On January 1, 2025, New Hampshire's new consumer data privacy law, known as the New Hampshire Data Privacy Act (NHDPA), officially took effect, marking a significant step in consumer rights regarding personal data. The law, signed by former Governor Chris Sununu in 2024, aims to empower consumers by giving them greater control over how their personal information is handled by businesses.
The NHDPA guarantees several rights to consumers, including the ability to confirm whether a business is controlling or processing their personal data, correct inaccuracies, demand deletion of their data, obtain copies of their data in a portable format, and opt out of targeted advertising and profiling. These rights are designed to provide consumers with more transparency and control, addressing growing concerns about data privacy in an increasingly digital world.
According to the New Hampshire Attorney General’s Office, businesses are required to comply with a consumer’s request within 45 days. However, they may extend this deadline by an additional 45 days if it is deemed “reasonably necessary.” This provision aims to balance consumer rights with the operational realities of businesses processing large volumes of data.
Moreover, the NHDPA mandates that businesses limit their collection of consumer data strictly to what is necessary for the intended purpose. The law also requires explicit consent from consumers before collecting sensitive data, which includes information about race, ethnicity, religion, health status, and more. This requirement is crucial in protecting vulnerable populations and ensuring that individuals are aware of how their personal data is being utilized.
Businesses must also safeguard the confidentiality of the data they collect. They are obligated to provide consumers with the option to opt out of having their data processed by third parties. While the law allows businesses to deny certain requests, it also establishes an appeals process for consumers, ensuring that they have recourse if their requests are not honored.
The enforcement of the NHDPA is primarily the responsibility of the New Hampshire Attorney General, who is empowered to impose penalties of up to $10,000 per violation. However, the law does not allow for private rights of action, meaning that consumers cannot initiate lawsuits against businesses for alleged violations of their privacy rights.
The NHDPA applies to any person or business that controls or processes the personal data of 35,000 or more unique consumers, or 10,000 or more unique customers who derive 25% or more of their gross revenue from the sale of personal data. This broad applicability ensures that a wide range of businesses, from large corporations to smaller entities, are subject to these privacy regulations.
Exemptions exist for certain types of data, including information regulated under HIPAA, data used for clinical research, and data collected under specific federal regulations. These exemptions acknowledge the complexities of data handling in various sectors while still aiming to protect consumer rights.
As New Hampshire implements this new law, privacy campaigners in the UK are raising alarms about the potential misuse of personal data in political contexts. In a recent letter to Chris Bryant, the data protection minister, and Deputy Prime Minister Angela Rayner, campaigners highlighted concerns regarding the proposed data (use and access) bill, which is expected to come into force in early 2026.
Privacy advocates, including the Open Rights Group, argue that the bill could allow the government to exploit personal data for political messaging without the necessary risk assessments that currently protect individual rights. They warn that this could lead to the ruling party gaining an unfair electoral advantage by targeting voters more effectively.
James Baker, a programme manager at the Open Rights Group, emphasized the need for clear and fair rules governing the use of personal data by political parties. He stated, “Political parties are stuck in an arms race as to how they can use data to reach and influence potential voters in order to win elections.” Baker added that any changes to the regulations surrounding data use must be subjected to thorough parliamentary scrutiny to safeguard democracy.
The proposed legislation has been criticized for potentially granting the Secretary of State excessive discretion in how personal data is utilized, which could lead to abuses of power in the future. Baker noted that while the current government may not intend to misuse these powers, there is no guarantee that future administrations would operate similarly, especially in a political landscape characterized by a rise in populism.
In response to the concerns raised, a spokesperson from the Department for Science, Innovation and Technology assured that the use of personal data for political campaigning is not included in the measures of the data bill. They stated that regulations will be subject to “three robust safeguards,” including consultation with the Information Commissioner’s Office, parliamentary approval, and a requirement to serve the general public interest.
However, critics argue that the law is structured in a way that future secretaries of state could exploit it for political gain. Ross McKenzie, a partner at Addleshaw Goddard, acknowledged that while the law does not grant a completely unfettered right to use personal data, it does provide more flexibility than existing regulations in Europe, which could raise human rights concerns.
Despite the government’s assertion that the data bill will facilitate business operations and potentially contribute £10 billion to the UK economy over the next decade, peers in the House of Lords have expressed skepticism regarding the adequacy of oversight for the powers granted by the bill.
As New Hampshire navigates its new data privacy landscape, the ongoing debate in the UK highlights the delicate balance between leveraging data for economic growth and safeguarding individual rights. The outcomes of these legislative efforts will undoubtedly shape the future of data privacy and consumer protection in both regions.
