New Hampshire

Who Is Covered?

Any person doing business in New Hampshire who owns or licenses computerized data that includes personal information. N.H. Rev. Stat. Ann. § 359-C:20(I)(a).

What Information Is Protected?

“Personal information” means an individual’s first name or initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:

  1. Social security number.
  2. Driver’s license number or other government identification number.
  3. Account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account. N.H. Rev. Stat. Ann. § 359-C:19(IV).

What Is A “Breach”?

“Security breach” means unauthorized acquisition of computerized data that compromises the security or confidentiality of personal information maintained by a person doing business in this state. Good faith acquisition of personal information by an employee or agent of a person for the purposes of the person’s business shall not be considered a security breach, provided that the personal information is not used or subject to further unauthorized disclosure. N.H. Rev. Stat. Ann. § 359-C:19(V).

What Triggers Notification?

After becoming aware of a security breach, a determination that misuse of the information has occurred or is reasonably likely to occur, or such a determination cannot be made. N.H. Rev. Stat. Ann. § 359-C:20(I)(a).

How Is Notice Provided To Individuals?

Timing: As soon as possible. N.H. Rev. Stat. Ann. § 359-C:20(I)(a).

Delivery: Notification may be made by:

  1. Written notice. 
  2. Electronic notice, if the agency’s or business’s primary means of communication with affected individuals is by electronic means.
  3. Telephonic notice, provided that a log of each such notification is kept by the person or business who notifies affected persons. 
  4. Substitute notice, if the person demonstrates that the cost of providing notice would exceed $5,000, that the affected class of subject individuals to be notified exceeds 1,000, or the person does not have sufficient contact information or consent to provide notice pursuant to subparagraphs 1-3 above. N.H. Rev. Stat. Ann. § 359-C:20(III).

Content: The notice must include:

  1. A description of the incident in general terms.
  2. The approximate date of breach.
  3. The type of personal information obtained as a result of the security breach.
  4. The telephonic contact information of the person subject to this section. N.H. Rev. Stat. Ann. § 359-C:20(IV).

Is Notice To The Government Required?

Yes. Those subject to the jurisdiction of the bank commissioner, the director of securities regulation, the insurance commissioner, the public utilities commission, the financial institutions and insurance regulators of other states, or federal banking or securities regulators must notify the regulator who possesses primary regulatory authority.

Otherwise the Attorney General must be notified. The notice must include the anticipated date of the notice to the individuals and the approximate number of individuals in this state who will be notified. N.H. Rev. Stat. Ann. § 359-C:20(I)(b).

Is Notice To Credit Reporting Agencies Required?

No.

Are There Security Measure Standards?

No.

What Are The Possible Consequences Of A Violation?

Any person injured by any violation under this subdivision may bring an action for damages and for such equitable relief, including an injunction, as the court deems necessary and proper. If the court finds for the plaintiff, recovery shall be in the amount of actual damages. If the court finds that the act or practice was a willful or knowing violation of this chapter, it shall award as much as three times, but not less than two times, such amount. In addition, a prevailing plaintiff shall be awarded the costs of the suit and reasonable attorney’s fees, as determined by the court. Any attempted waiver of the right to the damages set forth in this paragraph shall be void and unenforceable. Injunctive relief shall be available to private individuals under this chapter without bond, subject to the discretion of the court. N.H. Rev. Stat. Ann. § 359-C:21(I).

The New Hampshire attorney general’s office shall enforce the provisions of this subdivision pursuant to N.H. Rev. Stat. Ann. § 358-A:4 which allows for injunctive relief and civil penalties up to $10,000 per violation. N.H. Rev. Stat. Ann. § 359-C:21(II).

Are There Any Exemptions/Exceptions?

Any person engaged in trade or commerce that is subject to RSA 358-A:3, I which maintains procedures for security breach notification pursuant to the laws, rules, regulations, guidances, or guidelines issued by a state or federal regulator shall be deemed to be in compliance with this subdivision if it acts in accordance with such laws, rules, regulations, guidances, or guidelines. N.H. Rev. Stat. Ann. § 359-C:20(V).