Law / United States / 
New Jersey
New Jersey Data Privacy Act, Division of Consumer Affairs enforcement
N.J. Stat. §§ 56:8-166.4 to 56:8-166.19
In force since .
An enforcement supervision rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- none
What it requires
- Expect NJDPA violations to be enforced exclusively by the Division of Consumer Affairs and the Attorney General under the Consumer Fraud Act, never by a private plaintiff.
- Do not rely on a notice-and-cure opportunity before an enforcement action. New Jersey's cure window ran until .
These lines are LexLint's reading of the law's text. Also read by: New Jersey Division of Consumer Affairs, Office of the Attorney General (guidance, recorded ).
If you get it wrong
Private right of actionNo
Penalty structure
A violation of the Act is an unlawful practice and violation of the Consumer Fraud Act (section 14(a)), and N.J.S.A. 56:8-13 makes a person who violates that Act liable, in addition to any other penalty provided by law, to a penalty of not more than $10,000 for the first offense and not more than $20,000 for the second and each subsequent offense. The penalty is exclusive of and in addition to any moneys or property ordered to be paid or restored to any person in interest.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
New Jersey Office of the Attorney General, which has sole and exclusive authority to enforce a violation of the Act (section 16).
Settledness
- As of
- Guidance link
- https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx
- Guidance body
- New Jersey Division of Consumer Affairs, Office of the Attorney General
- Open questions
- What counts as an 'initial offense' and what counts as a 'later offense' for the $10,000 and $20,000 penalties the Division's FAQs describe: each violation, each affected consumer or each enforcement action?
What it makes you log
Logging duty
A violation is an unlawful practice under the Consumer Fraud Act, enforced by the Division of Consumer Affairs and the Attorney General, with a notice and 30-day cure step until the first day of the 18th month after the effective date (section 14) and exclusive Attorney General authority (section 16). The enforcement sections state no duty to keep a record and no power to inspect or demand one. The only regulator access to a record in the act is the Division's right to a data protection assessment on request in section 9(b), which the general applicability row carries. The act reaches controllers that conduct business in the State or produce products or services targeted to its residents (section 2), and a consumer is defined as a resident (section 1).
- Kind
- None
- As of
What this law does
A violation of NJDPA is an unlawful practice and violation of the Consumer Fraud Act, N.J. Stat. § 56:8-1 et seq., enforced exclusively by the Division of Consumer Affairs and the Attorney General. Until the first day of the 18th month next following the effective date (), the Division was required to issue a notice of alleged noncompliance and a 30-day cure opportunity before bringing an action if a cure was deemed possible.
The Act provides that nothing in it is to be construed as providing the basis for, or subject to, a private right of action for violations of the Act itself; the words "or under any other law" were struck by Assembly floor amendment before enactment, so the enacted text leaves a claim under another law, including the Consumer Fraud Act's own separate private-action mechanism, unaddressed.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .