Starting in mid-2025, companies doing business in New Jersey will be required to notify consumers and allow them to opt-out when collecting personal information online.
New Jersey becomes the 13th state to pass similar data privacy rules, and several other state legislatures have bills pending. But some business leaders and the state’s largest media outlets argue that New Jersey’s new requirements go further than other states and that the bill’s language could open the door to overreaching lawsuits. ing.
Websites that collect data from more than 100,000 people a year would be required to notify each consumer and provide an opt-out option, according to a bill signed by Gov. Phil Murphy on Jan. 17. . The threshold will be lowered to 25,000 consumers. 1 year if the website sells personal data.
The state’s data privacy law has been heavily lobbied by technology companies such as Amazon, Google and Meta. The companies spent more than $50 million in 2022 on federal lobbying efforts on issues such as privacy and competition, and a federal bill enacting similar protections stalled in 2022 after gaining bipartisan support, Bloomberg reported. It was reported last year. Tech companies have also been lobbying state legislators hard.
New Jersey’s law is considered one of the strictest in the nation, said state Sen. Raj Mukherji, a Jersey City Democrat who introduced the bill in the last Congress when he was a lawmaker.
“We have the strongest universal opt-out mechanism of any data privacy law in the country,” Mukerji said. “And it just puts consumers back in control of their own data.”
Generally, if a website complies with state privacy laws, it will display a message informing users that personal data is being collected and offering an opportunity to opt-out. The data collected ranges from very personal information collected on dating and health apps to information about what you read, buy, and subscribe to online.
Mukherji said New Jersey’s laws are more advanced than other states, and require companies to require customers to know before collecting data on certain types of highly sensitive information, such as biometric data collected by health apps. They say they are required to explicitly ask people to opt-in. However, the law does not specify how sites and apps seek permission, leaving that decision up to companies.
“This important legislation will help consumers regain control over their personal data and give them the choice to share information that is personal to them,” Murphy said in a press release after signing the bill. said.
The bill was under consideration for two years and was rushed to the finish line in the final days of the 2022-23 legislative session with amendments that angered the New Jersey Chamber of Commerce.
“The business community supports consumer data privacy. We just want a bill or law that works,” said Ray Cantor, a lobbyist for the group. “There are ambiguous provisions in the bill. There are contradictory provisions.”
For example, Cantor said the term “financial data” is not defined in the bill and could have different meanings. He said some of the language in New Jersey’s bill differs from other states in terms of how different types of data must be processed, making it difficult for companies operating nationally to update their systems. It has become difficult to comply with other state laws, he added.
Lawmakers removed language dealing with lawsuits over privacy violations. Cantor said companies that operate across state lines can run into differences in state rules and face lawsuits.
“We were very comfortable with the enforcement of the violations by the Attorney General’s Office,” Canter said. “What we didn’t want, and what we think this bill would allow, is for private lawyers to file class action lawsuits for technical violations, and that’s very concerning. It does not promote data privacy and is of no use to anyone other than the lawyers filing these types of lawsuits.”
But Mukherji said the law would indeed be enforced by the attorney general, and the removed language would prevent consumers from filing lawsuits related to the previous privacy law.
“We are not going to take away the rights of consumers under other existing frameworks and make their lives even worse. I mean, it was unfair,” Mukherji said. “So that argument is a red one for me.”
In his signing statement, Murphy pointed to criticism from the business lobby.
“I understand that concerns have been raised that removing that language would establish a private right of action under other laws for violations of this bill. ,” Murphy wrote. He added that nothing in the bill explicitly provides for a right for consumers to sue, and that the Attorney General will establish appropriate action against violators.
Earlier this month, the New Jersey Press Association, which represents hundreds of newspapers and other newsrooms, asked the governor to veto the bill, citing concerns that it would “capture professional reporting.” They sent a letter requesting that the law be activated, expressing concern that someone may try to obtain information. Despite First Amendment protections, news organizations remove or change information published about them.
The Press Association asked for the bill’s language, saying it would not apply to those who work professionally in news media “for the purpose of gathering, procuring, disseminating, compiling, editing, or disseminating news for the general public.” And he specifically cited exemptions in other states’ laws that exempt journalism.
But Mukherji said there is nothing in the law that affects journalism in New Jersey.
Mukherji said the attorney general’s office will hold public hearings before drafting detailed regulations setting out exactly how the new law will operate, a process all bills pass. This law will go into effect in January 2025, and implementation will begin six months after that.
