iOn January 16, 2024, Governor Phil Murphy signed into law Bill 332, making New Jersey the 14th state with a comprehensive state privacy law. The law is set to take effect in January 2025.
Applicability
The law will apply to controllers that conduct business in New Jersey or produce products or services that are targeted to New Jersey residents, and that during a calendar year meet any of the following criteria: (1) control or process the personal data of at least 100,000 New Jersey consumers (notably excluding personal data processed solely for the purpose of completing a payment transaction); or (2) control or process the personal data of at least 25,000 New Jersey consumers and derive revenue, or receive a discount on the price of any goods or services, from the “sale” of personal data. In line with the CCPA and other state privacy laws, the New Jersey law broadly defines “sale” as the disclosure of personal data to a third party for “monetary or other valuable consideration.”
The law’s protections will apply to “consumers” (i.e., New Jersey residents acting only in an individual or household context, with an express exemption for individuals acting in a commercial or employment context). The law contains a narrow data-level (and not entity-level) HIPAA exemption, exempting PHI collected by a HIPAA covered entity or business associate. It contains a broader entity-level exemption under GLBA, exempting from application financial institutions, affiliates and data subject to GLBA. The law does not contain an exemption for non-profit organizations.
Controller Obligations
The law outlines a number of obligations for controllers.
Data Minimization and Purpose Specification – Similar to other comprehensive state privacy laws, the law requires controllers to limit the collection of personal data to what is adequate, relevant and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer. The law also requires controllers to specify the express purposes for which personal data is processed.
Privacy Notice – The law’s privacy notice requirements do not materially differ from other state privacy laws. The law requires controllers to provide a reasonably accessible, clear and meaningful privacy notice that includes: (1) the categories of personal data processed by the controller; (2) the purposes for processing personal data; (3) the categories of third parties to whom personal data is disclosed; (4) the categories of personal data shared with third parties; (5) how consumers may exercise their privacy rights, and how to appeal a controller’s decision on a privacy request; (6) how the controller notifies consumers of material changes to the privacy notice; (7) the privacy notice’s effective date; and (8) an active email address or other online mechanism that consumers may use to contact the controller.
Consent – The law requires controllers to obtain consumer consent to process: (1) “sensitive data” (e.g., race, religion, health, financial information, citizenship, children’s data (must be processed in accordance with COPPA)); (2) personal data for purposes that are not reasonably necessary to or compatible with the purposes for which the data originally was processed, as disclosed to the consumer; and (3) personal data of individuals between 13 and 17 years old for the purpose of selling the data, serving targeted advertising, or “profiling” the individual (where the profiling would result in legal or similarly significant effects).
Data Security – The law will require controllers to take reasonable measures (appropriate to the volume and nature of the personal data at issue) to establish, implement and maintain administrative, technical and physical data security practices to protect the confidentiality, integrity and accessibility of personal data and to secure personal data from unauthorized acquisition.
Data Protection Assessment – Like Colorado, the law will require controllers not to conduct processing that presents a “heightened risk of harm” to consumers without conducting and documenting a data protection assessment. The definition of heightened risk of harm includes: (1) the processing of personal data for targeted advertising purposes; (2) the “sale” of personal data; (3) the processing of “sensitive data;” and (4) the processing of personal data for the purposes of “profiling,” where such profiling presents a reasonably foreseeable risk of (a) unfair or deceptive treatment of, or unlawful disparate impact on, consumers, (b) financial or physical injury to consumers, (c) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers if the intrusion would be offensive to a reasonable person, or (d) other substantial injury to consumers.
Universal Opt-Out Mechanism – Beginning no later than six months following its effective date, the law will require controllers that engage in targeted advertising or the “sale” of personal data to allow consumers to exercise the right to opt out of such processing through a user-selected universal opt-out mechanism, which is expected to be further explicated in rules and regulations to be adopted by the Division of Consumer Affairs.
Consumer Rights
The law will provide consumers with the standard set of privacy rights: (1) access (as well as to confirm whether a controller processes the consumer’s personal data); (2) correction; (3) deletion; (4) data portability; and (5) opt-out of the processing of personal data for the purposes of (a) targeted advertising, (b) “sale,” and (c) “profiling” in furtherance of decisions that produce legal or similarly significant effects.
Like the other laws, controllers will have 45 days to respond to consumer rights requests, with a potential 45-day extension where reasonably necessary.
Enforcement and Promulgating Regulations
The law will be enforceable by the New Jersey Office of the Attorney General, and does not provide for a private right of action. The law requires the Director of the Division of Consumer Affairs to promulgate implementing rules and regulations, so forthcoming regulations are expected.
The law also provides a 30-day cure period for violations that will last for 18 months after the law’s effective date. If a violation is not cured, an enforcement action may be brought.
Effective Date
The law will become effective one year after its enactment date, which will be January 15, 2025.
