New Jersey has enacted significant amendments to its privacy laws that immediately prohibit the sale of sensitive personal data and establish a new regulatory framework for certain data brokers and data collectors. Unlike many state privacy laws, key portions of this legislation became effective immediately upon enactment, creating potential compliance obligations without the customary implementation period.
Organizations that conduct business in New Jersey or target products or services to New Jersey residents should promptly evaluate whether their existing data collection, sharing, licensing, marketing, analytics, and commercial data practices may be affected. Notably, certain provisions may apply even to organizations that do not otherwise meet the threshold requirements of the New Jersey Data Privacy Act.
Why This Matters
The legislation represents a significant shift in state privacy regulation. Rather than relying solely on notice-and-consent requirements, New Jersey has adopted an outright prohibition on certain activities involving sensitive data.
Perhaps most notably, the prohibition on selling sensitive data applies regardless of the volume of consumer data processed. As a result, organizations that previously believed they fell outside the scope of New Jersey privacy requirements may nevertheless be subject to these new restrictions.
What Is Considered Sensitive Data?
The law defines “sensitive data” broadly and includes categories such as:
· Racial or ethnic origin
· Religious beliefs
· Physical or mental health conditions, treatment, or diagnoses
· Certain financial account information
· Sexual orientation or sex life
· Citizenship or immigration status
· Transgender or non-binary status
· Certain genetic and biometric information
· Information collected from known children
· Precise geolocation information
Businesses should not assume they do not possess sensitive data. Many websites, mobile applications, healthcare organizations, financial institutions, wellness providers, and
consumer-facing businesses routinely collect one or more of these categories of information.
New Restrictions
The legislation generally prohibits the sale of sensitive data by controllers and separately prohibits certain data brokers and data collectors from selling or licensing sensitive data, subject to statutory exceptions. [Re: New Je…ctive now. | Outlook]
The law also establishes a new regulatory framework for qualifying data brokers and data collectors, including registration, annual reporting, public disclosure, and fee requirements. While some registration provisions become effective on a delayed basis, the substantive restrictions on the sale of sensitive data are already in effect.
Potential Penalties
The legislation authorizes significant civil penalties, including:
· Penalties for failures relating to required registration and reporting obligations
· Civil penalties of up to $50,000 per record for violations involving the sale or licensing of sensitive data
Organizations whose business models involve the commercialization, sharing, licensing, or exchange of personal information should carefully evaluate their exposure under the new law.
Recommended Immediate Actions
Organizations should consider:
· Identifying whether they collect or process any categories of sensitive data covered by the statute
· Reviewing whether sensitive data is sold, licensed, exchanged for valuable consideration, or otherwise disclosed in a manner that could constitute a statutory sale
· Inventorying third-party data-sharing arrangements, marketing technologies, analytics providers, advertising relationships, and data licensing arrangements
· Determining whether they may qualify as a data broker or data collector under the statute
· Reviewing privacy notices, consent mechanisms, and vendor agreements
· Evaluating whether additional governance documentation or data protection assessments should be prepared
· Monitoring future guidance and regulations issued by New Jersey regulators
How We Can Help
Mandelbaum Barrett’s Cybersecurity & Data Privacy team is actively evaluating the scope and practical implications of this legislation. We assist organizations with:
· Applicability assessments
· Data mapping and data flow reviews
· Evaluation of data-sharing and commercialization practices
· Vendor and contractual reviews
· Privacy policy updates
· Regulatory risk assessments
· Data broker and data collector analyses
· Broader privacy governance and compliance planning
If you have questions regarding how these developments may affect your organization, please contact Steven W. Teppler, Chair of Mandelbaum Barrett PC’s Cybersecurity & Data Privacy Practice Group.