New Mexico State Personnel Office Logo

Memorandums

Back to Memorandums
  • Michelle Lujan Grisham
    Governor
  • Dylan K. Lange
    Director
  • Cynthia Sandoval
    Deputy Director
  • State Personnel Board
  • David F. Cunningham, Chair
  • Carol A. Parker, Vice Chair
  • Kari Fresquez, Member
  • Sandra D. Lopez, Member
  • Fred Radosevich, Member

Address: 2600 Cerrillos Road, Santa Fe, NM 87505-3258
Phone: (505) 476-7759 | Fax: (505) 605-4981 | Web: https://www.spo.state.nm.us/

General Memorandum 2025-007

Date:

July 30, 2025

To:

Cabinet Secretaries, Agency Heads and HR Managers

From:

Dylan K. Lange, DirectorSPO Director, Dylan K. Lange, Intials

Subject:

Nondisclosure of Sensitive Personal Information

This memorandum provides notice to agencies regarding the Nondisclosure of Sensitive Personal Information Act (the “Act”) that went into effect July 1, 2025. See attached NMSA 1978, Sections 10-16I-1 to 4 (2025).

The Act prohibits state agency employees from intentionally disclosing sensitive personal information, which includes an individual’s status as a recipient of public assistance or a crime victim; an individual’s sexual orientation, gender identity, physical or mental disability, medical condition, immigration status, national origin or religion; and social security number or tax identification number.

Disclosure of sensitive personal information is permitted in specific circumstances, such as when necessary for agency function, required by court order or subpoena, mandated by state or federal law, or with the individual’s written consent. Other exceptions include disclosures under the Inspection of Public Records Act, to state contractors under specific conditions, under the Whistleblower Protection Act, and when expressly permitted by the Health Insurance Portability and Accountability Act (HIPAA).

Enforcement of the Act may be pursued by the New Mexico Attorney General, district attorneys, and the State Ethics Commission. Civil penalties can reach up to $5,000 per violation. Improper disclosure by Motor Vehicle Division employees or contractors related to immigration enforcement can also lead to a misdemeanor charge and penalties under state law.

Please share this information with your employees. If your agency has any policies addressing confidentiality and/or the disclosure of personal information, please review those policies and ensure that they comply with the Act.

ARTICLE 16I
Nondisclosure of Sensitive Personal Information

10-16I-1. Short title.

Sections 1 through 4 [10-16I-1 to 10-16I-4 NMSA 1978] of this act may be cited as the "Nondisclosure of Sensitive Personal Information Act"

10-16I-2. Definitions

As used in the Nondisclosure of Sensitive Personal Information Act:

  1. "sensitive personal information" means an individual's:
    1. status as a recipient of public assistance or as a crime victim;
    2. sexual orientation, gender identity, physical or mental disability, medical condition, immigration status, national origin or religion; and
    3. social security number; and
  2. "social security number" includes an individual tax identification number.

10-16I-3. Sensitive personal information; exceptions.

A state agency employee shall not intentionally disclose sensitive personal information acquired by virtue of the employee's position with a state agency to anyone outside the state agency except when such disclosure is:

  1. necessary to carry out a function of the state agency;
  2. necessary to comply with an order or subpoena issued by a court of this state or a United States district court;
  3. required by the Inspection of Public Records Act [Chapter 14, Article 3 NMSA 1978];
  4. required by federal statute;
  5. made to or by a court or administrative tribunal in the course of a judicial or administrative proceeding or made in a court or administrative tribunal record;
  6. made to a state contractor that needs the sensitive personal information to perform the contractor's obligations under the contract and has agreed in writing to be bound by the same restrictions on disclosure that are imposed on state employees by this section;
  7. made pursuant to the Whistleblower Protection Act [10-16C-1 to 10-16C-4 NMSA 1978];
  8. expressly permitted by the federal Health Insurance Portability and Accountability Act of 1996 and associated regulations; or
  9. made with the written consent of the person whose information would be disclosed.

10-16I-4. Enforcement; penalties.

The attorney general, a district attorney and the state ethics commission may institute a civil action in district court if a violation has occurred or to prevent a violation of the Nondisclosure of Sensitive Personal Information Act. Penalties for a violation of that act shall be a civil penalty of two hundred fifty dollars ($250) for each violation, but not to exceed five thousand dollars ($5,000).