InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
New Hampshire enacts SB 255, a comprehensive consumer privacy bill
Recently, the Governor of New Hampshire signed SB 255 (the “Act”) making New Hampshire the 14th state to enact a comprehensive consumer privacy bill. The Act will apply to entities that engage in commercial activities within New Hampshire or target New Hampshire consumers for their products or services and that during a one-year period either: (i) control or process data of 35,000 New Hampshire consumers (except solely for purposes of completing a payment transaction); or (ii) control or process data of 10,000 New Hampshire consumers and derive more than 25 percent of their revenue from selling the data. Exemptions include entities or data subject to the Gramm-Leach-Bliley Act’s Title V, non-profit organizations, and higher education institutions. The legislation will also exempt specific types of data, such as health information that is protected under HIPAA or data subject to the FCRA. The definition of consumer is limited to an individual residing in New Hampshire and excludes both employee and business-to-business (B2B) data.
The Act will define new terms, such as "sensitive data” which could mean “personal data that includes data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation or citizenship or immigration status.” “Sensitive data” also includes genetic or biometric information, data on children, and precise location details. New Hampshire will now mandate that companies obtain explicit consent from consumers before processing sensitive data.
The Act also granted consumers the following rights: the right to know, the right to correct, the right to delete, the right to opt out of the processing of their personal data for targeted advertising, sales, or profiling of the consumer in furtherance of solely automated decisions that produce legal effects or other effects of similar significance, and the right to data portability. Consumers will also be protected against discrimination for exercising any of the above rights.
The Act contained controller responsibilities, including:
- Limiting the collection of personal data to what is adequate, relevant and reasonably necessary;
- not processing personal data for purposes that are neither reasonably necessary to, nor compatible with, the disclosed purposes that were disclosed to the consumer, unless the controller obtains the consumer's consent;
- Establishing, implementing and maintaining reasonable administrative, technical and physical data security practices to protect the confidentiality, integrity and accessibility of personal data;
- Not processing sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with COPPA;
- Providing an effective mechanism for a consumer to revoke the consumer's consent that is at least as easy as the mechanism by which the consumer provided the consumer's consent and, upon revocation of such consent, ceasing to process the data as soon as practicable, but not later than 15 days after the receipt of such request; and
- Not processing the personal data of a consumer for purposes of targeted advertising, or selling the consumer's personal data without the consumer's consent, under circumstances where a controller has actual knowledge, and willfully disregards, that the consumer is at least 13 years of age but younger than 16 years of age.
The controller also must provide a privacy notice meeting the standards set forth by the Secretary of State. Controllers must conduct data protection assessments for each processing activity that presents a heightened risk of harm to a consumer, including: (i) the processing of personal data for the purpose of targeted advertising; (ii) the sale of personal data; (iii) the processing of sensitive data; and (iv) the processing of personal data for profiling, where profiling presents a reasonably foreseeable risk of unfair or deceptive treatment of consumers, unlawful disparate impact, or undue intrusion upon solitude or seclusion.
The attorney general has exclusive authority to enforce the Act. Between January 1, 2025, and December 31, 2025, the attorney general is required to provide notice of an alleged violation and an accompanying 60-day cure period before commencing an enforcement action. Beginning January 1, 2026, the attorney general has the discretion to provide an opportunity to cure but is not required to provide such an opportunity. The Act does not include a private right of action. The Act will take effect on January 1, 2025.
New Hampshire enshrines a new consumer privacy law
On March 6, the Governor of New Hampshire, Chris Sununu, signed into law a sweeping consumer privacy bill. Under the act, consumers will have the right to confirm if a controller (an individual who controls personal data) is processing their personal data, a right to access that data, as well as correct inaccuracies, obtain a copy, delete, and opt-out of the processing of the data for targeted advertising purposes. The act also imposed limits on collectors, including that a controller shall (i) limit the collection of data to only what is adequate, relevant, and reasonably necessary for the intended purpose; (ii) establish and maintain administrative security practices to protect the confidentiality of consumer personal data; (iii) not process sensitive data without obtaining the consumer’s consent or, if the data concerns a known child, process the data in accordance with COPPA; (iv) provide an easy means for consumers to revoke consent; and (v) not process personal data for targeted advertising purposes without consumer consent. The bill further outlined a processor’s responsibilities and required controllers to conduct a data protection assessment for each action that may present a risk of harm to a consumer. The act will go into effect on January 1, 2025.
New Hampshire amends rules for interest on escrow accounts
On June 20, New Hampshire enacted HB 520 (the “Act”) to amend provisions relating to escrow accounts maintained by licensed nondepository mortgage bankers, brokers, and servicers. The Act amends guidelines surrounding interest payments to escrow accounts maintained for the payment of taxes or insurance premiums related to loans on single family homes in New Hampshire and property secured by real estate mortgages. For both (single family homes and property) accounts, payments must be at a rate no less than the National Deposit Rate for Savings Accounts. Further, interest payments during the six-month period beginning on April 1 of each year, must be no less than the FDIC published rate in January of the same year, whereas interest payments during the six-month period beginning on October 1 of each year, must be no less than the FDIC published rate in July of the same year.
The Act was effective upon its passage.
New Hampshire clarifies licensing requirements
On May 27, the New Hampshire governor signed HB 312, which clarifies certain deadlines and provisions in consumer credit applications and licensing requirements for mortgage loan originators. Among other things, HB 312 states that company licensees or persons must “deliver to the commissioner a list of all New Hampshire consumers who have contracted with the licensee or with whom the licensee is otherwise engaged in business regulated under this chapter, and other requested lists summarizing the business of the licensee, within 7 days of receipt of the request” or be subject to a $50 fine per day for each day. The bill further stipulates that a “license shall not be issued and effective unless the applicant or licensee is licensed or registered in the state where its principal office is located.” This provision modifies the previous requirements, in that it is now only applicable to nondepository mortgage bankers, brokers, and servicers, but no longer applies to mortgage loan originators. Additional provisions address, among other things, “examinations of family trust companies, delegation by credit union boards to committees, qualifications of the banking commissioner, and authorizing depository banks to elect benefit corporation status.” The act takes effect 60 days after its passage.
New Hampshire issues guidance for reopening of branches of financial institutions
The New Hampshire Banking Department has issued guidance on the reopening of branches and other financial institution offices that were closed due to the Covid-19 pandemic. Banks or credit unions planning to reopen branch offices or other offices are requested to provide notice to the in the manner specified in the guidance and must also ensure that customers and members are aware of any planned reopening. Banks and credit institutions are urged to consult Emergency Order 40 for guidance on precautions to protect the safety of the institutions’ staff and customers.
New Hampshire bank regulator exempts PPP loans from legal lending limits
On April 3, the New Hampshire Banking Department issued guidance to state-chartered banks indicating that loans made under the Small Business Administration’s Payment Protection Program are exempt from applicable legal lending limits because the loans are guaranteed by the Small Business Administration.
New Hampshire issues FAQs on foreclosures during pandemic
On March 31, the New Hampshire Banking Department issued FAQs for consumers addressing foreclosures during the Covid-19 pandemic. The FAQs reiterate that New Hampshire Emergency Order #4 establishes a temporary prohibition on all foreclosures while New Hampshire’s Covid-19 state of emergency is in effect, and that the CARES Act gives borrowers with federally-backed mortgage loans the right to request a forbearance based on Covid-19 related financial hardship.
New Hampshire issues emergency order authorizing secure remote online notarization
On March 23, the New Hampshire governor issued an emergency order temporarily authorizing secure remote online notarization, with certain specified conditions. If state law requires an individual to appear personally before or be in the physical presence of a notarial officer at the time of a notarization, this requirement is satisfied if the individual and the notarial officer can communicate simultaneously by sight and sound through an electronic device or process at the time of the notarization. The order provides additional guidance on the signature, mailing, official date and time, and validity and recognition of the notarization.
New Hampshire issues executive order prohibiting evictions and foreclosures
On March 17, the New Hampshire governor issued an emergency order temporarily prohibiting evictions and foreclosures. All judicial and non-judicial foreclosure actions are prohibited during the declared State of Emergency, and all applicable provisions of any law, rule, or other regulation which would allow for the initiation of foreclosure proceedings are suspended for the same duration. However, the order does not relieve an individual of their obligations to pay rent, make mortgage payments, or any other obligation which an individual may have under a tenancy or mortgage.
New Hampshire Banking Department issues FAQs on mortgage foreclosure
On March 20, the New Hampshire Banking Department issued FAQs discussing mortgage foreclosures during the Covid-19 pandemic. Among other things, the FAQs clarified that New Hampshire Emergency Order #4 temporarily prohibits any judicial or non-judicial foreclosure action in New Hampshire during New Hampshire’s Covid-19 State of Emergency, regardless of where the lender is located.