New Mexico Comprehensive Privacy Bill May Wait Until 2027
Efforts continue to pass a New Mexico comprehensive privacy bill that includes a private right of action, but logistical issues in the legislature could prevent the measure from getting a hearing in 2026, supporters said.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
New Mexico Rep. Pamelya Herndon (D) told Privacy Daily to wait for 2027. Herndon will bring back 2025’s HB-307, “but we won’t be bringing it back during the 2026 legislative session,” she said in an interview Monday. That’s because in even years, like 2026, New Mexico has a short, 30-day session, and the governor must approve which bills are heard. That’s not enough time, especially with other issues likely taking priority, said Herndon. So, “we decided we need to put this off until the next 60-day session,” which is in 2027.
“What we're trying to do is get all the parties back to the table again” to iron out what should and shouldn’t be covered by the privacy bill, said the legislator, adding that protecting youth and seniors drives her interest in data privacy. Herndon said she and “lots” of other people “think this is important to get it through, and I regret that we've had some disagreement on the different versions of the bill, but I believe that we will be successful in getting one through during the next 60-day session.”
In 2025, HB-307 had a Senate version (SB-420) by Sen. Katy Duhigg (D), as well as a rival House bill (HB-410) by Rep. Linda Serrato (D). The Duhigg and Serrato bills cleared their committees in March, though consumer advocates slammed HB-410 at a February hearing (see 2503030061 and 2502270010). Herndon said she hasn’t yet “had as strong a conversation with” the other bills’ sponsors as she “would like to have.”
Equality New Mexico Chief Liberation Officer Marshall Martinez told us Tuesday he will maintain “perpetual optimism” about passing a privacy bill in 2026 until it’s certain that the measure won’t be heard. Equality is a lead supporter of the privacy legislation known as the New Mexico Community and Health Information Safety and Privacy Act (CHISPA) that Duhigg and Herndon are sponsoring. American Civil Liberties Union of New Mexico and Bold Futures, plus 17 other community groups, are also sponsors.
CHISPA "ensures that big corporations, the federal government, and out-of-state prosecutors cannot weaponize our data to target trans individuals, immigrants, those receiving gender-affirming care, or people accessing reproductive healthcare," according to the groups' website. "These protections are essential to safeguarding our privacy and freedoms in an increasingly data-driven world."
While Martinez acknowledged 2026’s logistical difficulties, he said the plan is for the bill to be introduced during the 30-day session, regardless. Supporters of the Duhigg and Herndon proposal oppose Serrato’s separate privacy bill, but they expect that to be reintroduced, too. Serrato didn’t comment.
While Equality and other supporters have been working on the privacy bill since the last session ended, Martinez said the only substantive change for next year is to fold in a separate health data privacy measure (see 2502240017), which also stalled in 2025.
The groups want to go in a different direction than other states on privacy, which they frame as a “community safety issue” that outweighs tech companies’ concerns about complying with a state patchwork, he said. One key to that focus is to include a private right of action to supplement attorney general enforcement, said Martinez: New Mexico currently has a good AG, “but that’s not always going to be true,” so it’s important to give individuals the right to sue.