Committee debates broad data‑privacy bill, seeks revisions to sensitive‑data rules

A House committee held extensive testimony and debate on House Bill 410 and a committee substitute that would create a statewide consumer data privacy framework, but lawmakers delayed final action and asked sponsors and the attorney general’s office to refine several provisions.

The substitute would define “sensitive data” broadly — including health and reproductive information, biometric identifiers, racial or ethnic origin, citizenship and immigration status, sexual orientation and precise geolocation — and require opt‑in consent for processing of sensitive categories. The substitute also would strengthen child protections by requiring opt‑in consent for children under 13 and additional controls for users under 18.

Representative Serrato, the sponsor in committee, framed the bill as adopting best practices from other states and giving “teeth” to the attorney general to enforce privacy protections. The draft creates an enforcement path led by the attorney general’s office rather than a statewide private right of action; sponsors said the AG should act as the consumer‑protection authority in this space.

Opponents and civil‑liberties groups urged stronger enforcement and fewer exemptions. Marshall Martinez of Equality New Mexico and Lena Weber of the ACLU of New Mexico said the committee substitute left too many gaps and would leave marginalized groups exposed. “Without a private right of action, individuals have no direct means to defend rights against companies that misuse their data,” Martinez told the committee.

Tech and business groups — including TechNet, Fidelity Investments and industry trade associations — said the bill had improved from prior drafts but flagged problems with a committee‑substitute provision (section 13) that overlaps other rights and mixes controller/processor duties and response timelines. Industry witnesses asked the sponsor to clarify controller/processor distinctions and to simplify duplicative timelines for access, deletion and other consumer rights.

The substitute also would establish data‑protection assessments, require clear privacy notices and create a “universal” mechanism to exercise opt‑out or opt‑in rights. The sponsor noted the bill exempts information already covered by federal statutes such as HIPAA and the Gramm‑Leach‑Bliley Act.

Committee members asked detailed questions about: how easy consent and revocation would be for everyday users; how identity authentication would work for consumer requests; whether the AG has the staff and technical capacity to enforce the law; and whether the bill’s severability language is consistent with other states’ statutes. Multiple speakers recommended additional fiscal and technical analysis; a committee member requested an updated fiscal impact report if possible before the bill returns.

Outcome and next steps: the committee did not pass the bill. The sponsor and the attorney general’s representative said they would continue negotiations with civil‑liberties advocates, industry groups and small‑business representatives, and the chair asked for additional cleanup and for Representative Herndon to be present at the next discussion. The committee discussed rescheduling further action for the following Monday to allow more stakeholder consultation and a potential updated fiscal analysis.

Discussion vs. action: the hearing was largely discussion and stakeholder testimony; no committee vote was taken on the committee substitute.

Key points of contention: private right of action vs. AG enforcement; scope of exemptions for covered entities; section 13 (sensitive‑data handling and duplication of timelines); practical consumer experience for opt‑in/opt‑out and revocation; adequacy of AG staffing for enforcement.

What to watch: sponsors plan technical cleanups of section 13, further engagement with the attorney general’s office, and follow‑up on whether the committee will seek an updated fiscal impact report and a revised substitute.