{"data":{"id":"us-nm/57-12c-11","jurisdiction":"us-nm","citation":"57-12C-11","heading":"Attorney general enforcement; civil penalty.","body":"A. When the attorney general has a reasonable belief that a violation of the Data Breach Notification Act has occurred, the attorney general may bring an action on the behalf of individuals and in the name of the state alleging a violation of that act.\nB. In any action filed by the attorney general pursuant to the Data Breach Notification Act, the court may:\n(1) issue an injunction; and\n(2) award damages for actual costs or losses, including consequential financial losses.\nC. If the court determines that a person violated the Data Breach Notification Act knowingly or recklessly, the court may impose a civil penalty of the greater of twenty-five thousand dollars ($25,000) or, in the case of failed notification, ten dollars ($10.00) per instance of failed notification up to a maximum of one hundred fifty thousand dollars ($150,000).","path":["Chapter 57 - Trade Practices and Regulations","ARTICLE 12C Data Breach Notification"],"source_url":"https://nmonesource.com/nmos/nmsa-unanno/en/item/18560/index.do","current_through":"2025-06-20","vintage":"","retrieved_at":"2026-09-03T15:02:20Z","sha256":"80587119d87fa62bba31a0e411d4673f56befed442e164782919c67b80494ad2","source_id":"us-nm","stale":false,"prev":"us-nm/57-12c-10","next":"us-nm/57-12c-12"},"notice":"GroundRules: Original legal text. Not legal advice."}