New Mexico Biometric Privacy Laws: Collection, Consent & Penalties (2026)

New Mexico has no standalone biometric privacy law. Biometric data is protected under the Data Breach Notification Act (N.M. Stat. Ann. 57-12C-1 et seq.), which requires organizations to secure and properly dispose of that data and to notify affected residents within 45 days of a breach, but imposes no consent or collection rules. The Attorney General enforces the law; individuals have no private right of action.

New Mexico takes a breach-notification approach to biometric privacy. The state has no dedicated statute governing how businesses collect, store, or use biometric identifiers. Instead, biometric data falls under the umbrella of the Data Breach Notification Act (N.M. Stat. Ann. 57-12C-1 through 57-12C-12), which requires organizations to notify residents when their personal information, including biometric data, is compromised in a security breach.

This means New Mexico employers and businesses can collect fingerprints, facial scans, and other biometric identifiers without obtaining advance consent or following specific collection procedures. Consent is the gap, not security. Once a business holds that data, N.M. Stat. Ann. 57-12C-3 through 57-12C-5 require it to store the data under reasonable security procedures, to dispose of the records properly once they are no longer reasonably needed, and to bind its service providers to the same standard by contract.

For an overview of the state's broader privacy framework, see the parent guide to New Mexico Data Privacy Laws.

How New Mexico Defines Biometric Data

The Data Breach Notification Act defines biometric data under N.M. Stat. Ann. 57-12C-2 as a record generated by automatic measurements of an identified individual's biological characteristics. The statute specifically lists:

• Fingerprints
• Voice prints
• Iris or retina patterns
• Facial characteristics
• Hand geometry

There is an important qualifier. The biometric data must be "used to uniquely and durably authenticate an individual's identity when the individual accesses a physical location, device, system or account." Biometric measurements collected for research, analytics, or purposes other than authentication do not qualify as protected personal identifying information under this statute.

This authentication-linked definition is narrower than the definitions used in states with dedicated biometric privacy laws, such as Illinois or Washington.

What the Data Breach Notification Act Requires

Personal Identifying Information

Biometric data is one of several categories that qualify as personal identifying information (PII) under the Act. The full list includes a person's first name or first initial and last name combined with any of the following:

• Social Security number
• Driver's license number or government-issued identification number
• Account number, credit card number, or debit card number combined with any required security code, access code, or password
• Biometric data

Publicly available information and information found in government records are excluded from this definition.

Security, Disposal, and Service-Provider Duties

The Act is not purely reactive. Three of its sections impose affirmative duties that apply before any breach occurs, and biometric data carries them because it is personal identifying information under N.M. Stat. Ann. 57-12C-2(C)(1)(e).

Under N.M. Stat. Ann. 57-12C-4, a person that owns or licenses personal identifying information of a New Mexico resident "shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information" to protect it from unauthorized access, destruction, use, modification or disclosure.

Under N.M. Stat. Ann. 57-12C-3, a person that owns or licenses records containing that information "shall arrange for proper disposal of the records when they are no longer reasonably needed for business purposes." Proper disposal means shredding, erasing or otherwise modifying the information to make it unreadable or undecipherable.

Under N.M. Stat. Ann. 57-12C-5, a business that discloses personal identifying information to a service provider under contract must require by contract that the service provider implement and maintain the same reasonable security procedures and practices.

One limit shapes how far these duties reach. Biometric data is personal identifying information only when it is combined with an individual's first name or first initial and last name and is not protected through encryption or redaction, so encrypting biometric records both satisfies the security duty and removes the record from the notification trigger.

Breach Notification Timeline

When a security breach compromises biometric data or other PII, the organization must notify affected New Mexico residents "in the most expedient time possible, but not later than forty-five calendar days following discovery of the security breach" under N.M. Stat. Ann. 57-12C-6.

The 45-day clock starts at discovery, not at the time the breach actually occurred. This distinction matters because breaches are often detected weeks or months after the initial intrusion.

What the Notification Must Include

Written notices sent to affected individuals must contain specific information under the Act:

• The name and contact information of the entity reporting the breach
• A list of the types of personal identifying information believed to have been compromised
• The date of the security breach or the estimated date range
• A general description of the breach incident
• Toll-free telephone numbers and addresses for major consumer reporting agencies
• Advice to review personal account statements and credit reports for unusual activity
• Information about the individual's rights under the federal Fair Credit Reporting Act

Attorney General Notification

Under N.M. Stat. Ann. 57-12C-10, when a breach affects more than 1,000 New Mexico residents, the organization must also notify the New Mexico Attorney General and major consumer reporting agencies within 45 calendar days. The AG notification must include the number of residents who received breach notices and a copy of the notification sent to affected individuals.

Harm Threshold Exception

Notification is not required if, after an appropriate investigation, the organization determines that the security breach does not give rise to a significant risk of identity theft or fraud. Organizations that rely on this exception should document their investigation and reasoning thoroughly, as the Attorney General may later question that determination.

Exemptions Under the Act

Two categories of entities are fully exempt from the Data Breach Notification Act's requirements:

GLBA-covered entities. Financial institutions that comply with the data security and breach notification provisions of the Gramm-Leach-Bliley Act do not need to follow New Mexico's separate notification procedures.

HIPAA-covered entities. Healthcare providers, health plans, and healthcare clearinghouses that comply with the breach notification requirements of the Health Insurance Portability and Accountability Act are similarly exempt.

These exemptions recognize that federal law already imposes breach notification obligations on these industries. However, organizations should verify they are actually complying with the applicable federal requirements, not just that they fall within the regulated industry.

Encryption Safe Harbor

The Act does not apply to breaches involving personal identifying information that was encrypted, redacted, or otherwise rendered unreadable at the time of the breach. This safe harbor applies as long as the encryption key itself was not also compromised in the incident.

Organizations that encrypt biometric data at rest and in transit gain meaningful protection from notification obligations under this provision.

Enforcement and Penalties

Attorney General Authority

The New Mexico Attorney General has exclusive enforcement authority over the Data Breach Notification Act. Under N.M. Stat. Ann. 57-12C-11, when the AG has a reasonable belief that a violation has occurred, the office may bring an action on behalf of affected individuals and in the name of the state.

Civil Penalties

Courts can impose civil penalties of the greater of $25,000 or $10 per instance of failed notification, up to a maximum of $150,000, when a person or entity violates the Act knowingly or recklessly. The AG may also seek injunctive relief and damages for actual costs and losses suffered by affected individuals.

No Private Right of Action

New Mexico residents cannot file private lawsuits under the Data Breach Notification Act. Only the Attorney General can pursue enforcement. This limits the litigation risk for organizations compared to states like Illinois, where individuals can sue directly under BIPA and recover statutory damages.

However, individuals may still have claims under the New Mexico Unfair Practices Act (N.M. Stat. Ann. 57-12-1 et seq.) if a business's handling of biometric data involves deceptive or unconscionable trade practices.

Employer Use of Biometric Data

New Mexico has no biometric-specific employment statute, so there is no state-level mandate requiring employers to:

• Obtain written consent before collecting fingerprints or facial scans
• Publish a biometric data retention and destruction schedule
• Limit biometric data storage to a fixed number of years
• Destroy biometric data on a set deadline tied to the end of employment

The Data Breach Notification Act's general duties still apply to employee biometrics, and they are statutory obligations rather than best practices. An employer running biometric time clocks, fingerprint scanners for facility access, or facial recognition systems owns or licenses personal identifying information, so N.M. Stat. Ann. 57-12C-4 requires it to implement and maintain reasonable security procedures and practices for that data, and N.M. Stat. Ann. 57-12C-3 requires proper disposal of those records once they are no longer reasonably needed for business purposes. An employer that hands biometric data to a payroll, timekeeping, or access-control vendor must also require that vendor by contract, under N.M. Stat. Ann. 57-12C-5, to maintain reasonable security procedures and practices. A breach of employee biometric information triggers the same 45-day notification obligation as any other PII breach under the Act.

Pending Legislation and Future Outlook

New Mexico lawmakers have introduced several privacy bills in recent sessions that would expand biometric data protections if enacted.

Internet Privacy and Safety Act (HB 307, 2025)

House Bill 307 from the 2025 session proposed comprehensive consumer privacy protections. The bill defined biometric data broadly as "data about a consumer generated by measurements of the consumer's unique biological characteristics, such as a faceprint, a fingerprint, a voiceprint, a retina or an iris image." It would have classified biometric data as sensitive personal data, prohibited its use for targeted advertising, required opt-in consent for processing, and imposed civil penalties up to $7,500 per intentional violation with a private right of action. The bill did not become law during the 2025 session.

Community and Health Information Safety and Privacy Act (SB 53, 2026)

Senate Bill 53, known as CHISPA, was introduced in January 2026. It included a similar broad definition of biometric data and aimed to make online privacy the default by requiring opt-in consent for data collection. Despite receiving a "Do Pass" recommendation from the Senate Health and Public Affairs Committee on February 5, 2026, the bill was postponed indefinitely and did not advance further.

Artificial Intelligence Transparency Act (HB 28, 2026)

House Bill 28 from the 2026 session addressed AI systems making consequential decisions but did not directly regulate biometric data collection; like SB 53, it was postponed indefinitely and died when the session ended. It focuses on transparency and accountability for automated decision-making in employment, financial services, healthcare, and other areas.

What This Means Going Forward

The repeated introduction of privacy bills with biometric provisions signals growing legislative interest in this area. New Mexico may eventually adopt a comprehensive consumer privacy law that includes dedicated biometric data protections. Until then, the Data Breach Notification Act remains the primary safeguard.

How New Mexico Compares to Other States

New Mexico falls into a group of states that protect biometric data only through data-security and breach-notification requirements, without a dedicated biometric privacy statute or comprehensive consumer privacy law. This places it behind states with stronger protections:

The key difference is that states with dedicated biometric privacy laws or comprehensive privacy laws regulate the collection and use of biometric data proactively, while New Mexico's law governs how the data is secured and disposed of but never asks whether it should have been collected in the first place.

This article provides general legal information about New Mexico biometric privacy laws and is not legal advice. Statutes and regulations change over time. Consult a qualified attorney licensed in New Mexico for guidance on your specific situation.

More New Mexico Laws

• New Mexico Deepfake Laws
• New Mexico Employee Monitoring Laws
• New Mexico GPS Tracking Laws
• New Mexico Recording Laws