This bill establishes comprehensive regulations for data brokers in New Jersey, focusing on the handling of sensitive personal information. It amends existing law to prohibit the sale of sensitive data by controllers, applicable to all individuals and entities regardless of data volume. Data brokers are required to register with the Division of Consumer Affairs, pay an annual fee of $5,500, and provide detailed information about their data collection practices, including opt-out options for consumers and a history of data breaches. Furthermore, they must maintain a public registry with their contact information and privacy policies, and failure to comply with registration requirements incurs a civil penalty of $2,500 for each day of non-compliance.

The legislation also mandates data protection assessments for controllers when processing activities pose a heightened risk to consumers, requiring an evaluation of the benefits and risks associated with data processing. These assessments must be available to the Division of Consumer Affairs upon request. The bill outlines specific exemptions for entities collecting personal data without a direct consumer relationship, such as regulated financial institutions, but clarifies that if they sell or license personal identifying information, they will still be classified as data brokers. Violations related to the sale or transmission of sensitive data will result in significant civil penalties of $50,000 for each record involved, thereby enhancing consumer privacy protections and accountability among data brokers in New Jersey.

Statutes affected:
Introduced: 56:8-166.12