Businesses and organizations now require notification to consumers of collection and disclosure of personal data by certain entities
This past January, Governor Phil Murphy enacted the New Jersey Privacy Act, a comprehensive piece of legislation aimed at safeguarding the privacy rights of individuals in the state. Taking effect in January 2025, the law will require notification to consumers for the collection and disclosure of personal data by entities like online providers. The law cites commercial Internet websites and online services to notify consumers of collection and disclosure of personally identifiable information and allows consumers to opt out.
Businesses and services have until next year to better understand the law and how it could affect their practices. The new law requires a controller to provide notice to consumers of the collection and disclosure of “personal data,” as that term is defined in the bill, to third parties. The bill also sets forth various requirements concerning the information that is required to be included in this notice. The bill also imposes other requirements and limitations on controllers regarding the processing of personal data, including limiting the collection and processing of personal data, taking reasonable measures to protect personal data, and obtaining consumer consent before processing certain data. Specifically, the bill imposes additional restrictions on the processing of sensitive data, as defined in the bill, or the processing of a child’s personal data. Additionally, the bill requires a controller that processes personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer to allow consumers to exercise the right to opt-out of such processing through a user-selected universal opt-out mechanism.
Find Bills and Joint Resolutions online here.
