New Hampshire Privacy Act (NHPA)
NHPA follows primarily an opt-out model, meaning businesses are free to process consumer data, but must notify consumers about the processing first and give them a way to opt out of the collection or sale of data. There are exceptions, however, for the data of children under the age of 13 and for sensitive data.
Is Complying with NHPA Mandatory?
The law applies to “persons that conduct business” in the state or who produce products or services targeted to residents of New Hampshire and who, during a one-year period:
Controlled or processed the personal data of not less than 35,000 unique consumers, excluding if the processing occurred solely to complete a payment transaction, or
Controlled or processed the personal data of not less than 10,000 unique consumers and derived more than 25 percent of their gross revenue from the sale of personal data.
What are the penalties for not complying with NHPA?
The privacy act states that a violation constitutes a violation of the state’s deceptive trade practices law. This means penalties could be as steep as $10,000 per violation.