Law / United States / 
New Jersey
Identity Theft Prevention Act, methods of destruction of customer records
N.J. Stat. Ann. § 56:8-162 (L. 2005, c.226, s.11)
In force since .
A security baseline statutes rule binding public and private bodies.
What it requires
- This binds any business or public entity holding a customer's records containing personal information within its custody or control, whether or not the entity is otherwise subject to the New Jersey Data Privacy Act.
- Destroy, or arrange for the destruction of, a customer's records containing personal information once they are no longer retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable, undecipherable, or non-reconstructable through generally available means.
- A willful, knowing, or reckless violation is deemed an unlawful practice under the Consumer Fraud Act, enforceable by the Attorney General and, separately, by an affected consumer through the Consumer Fraud Act's private right of action for an ascertainable loss.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.DM-P5Data are destroyed according to policy.
- NIST CSF 2.0
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Section 15 (C.56:8-166) makes a willful, knowing or reckless violation of section 11 an unlawful practice and a violation of the Consumer Fraud Act. N.J.S.A. 56:8-13 then makes a person who violates that Act liable, in addition to any other penalty provided by law, to a penalty of not more than $10,000 for the first offense and not more than $20,000 for the second and each subsequent offense; the $20,000 tier is coded and the $10,000 first-offense tier is given here. The penalty is exclusive of and in addition to any moneys or property ordered to be paid or restored to any person in interest.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 20,000
Who enforces it
Enforcement body
New Jersey Attorney General and Division of Consumer Affairs, through the Consumer Fraud Act's civil-penalty and injunctive process; a violation is also actionable by an affected consumer under the Consumer Fraud Act's private right of action.
Settledness
- As of
- Open questions
- Does 'no longer to be retained by the business or public entity' in N.J.S.A. 56:8-162 fix the moment destruction becomes due when the section names no retention period?
- Does a violation of N.J.S.A. 56:8-162 that is not willful, knowing or reckless carry any remedy, given that section 15 (C.56:8-166) makes only a willful, knowing or reckless violation an unlawful practice?
What it reaches
Obligation class
Security
Applicability criteria
"Business" and "public entity" are defined in C.56:8-161; the federal government is not a public entity for these sections.
- As of
- Combinator
- All of
- Criteria
- A business or public entity
What this law does
A business or public entity must destroy, or arrange for the destruction of, a customer's records within its custody or control containing personal information, once the records are no longer retained, by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable, undecipherable, or non-reconstructable through generally available means.
A willful, knowing, or reckless violation is deemed an unlawful practice and a violation of the Consumer Fraud Act, enforceable by the Attorney General for a civil penalty and injunctive relief, and actionable by a consumer for an ascertainable loss under the Consumer Fraud Act's private right of action, trebled with reasonable attorney's fees.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .