Private Right of Action, Lack of Privacy Law Debated as N.M. Advances AI Bill

Introduced by Rep. Christine Chandler (D), the Artificial Intelligence Act (HB-60) is similar to proposals in Texas, Connecticut, California and Virginia that target high-risk AI systems and adverse impacts on consumers.

HB-60’s private right of action and potential conflicts with the Gramm-Leach-Bliley Act (GLBA) drew opposition from stakeholders Thursday. Tech industry representatives told the panel to focus on passing a comprehensive privacy law before regulating specific uses of AI technology. The bill passed the House Consumer & Public Affairs Committee 4-1 with Rep. John Block (R) opposed after questioning the bill’s broad definitions.

HB-60’s Section 8.A.1 would require companies to notify consumers each time a high-risk AI system is used to make a consequential decision about them, said Robert Singleton, a policy director at Chamber of Progress. This raises data privacy concerns because it could result in companies divulging sensitive information about algorithms and data processing methods, he said. AI-related social justice concerns are warranted, but pinpointing the source of discrimination in an AI system isn’t always possible, said Singleton.

New Mexico should pass a comprehensive privacy law with clear data privacy rights for consumers before trying to regulate AI systems, an approach many other states are taking, said Renzo Soto, TechNet’s southeast director. HB-60 shares a lot of similarities to the Colorado AI Act, a largely untested law Colorado legislators are now working to amend, he said. Soto added that HB-60’s private right of action will hinder development of AI technology.

New Mexico can pursue legislation on both AI and comprehensive privacy, Chandler told the committee. She said she’s heard there are plans to introduce a comprehensive privacy bill this session. “It just strikes me as another argument to kick this very important issue down the road,” she said. “We can do both and work on multiple issues at the same time.” She told the committee that the GLBA will supersede any finance-related provisions in HB-60 that might conflict.

Privacy is the foundation for AI regulation, and New Mexico should set clear limits on data collection, use, sharing and retention before passing AI legislation, said William Chanes Martinez. He’s an attorney for the State Privacy & Security Coalition, a group that represents 30 companies, including Google, Meta, Capital One, H&R Block, Mastercard, Nike and Target. Colorado, Connecticut and Oregon have all recognized the need to pass a privacy law before passing AI-specific regulation, he said. Colorado is now revising its AI law, and the proposal in Connecticut failed last session due to its complexity, he said. Passing HB-60 without a privacy law in place would leave unanswered questions about consumer protection, data processing and enforcement, he said.

The American Civil Liberties Union and New Mexico-based consumer groups spoke in support of HB-60. Algorithm-based data processing is ingraining systemic racism and discrimination, the ACLU said. Rachel Arrey said her organization, Bold Futures, which advocates for women and people of color, supports HB-60’s “common sense” protections for data privacy and safeguards against discrimination. Luca Ceccarelli, founder of aiSynergy.net, said regulations are needed to stop the reinforcement of bias in education.

Donald Maurice, an attorney with the Receivables Management Association International, said bankers and lenders are opposed to the legislation because of potential regulations duplicating what’s already required under the GLBA. The GLBA empowers the FTC with the safeguards rule, which has stringent data privacy requirements for the financial sector, he said. He urged New Mexico not to become the first state to pass a private right of action in a regulation targeting high-risk AI systems.

Chandler said the bill will force companies to protect consumers against “known and foreseeable risks” of algorithmic discrimination through its “duty of reasonable care.” She noted the bill requires certain disclosures by developers and deployers of AI systems. This includes deployers publishing descriptions of high-risk systems on their websites and informing consumers when a high-risk system is used to make consequential decision. A deployer must provide additional information when an adverse decision is made impacting a consumer and give the consumer the right to correct any incorrect information, she said. In addition to the private right of action, the bill grants to the New Mexico attorney general with enforcement and rulemaking authority.