Duty LXD-0232
Crawls the web, in New Jersey
New Jersey Computer Criminal Activity, objective reasonable-person authorization testsince 2 lines
N.J. Stat. § 2C:20-25 · Read the law's page
- Whether your access to a New Jersey-connected system is authorized turns on the permission of the person with lawful authority to give it and, alternatively, on whether a reasonable person would believe the access was authorized; an open, unrestricted page with no login wall or technical block tends to favor a reading of authorized access, though no New Jersey court has applied this to a scraping fact pattern.
- There is no statutory notice-based revocation mechanism here, and no New Jersey decision holds that a bare demand letter alone ends authorization, but a clear written demand to stop weakens any reasonable belief that continued access is authorized.
Identity Theft Prevention Act, methods of destruction of customer recordssince 3 lines
N.J. Stat. Ann. § 56:8-162 (L. 2005, c.226, s.11) · Read the law's page
- This binds any business or public entity holding a customer's records containing personal information within its custody or control, whether or not the entity is otherwise subject to the New Jersey Data Privacy Act.
- Destroy, or arrange for the destruction of, a customer's records containing personal information once they are no longer retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable, undecipherable, or non-reconstructable through generally available means.
- A willful, knowing, or reckless violation is deemed an unlawful practice under the Consumer Fraud Act, enforceable by the Attorney General and, separately, by an affected consumer through the Consumer Fraud Act's private right of action for an ascertainable loss.
New Jersey Data Privacy Act (NJDPA), publicly available information exemption and biometric definitionsince 3 lines
N.J. Stat. §§ 56:8-166.4 et seq. (P.L. 2023, c. 266, S332) · Read the law's page
- Personal data that is lawfully made available through a government record or widely distributed media, or that a consumer has not restricted to a specific audience, falls outside the NJDPA's definition of personal data.
- The NJDPA's 25,000-consumer data-sale threshold has no percentage floor on how much of your revenue comes from selling personal data, so any revenue or in-kind discount from data sales can trigger it.
- Facial mapping, facial geometry or a facial template generated from a scraped photograph is biometric data under this Act when it is generated to identify a specific individual, although the photograph itself is excluded from the definition.