New Jersey Enacts Comprehensive Data Privacy Law: Key Provisions and Requirements

New Jersey Makes History by Enacting Comprehensive Data Privacy Law

In a groundbreaking move, New Jersey has become the first state to enact a comprehensive data privacy law in the new year. Governor Phil Murphy signed the New Jersey Privacy Act (NJPA) into law on January 16, 2024, with the law set to go into effect on January 15, 2025. This new law places New Jersey at the forefront of data privacy legislation, joining other states like Connecticut and Colorado in demanding more from companies when it comes to protecting consumer data.

The NJPA includes key provisions that outline obligations for both controllers and processors, as well as granting consumers important rights regarding their personal data. Some of the key provisions of the law include requirements for data minimization, data security, opt-in consent for sensitive data, and protections for children under 17. The law also recognizes universal opt-out mechanisms for targeted advertising and expands exemptions for fraud detection.

The law applies to both controllers and processors who conduct business in New Jersey or target New Jersey residents, with specific thresholds for the number of consumers whose data is processed. The NJPA defines personal data as information linked to an identified or identifiable person, with a focus on protecting sensitive data such as financial information and data related to a child’s identity.

Notably, the NJPA does not contain a private right of action, with enforcement falling under the jurisdiction of the Attorney General’s office. The law also empowers the Director of the Division of Consumer Affairs to issue additional rules in the future to ensure compliance with the law.

Overall, the New Jersey Privacy Act represents a significant step forward in data privacy regulation, setting a high standard for companies operating in the state. With its comprehensive provisions and focus on consumer rights, the NJPA aims to protect the personal data of New Jersey residents and hold businesses accountable for how they handle sensitive information.