dark patterns<\/a><\/em><\/li>\n<\/ul>\nConsumer under the NJDPA<\/strong><\/p>\nRefers to \u201can identified person who is a resident of this State acting only in an individual or household context<\/em>.\u201d<\/p>\nFor additional clarity, the law also notes the following, which is commonly included language in the other US privacy laws: \u201cConsumer\u2019 shall not include a person acting in a commercial or employment context<\/em>\u201d.<\/p>\nController under the NJDPA<\/strong><\/p>\nWill largely apply to companies, but the specific language refers to \u201can individual, or legal entity that, alone or jointly with others determines the purpose and means of processing personal data<\/em>\u201d.<\/p>\nProcessor under the NJDPA<\/strong><\/p>\nA processor is defined as \u201c a person, private entity, public entity, agency, or other entity that processes personal data on behalf of the controller<\/em>\u201d. It could include third parties like advertising partners or fulfillment companies.<\/p>\nProfiling under the NJDPA<\/strong><\/p>\nProfiling is increasingly becoming a standard inclusion in data privacy laws, particularly as it can relate to \u201cautomated decision-making\u201d or the use of AI technologies. The New Jersey data protection law defines profiling as \u201cany form of automated processing performed on personal data to evaluate, analyze or predict personal aspects related to an identified or identifiable individual\u2019s economic situation, health, personal preferences, interests, reliability, behavior, location or movements<\/em>\u201d.<\/p>\nTargeted advertising under the NJDPA<\/strong><\/p>\nThis is also increasingly becoming a standard inclusion in data privacy laws, and can refer to the use of emerging technologies like AI tools.<\/p>\n
The New Jersey data privacy law defines targeted advertising as \u201cdisplaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred from that consumer\u2019s activities over time and across nonaffiliated Internet websites or online applications to predict such consumer\u2019s preferences or interests<\/em>.\u201d<\/p>\nThe following are not included in the definition of targeted advertising:<\/p>\n
\n- advertisements based on activities within a controller\u2019s own Internet websites or online applications<\/em><\/li>\n
- advertisements based on the context of a consumer\u2019s current search query, visit to an Internet website, or online application<\/em><\/li>\n
- advertisements directed to a consumer in direct response to the consumer\u2019s request for information or feedback<\/em><\/li>\n
- processing personal data solely to measure or report advertising frequency, performance or reach<\/em><\/li>\n<\/ul>\n
Sale under the NJDPA<\/strong><\/p>\nRefers to \u201cthe sharing, disclosing, or transferring of personal data for monetary or other valuable consideration by the controller to a third party<\/em>\u201d.<\/p>\nExclusions to the definition of sale include disclosures of personal data:<\/p>\n
\n- to a processor that only processes the personal data on the controller\u2019s behalf<\/li>\n
- to a third party for purposes of providing a product or service requested by the consumer<\/li>\n
- or transfer of personal data to an affiliate of the controller<\/li>\n
- that the consumer intentionally made available to the general public through a mass media channel and did not restrict to a specific audience<\/li>\n
- or transfer of personal data to a third party as an asset that is part of a proposed or actual merger, acquisition, bankruptcy, or other similar transaction in which the third party assumes control of all or part of the controller\u2019s assets<\/li>\n<\/ul>\n\n\n
What is covered in the New Jersey Data Privacy Act?<\/h2>\n
The NJDPA mainly affects commercial companies, but it can potentially apply to any organization processing personal data that meets the compliance threshold criteria.<\/p>\n
Who has to comply with the New Jersey data privacy law?<\/h4>\n
The New Jersey privacy law\u2019s compliance thresholds are fairly standard compared to other fairly populous states\u2019 laws. The NJDPA continues a trend in US state-level privacy laws in having no revenue-only threshold for compliance, i.e. a company making X amount of revenue has to comply, solely based on that dollar amount and no other factors.<\/p>\n
The compliance thresholds are for the preceding calendar year if an organization:<\/p>\n
\n- controls or processes the personal data of at least 100,000 New Jersey residents, excluding personal data controlled or processed solely for the purpose of completing a payment transaction<\/li>\n<\/ul>\n
or<\/p>\n
\n- controls or processes the personal data of at least 25,000 New Jersey residents and derives revenue or receives a discount of any amount on the price of goods or services from the sale of personal data<\/li>\n<\/ul>\n
Exemptions to New Jersey Personal Data Privacy Act compliance<\/h4>\n
The NJDPA\u2019s exemptions are fairly standard, and include health information protected by federal law, like the Health Insurance Portability and Accountability Act (HIPAA) or Health Information Technology for Economic and Clinical Health Act (HITECH), or financial information handled by financial institutions or affiliates subject to the Gramm-Leach-Bliley Act (GLBA).<\/p>\n
Further exempted institutions include insurance institutions, secondary market institutions, and consumer reporting agencies. Additional exempted regulations include the Fair Credit Reporting Act (FCRA) and New Jersey\u2019s Motor Vehicle Commission under the Driver\u2019s Privacy Protection Act (DPPA).<\/p>\n
Nonprofit organizations are not exempt under the NJDPA as they are under some other states\u2019 laws, nor can the Family Educational Rights and Privacy Act (FERPA) be used for exemption purposes.<\/p>\n\n\n
Consumers\u2019 rights under the New Jersey consumer protection law <\/h2>\n
Consumers\u2019 rights under the NJDPA are fairly standard compared to other comprehensive privacy laws in the US:<\/p>\n
\n- Right to access<\/strong>: confirmation if the controller is processing the consumer\u2019s personal information and access to that data and information about third parties it\u2019s shared with, with exceptions<\/li>\n
- Right to disclosure<\/strong>: a list of the categories of third parties to which the controller has disclosed the consumer\u2019s personal data<\/li>\n
- Right to correction<\/strong>: any inaccurate or outdated information the controller has that was provided by the consumer<\/li>\n
- Right to delete<\/strong>: any personal data the controller has about or from the consumer (with some exceptions)<\/li>\n
- Right to portability<\/strong>: obtain a copy of the consumer\u2019s personal data that the consumer previously provided to the controller, in a readily usable format, with some exceptions<\/li>\n
- Right not to be<\/strong> discriminated against: controllers cannot unlawfully discriminate against consumers, including for exercising their rights<\/li>\n
- Right to opt out<\/strong>: of sale of personal data, targeted advertising, or profiling \u201cin furtherance of decisions that produce legal or similarly significant effects concerning a consumer\u201d<\/li>\n<\/ul>\n
Consumers can designate an authorized agent to opt out of personal data processing for them. This is particularly relevant as the NJDPA includes a requirement for controllers to recognize the universal opt-out signal.<\/p>\n
Coverage for children under the NJDPA<\/h4>\n
Parents or legal guardians can exercise the rights of children, defined as under 13 years of age, whose data is considered sensitive by default. The NJDPA uses COPPA for its definition of a child.<\/p>\n
Controllers are also required to obtain prior consent for the processing of personal data belonging to people between 13 and 17 years of age if it\u2019s for the purposes of targeted advertising, sales, or profiling in furtherance of decisions that produce legal or similarly significant effects.<\/p>\n
Consumer requests under the NJDPA<\/h4>\n
Consumers can make one free request to a controller to exercise their rights, e.g. getting a copy of their data, every 12 months. A controller can deny requests from a consumer that are \u201cmanifestly unfounded, excessive or repetitive\u201d, or they can charge the consumer a reasonable fee to cover the administrative costs of complying with such a request. The controller is responsible for demonstrating that request is unfounded, etc., however.<\/p>\n
Reasonable reasons to deny a request could also include if the consumer\u2019s identity cannot reasonably be verified, or if too many requests are received in a 12-month period.<\/p>\n
An organization has 45 days from receiving a consumer\u2019s request to respond, though they have the option to extend that by another 45 days if reasonably necessary., e.g. if fulfilling the request would be very complex or the controller has a great many requests to fulfill. If the controller extends the response period for a request, they must notify the consumer that they will do so before the original 45-day response period has expired, and must provide a reason for the extension.<\/p>\n
Private right of action under the NJDPA<\/h4>\n
California continues to be the only US state that enables privacy right of action under their data privacy law. That means that consumers can sue controllers in the event of a violation of the law. New Jersey\u2019s law does not include private right of action, and enforcement falls under the state\u2019s Office of the Attorney General.<\/p>\n\n\n
How does the new New Jersey Data Privacy Act affect businesses?<\/h2>\n
The NJDPA is fairly similar to other US privacy law requirements regarding notifications, data access, use, and security. The law also includes particular responsibilities for data processors, particularly relating to complying with controllers\u2019 requirements, assisting with enabling consumers to exercise their rights, e.g. with access requests, and ensuring adequate safeguards for collected data.<\/p>\n\n\n
\n
\n
\n
Find out how Usercentrics can help you achieve compliance with NJDPA<\/div>\n <\/div>\n