Just prior to its first-in-the-nation presidential primary this month, the New Hampshire legislature passed SB255 that is expected by signed into law by Governor Christopher Sununu that will make it the second law comprehensive consumer data privacy bill enacted in 2024. The bill’s effective date is January 1, 2025.
The New Hampshire legislation largely follows the Connecticut Data Privacy Act (CTDPA). However, there are some differences with the Connecticut law, including not containing the CTDTA amendments passed in 2023, such as the addition of consumer health data to the definition of sensitive data. Below are some of the variations that the Granite State bill does contain.
The New Hampshire bill applies to persons that conduct business in the state or that produce products or services that are targeted to Granite State residents and that either (1) control or process the personal data of not less than 35,000 unique consumers (excluding personal data controlled or processed solely for purposes of completing a payment transaction) or (2) control or process the personal data of not less than 10,000 unique consumers and derive more than 25% of their gross revenue from the sale of personal data.
The bill uses a similar percentage for consumer applicability thresholds from the CTDPA, albeit lower number. With a population of approximately 1.4 million, the 35,000 consumer threshold represents approximately 2.5% of New Hampshire’s population similar to Connecticut’s statute threshold.
The NH bill also requires the Secretary of State to (1) establish secure and reliable means for consumers to exercise their consumer rights and (2) provide standards for privacy notices and disclosures.
The New Hampshire bill mostly contains the same exemptions as found in the CTDPA such as for financial institutions and HIPAA covered entities. But is also exempts personal information maintained or used for purposes of compliance with the regulation of listed chemicals under the federal Controlled Substances Act (21 U.S.C. section 830).
The bill tracks the Connecticut’s by providing a 60 day right to cure, although sunsets after 12 months after enactment. The New Hampshire bill also does not require the Attorney General’s office to submit a report regarding its notices of violation during the right to cure period.
For further information, please contact Jim Potter, CHC Executive Director at jpotter@cohealth.com.