It looks like 2024 will be another big year for data privacy. Just eight days into January, the New Jersey Legislature passed Senate Bill 332, the country’s latest comprehensive consumer privacy law. The bill was signed a week later by Governor Phil Murphy.
Operating within an increasingly complex patchwork of state privacy rules, many businesses are now wondering: What does the New Jersey law mean for privacy compliance?
The New Jersey privacy law will go into effect on January 15, 2025.
S332 applies to any person or organization that does business in the state of New Jersey or targets its products or services toward state residents, and meets at least one of the following requirements:
The most notable difference from the thresholds in other states is the second option, related to the sale of personal data. There is no minimum percentage of revenue a business must receive from the sale of data for this to apply; ANY sale of personal data, in combination with controlling or processing the data of at least 25,000 consumers, will trigger this threshold. What’s more, it explicitly states that providing consumers' personal data in exchange for a discount is considered a sale. Many businesses will have to take a close look and determine if any of their data practices could be considered “selling” before dismissing S332 as not applicable.
S332 has many (but not all) of the same exemptions as other laws, including for government bodies and personal data already regulated by federal laws such as the GLBA or HIPAA. However, nonprofit organizations do not appear to be exempt from compliance. This means New Jersey is joining the growing list of states, along with Colorado, Oregon, and Delaware, whose privacy laws apply to nonprofits.
S332 gives consumers the following rights.
Starting six months after S332's effective date, businesses will be required to respect universal opt-out mechanisms, such as Global Privacy Control (GPC), on their websites. This means that any user with GPC enabled on their browser should be treated as if they have submitted on opt-out request.
Personal data is “any information that is linked or reasonably linkable to an identified or identifiable individual.” Deidentified data or publicly available information is excluded from this definition.
Personal data is more than just names and email addresses, though, and can cover anything from IP addresses to internet cookies to shopping habits.
The New Jersey law requires organizations to perform data protection assessments for certain types of processing activities that present a “heightened risk of harm” to consumers. This includes:
The statute does not provide a specific penalty for violations, but states that a violation shall be considered an unlawful practice under New Jersey’s consumer protection laws. The penalty for violating these laws is up to $10,000 for the first offense, and up to $20,000 for each subsequent offense.
Initially, the Attorney General's Office must give businesses 30 days to cure any alleged violations. This mandatory cure-period provision sunsets after 18 months.
S332 does not grant a private right of action to consumers, meaning they cannot sue an organization over alleged violations. Only the New Jersey Attorney General’s Office has authority to enforce the law.
The pace of state privacy legislation is picking up, with many more states likely to pass their own laws in the near future. With each new law, compliance becomes a little more complicated to manage, especially for businesses without in-house privacy experts.
TrueVault US helps businesses of all sizes get compliant with privacy laws from across the country with one streamlined platform. Built by attorneys, TrueVault US is a software solution that guides you at every step of the way, from onboarding vendors to responding to consumer privacy requests.
To learn more about how TrueVault US can help your business, contact our team today.
Disclaimer: This content is provided for general informational purposes only and does not constitute legal advice. This content is not a substitute for obtaining legal advice from a licensed attorney. The information on this page may be changed without notice and is not guaranteed to be complete, correct or up-to-date, and may not reflect the most current legal developments.