Duty LXD-1437
Processes biometric data, in New Jersey
Identity Theft Prevention Act, methods of destruction of customer recordssince 3 lines
N.J. Stat. Ann. § 56:8-162 (L. 2005, c.226, s.11) · Read the law's page
- This binds any business or public entity holding a customer's records containing personal information within its custody or control, whether or not the entity is otherwise subject to the New Jersey Data Privacy Act.
- Destroy, or arrange for the destruction of, a customer's records containing personal information once they are no longer retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable, undecipherable, or non-reconstructable through generally available means.
- A willful, knowing, or reckless violation is deemed an unlawful practice under the Consumer Fraud Act, enforceable by the Attorney General and, separately, by an affected consumer through the Consumer Fraud Act's private right of action for an ascertainable loss.
New Jersey Data Privacy Act (NJDPA), publicly available information exemption and biometric definitionsince 3 lines
N.J. Stat. §§ 56:8-166.4 et seq. (P.L. 2023, c. 266, S332) · Read the law's page
- Personal data that is lawfully made available through a government record or widely distributed media, or that a consumer has not restricted to a specific audience, falls outside the NJDPA's definition of personal data.
- The NJDPA's 25,000-consumer data-sale threshold has no percentage floor on how much of your revenue comes from selling personal data, so any revenue or in-kind discount from data sales can trigger it.
- Facial mapping, facial geometry or a facial template generated from a scraped photograph is biometric data under this Act when it is generated to identify a specific individual, although the photograph itself is excluded from the definition.
New Jersey Data Privacy Act, sensitive data and biometric definitionsince 3 lines
N.J. Stat. §§ 56:8-166.4 to 56:8-166.19 · Read the law's page
- Obtain a New Jersey consumer's opt-in consent before processing sensitive data, including biometric data, financial account information, or data revealing a mental or physical health condition, treatment, or diagnosis.
- Treat facial mapping, facial geometry, or facial templates, or an identifier derived from a photograph, video, or audio recording to identify a specific individual, as NJDPA biometric data. New Jersey's definition claws this back rather than excluding it outright.
- Do not sell a New Jersey consumer's sensitive data, whatever the number of consumers whose data you control or process.
Data brokers and data collectors: no sale or licensing of sensitive data, with a civil penalty of $50,000 for each recordsince 3 lines
Data broker sensitive data ban, N.J. Stat. §§ 56:8-166.22 and 56:8-166.23 (P.L.2026, c.25, sections 3 and 5) · Read the law's page
- If you are a data broker or a data collector, do not sell or license sensitive data to any other individual or entity (N.J.S.A. 56:8-166.22(a)).
- Treat as sensitive data any personal data revealing racial or ethnic origin, religious beliefs, health condition, treatment or diagnosis, financial account information with its access code, sex life or sexual orientation, citizenship or immigration status, transgender or non-binary status, genetic or biometric data processed to uniquely identify an individual, personal data collected from a known child, and precise geolocation data within a radius of 1,750 feet (N.J.S.A. 56:8-166.20(a) and 56:8-166.22(a)).
- Check whether an exclusion applies before relying on it: the ban does not reach HIPAA protected health information, Gramm-Leach-Bliley financial institutions, insurance institutions and insurance-support organizations, consumer reporting agencies acting under the Fair Credit Reporting Act, the Motor Vehicle Commission's sales that the Driver's Privacy Protection Act permits, State agencies and political subdivisions, human subjects research, and registered national securities associations (N.J.S.A. 56:8-166.22(b)).