New Hampshire’s Privacy Law
New Hampshire’s privacy law, formally called Bill 255 now just “NH”, was passed by the full legislature on January 18, 2024, and has an effective date of January 1, 2025. The law follows the Washington Privacy Act model, closely aligning with the Connecticut Data Privacy Act. While New Hampshire’s law follows common principles, it tasks the Secretary of State with providing standards for privacy notices and submission methods for privacy rights requests.
What You Need to Know About New Hampshire’s Privacy Law
NH’s data privacy law applies to for-profit entities that:
- Conduct business or provide products or services to residents of New Hampshire (consumers), and
- Annually controls or processes the PI of either:
- 35,000 unique residents, excluding PI solely used for completing payment transactions; or
- 10,000 unique residents, and derives at least 25% of gross revenue from sale of PI.
Exempt Entities: Exempt entities include:
- Non-profits;
- State government entities;
- Higher education Institutions;
- HIPAA -covered entities and business associates;
- GLBA-covered entities;
- FINRA national securities associations that are registered under the SEC Act of 1934
Exempt Data: NH exempts many different types of data from coverage under the law. Below is a list of some of the more commonly held data types that are exempt under the law.
- Protected Health Information under HIPAA;
- GLBA-covered data;
- Various federally and internationally protected health and patient information, including that protected by the Common Rule, human subject data, and more;
- Various forms of credit data regulated by the Fair Credit Reporting Act; and
- Data covered by a wide variety of other federal laws including Family Educational Rights, Farm Credit Act, and Privacy Act, and Driver’s Privacy Protection Act.
Exempt Use Cases: NH’s privacy law is not applicable to processing PI in an employment or commercial (B2B) context and the law specifies that it should not be construed to restrict a business’s collection, use, or retention of PI for:
- Conducting internal research for development, improvement, and repair of products, services, and technology (R&D);
- Product recalls;
- Identifying and repairing technical errors that impair existing or intended functionality; and
- Performing internal operations.
Key Components of NH’s Data Privacy Law
New Hampshire’s law covers “personal data,” or PI, which it defines as “any information that is linked or reasonably linkable to an identified or identifiable individual.”
The definition exempts de-identified and information made publicly available by government records, the media, or the consumer.
New Hampshire’s definition of sensitive PI includes the following information:
- Racial or ethnic origin;
- Religious beliefs;
- Mental or physical condition or diagnosis;
- Sex life or sexual orientation;
- Citizenship or immigration status;
- PI about a known child;
- Precise geolocation data; and
- Genetic or biometric data processed for purposes of identification.
Where a controller processes de-identified data, NH requires it to take reasonable measures to ensure the data cannot be associated with an individual, publicly commit to maintaining such data without an attempt to re-identify it, and contractually obligate any recipients of the data to comply with NH’s law.
Additionally, NH exempts pseudonymous data from access, correction, and deletion rights requests where the controller can show it keeps information that would allow the data to be re-identified separate and subject to technical and organizational controls that prevent its use for re-identification.
In a word: YES!
A privacy notice must include:
- The categories of PI processed;
- The purpose for processing PI;
- The categories of third parties with which PI is shared;
- The categories of PI that are shared with third parties;
- The methods for a consumer to exercise their rights (see below) and appeal a decision on their rights request;
- Description of targeted advertising and selling activities including a procedure for opting out of the processing for these purposes; and
- An active email address or other electronic method for a consumer to contact the company.
Note: The law calls for the Secretary of State to provide standards for privacy notices that have not yet been published.
New Hampshire defines “sale” to include exchange for monetary or other valuable consideration.
There are limits on the definition of “sale” to ensure that certain business functions are not unintentionally impeded by this law. Examples of activities deemed not to be a sale include: the disclosure of PI to provide a product or service requested by the consumer, disclosure of PI intentionally made public, and the disclosure of PI as part of a merger or bankruptcy.
The New Hampshire attorney general (AG) has sole enforcement authority. Under the NH law the AG may bring an enforcement action after providing a 60-day notice and an opportunity for the business to cure the alleged violation(s); the cure period will end Jan. 1, 2026, at which time the AG will have discretion over whether to grant an opportunity to cure. Penalties may include injunctive relief (the company must immediately stop certain behaviors) and/or civil penalties, with fines up to $10,000 as determined by the NH Unfair and Deceptive Trade Practice Act.
Privacy Rights
If NH’s privacy law applies to your business, you must provide the following privacy rights to consumers:
- Right to know whether a business is processing your PI;
- Right to access PI;
- Right to correct inaccuracies in PI;
- Right to delete PI about them;
- Right to obtain a copy of PI (data portability); and
- Right to opt out of the sale of personal, processing for targeted advertising, or profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning the consumer.
New Hampshire requires that businesses respond to individual rights requests within 45 days of receipt of the request, with a permissible 45-day extension in limited circumstances. Responses must be provided free of charge once a year. Businesses may deny a rights request in certain circumstances, including inability to verify the identity of a requestor. When a business denies a request, the business must notify the consumer within the 45-day timeframe and provide the reason for the denial as well as instructions for how to appeal the decision.
The appeals process must be conspicuously available to consumers and similar to the process for submitting an initial privacy rights request. Businesses must respond to appeals within 60 days of receipt and, if denying an appeal, must provide the consumer with a method (online if available) to file a complaint with the attorney general.
Note: The law calls for the Secretary of State to determine appropriate means for submission methods for data subject rights requests
Universal Opt Out
Starting January 1, 2025, New Hampshire requires that businesses recognize universal opt-out signals. Universal opt-out, or global privacy control, is a technical standard that enables users to automatically communicate their privacy preferences, such as opting out of the sale of their personal information, to websites through their web browser or other technologies.
Privacy Impact Assessments
The NH law requires that businesses conduct data protection impact assessments, or privacy impact assessments (PIAs), for certain high-risk processing.
- Processing for targeted advertising;
- Processing sensitive data;
- Selling PI;
- Processing for the purposes of profiling if it presents a ‘reasonably foreseeable risk’ of
- Unfair or deceptive treatment or unlawful disparate impact on consumers;
- Financial, physical or reputational injury to consumers;
- Physical or other intrusion on the solitude or seclusion, or private affairs or concerns, which would be offensive to a reasonable person; or
- Other substantial injury.
Vendor Contracts
New Hampshire requires controllers to have a contract in place with vendors that dictates obligations with respect to processing PI. Contracts must include:
- Instructions for processing PI;
- The nature and purpose of processing;
- Type of data that is subject to processing;
- The duration of processing;
- A duty of confidentiality for individuals who process the PI;
- Obligation to delete or return all PI at the controller’s direction or when it has completed the services, unless retention of the PI is required by law;
- Obligation to make available all information necessary to demonstrate the vendor’s compliance with its obligations;
- Compliance with audits by the controller or independent auditor;
- Provide the opportunity for the controller to object to any sub-processors; and
- Pass along the same obligations to any subcontractors in a written contract.
Data Minimization
NH limits the collection of PI “to what is adequate, relevant, and reasonably necessary in relation to the purposes for which that personal data is processed, as disclosed to the consumer.” Where processing is not necessary or compatible with the purpose for collection, organizations must obtain consumers’ consent for the processing.
Data Privacy is Just Good Business
Managing privacy compliance with all these new state privacy laws popping up in the U.S., might seem like a daunting task. But just because the task appears daunting, it doesn’t mean that it’s impossible to handle.
You don’t have to go at it alone! With the right support, you can make data privacy measures a sustainable part of your daily operations. That’s where Red Clover Advisors comes in – to deliver practical, actionable, business-friendly privacy strategies to help you achieve data privacy compliance and establish yourself as a consumer-friendly privacy champion that customers will appreciate.
