New Mexico Privacy Enforcement Cases

Why the action was brought

New Mexico alleged that Google improperly collected and disclosed minor students’ personal data through Workspace for Education products. The allegations also concerned Google Play app developers mislabeling child-directed apps to obtain targeted advertising and user-profiling revenue, and apps collecting information from children under 13 without adequate age screening or parental visibility.

Why the action was brought

Equifax’s 2017 data breach exposed information of more than 147 million consumers, including more than 860,000 New Mexicans: Social Security numbers, names, birth dates, addresses, credit card numbers, and some driver’s-license numbers. Equifax failed to maintain reasonable security, patch a known critical vulnerability, or replace monitoring software, allowing attackers to steal data undetected for more than two months.

Why the action was brought

Blackbaud’s software stored highly sensitive constituent information, including Social Security and driver’s-license numbers, financial and health information. Attorneys general alleged Blackbaud failed to implement reasonable security, remediate known gaps, and timely, completely, or accurately notify customers after a 2020 ransomware breach exposed information involving more than 13,000 customers and millions of consumers.