Law / United States / 
New Jersey
New Jersey Data Privacy Act (NJDPA), publicly available information exemption and biometric definition
N.J. Stat. §§ 56:8-166.4 et seq. (P.L. 2023, c. 266, S332)
In force since .
A personal data rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Personal data that is lawfully made available through a government record or widely distributed media, or that a consumer has not restricted to a specific audience, falls outside the NJDPA's definition of personal data.
- The NJDPA's 25,000-consumer data-sale threshold has no percentage floor on how much of your revenue comes from selling personal data, so any revenue or in-kind discount from data sales can trigger it.
- Facial mapping, facial geometry or a facial template generated from a scraped photograph is biometric data under this Act when it is generated to identify a specific individual, although the photograph itself is excluded from the definition.
These lines are LexLint's reading of the law's text. Also read by: New Jersey Division of Consumer Affairs, Office of the Attorney General (guidance, recorded ).
Who enforces it
Settledness
The Division's FAQ states that it should not be considered a legal document or a complete explanation of the law.
- As of
- Guidance link
- https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx
- Guidance body
- New Jersey Division of Consumer Affairs, Office of the Attorney General
- Open questions
- When is data derived from a scraped photograph "generated to identify a specific individual", so that it falls within the definition of "Biometric data" in N.J.S.A. 56:8-166.4?
- Is the purpose when the data is generated, or the purpose of a later use, what decides whether data from a photograph or recording is "generated to identify a specific individual" under N.J.S.A. 56:8-166.4?
What it makes you log
Who may demand the log
Regulator
Logging duty
A controller may not conduct processing that presents a heightened risk of harm to a consumer without conducting and documenting a data protection assessment of each such processing activity, and must make the assessment available to the Division of Consumer Affairs on request, which may evaluate it. The assessment is confidential and exempt from public inspection. No retention period is stated. Section 56:8-166.10(b) also lets a controller that obtained data from a source other than the consumer satisfy a deletion request by retaining a record of the request.
- Kind
- Implicit
- As of
- Provision
- N.J. Stat. 56:8-166.12(a)(9) and (b) (conduct and document a data protection assessment; make it available to the Division of Consumer Affairs on request)
- Trigger
- personal_data_processing
What this law does
Personal data excludes de-identified data and publicly available information, defined as information lawfully made available from government records or widely distributed media, or that a controller reasonably believes a consumer lawfully made available to the public and did not restrict to a specific audience.
The Act applies to a controller conducting business in New Jersey or targeting New Jersey residents that controls or processes personal data of at least 100,000 consumers, or of at least 25,000 consumers where the controller derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data; this second limb carries no percentage threshold on how much revenue must come from data sales.
Biometric data is defined to include, but not be limited to, fingerprint, voiceprint, eye retinas, irises, facial mapping, facial geometry, facial templates, or other unique biological, physical, or behavioral patterns or characteristics used or intended to be used to identify a specific individual, and the definition excludes a digital or physical photograph, an audio or video recording, and data generated from one unless the data is generated to identify a specific individual.
Approved , the Act takes effect on the 365th day following enactment, . Enforcement belongs to the Office of the Attorney General, which has sole and exclusive authority, and the Act provides no basis for a private right of action.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .