The bill amends Section 9 of P.L.2023, c.266 (C.56:8-166.12) to enhance consumer protections regarding the processing of personal data. It requires data controllers to limit data collection to what is necessary for specified purposes, obtain consumer consent for processing sensitive data, and implement strong data security measures. Notably, the bill prohibits the sale of sensitive data and mandates that controllers provide a straightforward mechanism for consumers to revoke consent for data processing. Additionally, it requires data protection assessments for activities that pose a heightened risk of harm to consumers.

The legislation also establishes definitions for key terms such as "consumer," "data broker," and "data collector," and outlines their responsibilities concerning personal data. It mandates the creation of a public registry for data brokers and collectors, who must register annually and pay a fee based on the number of consumers whose data they handle. Certain entities, like financial institutions and healthcare providers, are exempt from these requirements. The bill imposes penalties for non-compliance, including a civil penalty of $2,500 per day for failure to register and a $50,000 penalty for each record of sensitive data sold or licensed in violation of the regulations. The Director of the Division of Consumer Affairs will adopt necessary rules for implementation, with the act taking effect immediately, though some provisions will remain inoperative for 270 days post-enactment.

Statutes affected:
Introduced: 56:8-166.12
Advance Law: 56:8-166.12