Big Tech lobbies New Mexico for AG-backed bill

This article was originally published by Source NM.

Two competing data privacy bills pending at the New Mexico Legislature appear aimed at protecting residents’ information online.

Both bills, if passed and signed into law, would protect New Mexicans’ personal data from disclosure without their consent, including information such as religious faith, consumer spending, health care and citizenship status. Both bills would also designate the New Mexico Department of Justice to write the rules to implement the law and take legal action to enforce it. 

But only one would protect tech companies from being sued directly by consumers for breaking the law.

With less than two weeks left in the session, two camps have emerged around the proposals: local community groups advocate for one bill, while the state’s attorney general and lobbyists for big technology companies back the other. National Big Tech watchdogs also warn that the bill backed by New Mexico Attorney General Raúl Torrez has some red flags.

Community Groups Back Senate Bill

Sen. Katy Duhigg (D-Albuquerque) introduced Senate Bill 420 on Feb. 17. The Senate Tax, Business and Transportation Committee on Feb. 27 passed the bill in a 5-4 party-line vote, with Republicans in opposition. It heads next to the Senate Judiciary Committee.

Numerous community groups turned out at the bill’s first hearing in support, including Planned Parenthood of the Rocky Mountains, the New Mexico Immigrant Law Center, Somos un Pueblo Unido, Bold Futures New Mexico, Conservation Voters New Mexico, the Center for Civic Policy and the National Organization for Women.

Representatives of these groups told the committee they back this bill because, for example, it would protect patients seeking abortion services from harassment or criminal prosecution where it’s illegal, and would protect immigrants from being targeted for deportation or criminalization.

Opponents included the New Mexico and Albuquerque Hispano chambers of commerce; TechNet, a trade association whose members include Apple, Google, Samsung and HP; and another trade group called the Consumer Data Industry Association.

“My understanding is there is a bill out there that all the tech guys want, and that I think that might have sign-on from the attorney general,” Duhigg told the committee. “I don’t think that is a bill that is going to protect New Mexicans. That is primarily for the benefit of the tech companies, not New Mexicans.”

In an emailed statement to Source NM on Wednesday, Duhigg confirmed she was referring to House Bill 410, a second data privacy bill being carried by Rep. Linda Serrato (D-Santa Fe).

House Bill Comes From ‘The Consumer Protector-in-Chief’

On March 3, New Mexico Attorney General Raúl Torrez posted a video to Instagram in which he talked about HB410, and another bill that would change his agency’s enforcement power.

In the video, Torrez said HB410 would give consumers the right to delete information they send to tech companies; request sharing information; and prohibit the federal government from unlawfully sharing their personal data. He described the two bills as “essential to protect consumers and everyday citizens.”

In an interview with Source NM on Wednesday, sponsor Serrato said HB410 is Torrez’s “brainchild,” and they started working together on it early in the session.

Serrato, who has been in the House of Representatives since 2020, carried the reproductive and gender affirming health care bill in 2023 ensuring New Mexicans can’t be prosecuted for the health care decisions they make. That year, she also co-sponsored an expansion of the state’s Human Rights Act that closed loopholes in state law that allowed for discrimination against transgender people.

“I’ve been pretty clear on my stances on protecting citizens and noncitizens, you know, folks in New Mexico,” she told Source NM.

In an emailed statement to Source NM on Thursday, Department of Justice Chief of Staff Lauren Rodriguez said Torrez supports Serrato’s bill rather than Duhigg’s because it puts New Mexicans in control of their personal data.

“The bill not only gives consumers a right to opt out of any data collection practices in the marketplace, but it is also the only bill in the United States to specifically protect citizens against the unlawful disclosure of sensitive data held by the federal government,” she said.

Part of HB410 “specifically empowers New Mexicans to take legal action if their information is unlawfully transferred to third parties by the likes of Elon Musk and his DOGE employees,” she said.

Big tech likes Serrato’s bill too.

Big Tech Visits New Mexico

Andrew Kingman, legal counsel for the State Privacy and Security Coalition, gave public comment via Zoom on Feb. 26 in support of HB410 before the House Commerce and Economic Development Committee.

The State Privacy and Security Coalition’s partners include Amazon, Google, Meta, Target and General Motors. “We work on these types of bills nationally,” Kingman told the committee.

An emailed request for comment from Kingman sent to the Coalition was not returned as of publication.

Kingman’s lobbying work has resulted in many states passing data-privacy laws that are relatively friendly to business, according to POLITICO. The news organization found the State Privacy and Security Coalition has lobbied in at least 32 states looking to pass data privacy regulations.

Kingman told the committee “our only major issue” with the version of HB410 being debated at the time was a provision titled Section 13, which would have required companies to create at least two ways for consumers to ask for copies of or to delete their data. He said that part was redundant with other parts of the bill.

He said he “would love to work with the sponsor on moving this bill forward, but without Section 13.”

Then on March 3, House Commerce held another hearing on HB410, during which Serrato introduced a substitute version. “The biggest change was that the Section 13 that gave folks a lot of concerns after many discussions, we entirely removed Section 13,” she told the committee.

After hearing testimony in support of HB410 from Kingman and some of the same groups who opposed SB420, the committee voted unanimously to pass HB410. It awaits a hearing in the House Judiciary Committee.

The version passed by House Commerce still allows consumers to request copies or deletion of their data, but no longer contains the provision requiring companies to create at least two user-friendly ways to do that. It allows companies to create “a secure and reliable means” of submitting a data request, and requires them to explain it to consumers in their privacy notice.

Serrato told Source NM that she met with Kingman in-person at the Roundhouse after the House Commerce committee passed her bill. She said while Kingman told her he agreed with the decision to remove Section 13, conversations with various businesses, not just him, led to the change.

“He was one of the conversations, I wouldn’t say he was the crux,” Serrato said.

Rodriguez, the AG’s chief of staff, did not respond to Source NM’s questions about Kingman’s lobbying efforts in New Mexico, including whether anyone from NMDOJ met with him while he was visiting, or whether the State Privacy and Security Coalition had any role in drafting HB410.

Should Consumers Be Allowed to Sue?

A key difference between the two bills is that Duhigg’s would allow a consumer to hold companies liable for violating the law and recover damages in court through what’s called a “private right of action,” while Serrato’s would not.

POLITICO found that all of the state laws Kingman has influenced keep citizens from directly suing companies for data privacy violations.

Serrato told Source NM her bill places enforcement entirely with the attorney general, without giving people the option to hire a lawyer and take the companies to civil court themselves. She said Torrez told her that he feels that consumer protection enforcement is part of his job and his office could handle the workload.

“We treat him — whether it’s unfair practices laws or what have you — as the consumer protector-in-chief, that’s how we look at him,” Serrato told Source NM. “He is the person, literally, who is equipped the best to take on a major company and actually win.”

But consumer privacy advocates caution against passing state laws that don’t allow people to directly sue corporations that run afoul of the law.

Hayley Tsukayama, associate director of legislative activism at the nonprofit Electronic Frontier Foundation, told Source NM that her organization has supported more narrow legislation that doesn’t allow consumers to sue, but when it comes to big comprehensive consumer data privacy bills, “EFF won’t support a bill that doesn’t have a strong private right of action.”

“If companies are violating the law, you should be able to sue them,” Tsukayama said. “People should be empowered to be their own privacy enforcers. They have a sense of what the costs are to them and their privacy the best. We believe that truly strong consumer privacy bills and honestly, most strong consumer bills, have a private right of action, because at the end of the day, it’s about what’s happened to the consumer, and they are the best person to judge that.”

She added that most states that limit consumer data privacy enforcement to state attorneys general often only have two or three attorneys responsible for an entire state, and “we just have not seen that much enforcement.”

“Even in states that have fairly strong laws, people have only taken a couple of actions on some of those laws in a couple years,” she said. “It takes a very long time to pull together those actions. It takes a lot of investigation. In terms of where that rubber actually hits the road and people actually get taken to task for what they’ve done, it can be really hard. It could be very few, and often only the worst companies.”

The House Commerce panel on March 3 also heard opposition to HB410 from Catrina Fitzgerald, deputy director of the Washington D.C.-based nonprofit Electronic Privacy Information Center. She said part of the problem with existing state data privacy laws is that they’re heavily influenced by big tech, and they don’t do enough to protect people online.

“They do little to change the status quo of companies being able to collect and use personal data however they like, as long as they tell us what they’re doing in a privacy policy that no one reads,” she said.

Fitzgerald said Serrato’s bill appears to be largely modeled on Connecticut’s data privacy law, which doesn’t allow consumers to sue.

She pointed the committee to a report published in January by her group and the U.S. Public Interest Research Group that scored state privacy laws. They gave Connecticut’s law a D grade, and described it as “a favored piece of template legislation for lobbyists, particularly in bluer states.”

Fitzgerald told the committee her group “would have much preferred” the identical House version of Duhigg’s bill, which Fitzgerald called “a much more pro-consumer bill.” Sponsor Rep. Pamelya Herndon, another Albuquerque Democrat, pulled HB307 and is a co-sponsor on Duhigg’s legislation. Herndon has not responded to requests for comment on this story.

HB410 also contains a grace period for companies that violate the law, giving them 30 days to fix it after prosecutors notify them.

Tsukayama, with EFF, said these 30-day cure periods have two problems: One, they don’t really result in repercussions for not complying with the law, and two, if you’re sharing information or not deleting it, the damage is done and the consumer can’t actually fix it.

“California actually eliminated its right to cure because, if you take all the time to pull together a case, and then you notify them, and they’re like, ‘Oh yeah, we fixed it,’ then you don’t move forward,” she said. “So what we’ve heard from other attorneys is, it’s a deterrent to enforcers to bring cases.”

Duhigg told Source NM in a written statement that the differences between her and Serrato’s bills amount to “a fundamental difference in priorities.” 

“Big tech companies want business as usual because their primary concern is protecting profits and maintaining data access,” she said. “Our concern is protecting New Mexicans. We’re focused on the safety and privacy of our communities at a time when digital exploitation has reached unprecedented levels.”

“Tech lobbyists are worried about quarterly earnings, while we’re worried about our neighbors, our families, and our children’s future,” Duhigg continued. “This isn’t about industry convenience—it’s about community protection when New Mexicans need it most.”