Scope of the NHPA

The NHPA applies to "controllers" - individuals who, or legal entities that, alone or jointly with others determines the purpose and means of processing personal data. To fall under the NHPA, controllers must either:

• Control or process the personal data of at least 35,000 unique New Hampshire consumers, or
• Control or process the personal data of 10,000 unique New Hampshire consumers if they derive over 25% of their gross revenue from the sale of personal data.

Controller and Processor Obligations

Under the NHPA, controllers are required to:

• Provide a meaningful privacy notice in a reasonably accessible format that includes the date it was last updated;
• Implement appropriate data security measures;
• Obtain consent before processing sensitive data;
• Limit data collection to what is necessary for disclosed purposes; and
• Allow consumers to revoke consent using mechanisms no more difficult than those used to provide consent, including clear universal opt-out mechanisms.

Exemptions

Similar to other state privacy laws, the NHPA exempts certain types of information and entities. Notably, data collected for consumer credit reports or under the Fair Credit Reporting Act (FCRA) is exempt.

Consumer Rights

The NHPA grants New Hampshire consumers specific rights regarding the processing of their data by controllers. These rights include:

• Access to personal data;
• Correction of inaccuracies;
• Deletion of personal data;
• Data portability; and
• The ability to opt out of data processing for targeted advertising, data sales, or profiling.

Enforcement and Penalties

Violations of the NHPA can incur civil penalties of up to $10,000 per violation. Controllers must ensure compliance to avoid substantial fines and demonstrate a commitment to data privacy and consumer protection.

Posted: August 7, 2024

All Rights Reserved © 2024 Business Information Group, Inc.
This document and/or presentation is provided as a service to our customers. Its contents are designed solely for informational purposes, and should not be inferred or understood as legal advice or binding case law, nor shared with any third parties. Persons in need of legal assistance should seek the advice of competent legal counsel. Although care has been taken in preparation of these materials, we cannot guarantee the accuracy, currency or completeness of the information contained within it. Anyone using this information does so at his or her own risk.