New Jersey Becomes First of the Year for State Privacy Laws
New Jersey became the thirteenth state (and the first of 2024) to enact data privacy legislation with Governor Phil Murphy signing the New Jersey Data Privacy Act (“NJDPA”) into law on January 16, 2024. Like most other states, vehicle performance data (“VPD”) is not directly addressed in the NJDPA, but it is certainly implicated.
VPD Provisions
The NJDPA does not specifically define “vehicle information” or include any provisions specific to VPD. However, the NJDPA does not apply to “the sale of a consumer’s personal data by the New Jersey Motor Vehicle Commission that is permitted by the federal “Drivers’ Privacy Protection Act of 1994.” S.B. 332 §6(e) (NJ. 2024).
The NJDPA defines “personal data” to mean “any information that is linked or reasonably linkable to an identified or identifiable person.” It does not include “de-identified” data or publicly available information. “Sensitive data” is defined to mean “personal data revealing racial or ethnic origin; religious beliefs; mental or physical health condition, treatment, or diagnosis; financial information, or credit or debit card number…genetic or biometric data that may be processed or for the purpose of uniquely identifying an individual; personal data collected from a known child, or precise geolocation.” It also includes sexual orientation, citizenship status, and transgender or non-binary status. S.B. 332 §1 (NJ. 2024).
It further defines “biometric data” to mean “data generated by automatic or technological processing, measurements, or analysis of an individual’s biological, physical, or behavioral characteristics…that are used or intended to be used…to identify a specific individual.” It does not include photographs, videos, or audio recordings unless the data is generated to identify an individual. S.B. 332 §1 (NJ. 2024).
A controller cannot process personal data for reasons that are not considered necessary without the consumer’s consent. S.B. 332 §9(4) (NJ. 2024).
Nothing in the NJDPA shall apply to “an insurance institution subject to P.L.198, c179 (C.17:23A-1 et seq.).” S.B. 332 §6(c) (NJ. 2024).
Privacy Law
New Jersey Data Privacy Act, effective January 15, 2025
The momentum from 2023 of comprehensive state data privacy laws doesn’t seem to be slowing down as over a dozen more states have introduced their own data privacy bills. It looks like New Hampshire will be the subject of our next update!
Copyright Nelson Law LLC
The opinions expressed in this blog are those of the author(s) and do not necessarily reflect the views of the Firm, its clients, or any of its or their respective affiliates. This blog post is for general information purposes and is not intended to be and should not be taken as legal advice.