The "Community and Health Information Safety and Privacy Act" aims to enhance consumer privacy protections in New Mexico by establishing clear definitions and responsibilities for covered entities regarding the handling of personal data. The bill introduces new legal language that defines terms such as "covered entity," "personal data," and "sensitive personal data." It mandates that these entities configure default privacy settings that prioritize consumer privacy, particularly for minors, and provide options for consumers to manage their data preferences. Additionally, the act prohibits practices like profiling consumers by default and processing sensitive personal data without explicit opt-in consent, ensuring that consumers are informed and can exercise their privacy rights without being misled.

The bill also includes significant amendments that require covered entities to obtain explicit consumer consent for the collection and processing of sensitive personal data, provide clear disclosures about data usage, and grant consumers the right to access, correct, and delete their personal data. It prohibits retaliation against consumers for exercising their rights and declares any contractual clauses that limit these rights as void. The act outlines penalties for violations and allows consumers to seek legal recourse, while also ensuring compliance through data processing agreements between service providers and covered entities. Exceptions are specified for compliance with certain federal data privacy laws, and the act will take effect on July 1, 2026.