507-H:3(II)(l) (NH 2024).
Privacy Law
New Hampshire Data Privacy Bill (SB 255), effective January 1, 2025
With New Hampshire’s bill now signed, it looks like Wisconsin, Kentucky, and Georgia are up next!
Copyright Nelson Law LLC
The opinions expressed in this blog are those of the author(s) and do not necessarily reflect the views of the Firm, its clients, or any of its or their respective affiliates. This blog post is for general information purposes and is not intended to be and should not be taken as legal advice.