Law / United States / 
New Jersey
Privacy Protection Act, government entities: limits on collecting and disclosing immigration status, citizenship status and similar information, no sale or transfer of license plate recognition data, and no use of motor vehicle records for immigration enforcement
In force since .
A sensitive categories rule binding government bodies.
- Private right of action
- Yes
- Obligation class
- Prohibition, Consent, Disclosure, Governance
- Audit expectation
- none
What it requires
- If you are a New Jersey government entity, do not request or collect information from an individual or a non-governmental entity relating to a person's immigration status, citizenship status, place of birth, social security number or individual taxpayer identification number, unless it is necessary to assess eligibility for, or to provide or administer, a public service, benefit, program, or professional qualification or license, or State law requires it (N.J.S.A. 52:4CC-4(a)).
- Do not disclose that information, which is not a government record under the Open Public Records Act when kept to assess eligibility for or to administer a public service, benefit, program or license, except as federal or State law requires for eligibility, as a valid judicial order, judicial warrant or federal law requires, as an election agency discloses a candidate's citizenship status where an elected office requires it, or with the person's knowing written consent (N.J.S.A. 52:4CC-5(a) and (c)).
- Do not sell, share or transfer automated license plate recognition information concerning the operation of a person's motor vehicle, except to another government entity when permitted by law, under a valid judicial order or warrant, with the person's written consent, or to a law enforcement agency of another jurisdiction for a criminal investigation that certifies, electronically or in writing, that the information will not be used for civil immigration enforcement, will not be shared, sold, transferred or made searchable, and is bound by the same restrictions that apply to you (N.J.S.A. 52:4CC-5(b)(1)).
- If a third-party vendor operates your automated license plate recognition system, make sure the vendor does not sell, share, transfer or make searchable the information to other entities or persons unless it meets those conditions and you authorize it (N.J.S.A. 52:4CC-5(b)(3)).
- Notify the person to whom a record or automated license plate reader information pertains within 90 days of a disclosure you make under a valid judicial order, judicial warrant or federal law, stating the specific record or information, the party it went to and the basis for the disclosure, unless notice would compromise a criminal investigation (N.J.S.A. 52:4CC-5(d)).
- Review your confidentiality policies, guidelines and regulations, make the changes needed to comply, and publish them prominently on your website no later than one calendar year after the effective date of P.L.2026, c.4 (N.J.S.A. 52:4CC-5(e)).
- Do not use or disclose to any federal, State or local law enforcement a motor vehicle record containing personal information, or any personal information as N.J.S.A. 39:2-3.3 defines it, for any purpose related to Title 8 of the United States Code without the applicant's informed consent, a judicial warrant or a valid judicial order (N.J.S.A. 39:2-3.4(g)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
The person to whom the information pertains, or the person's personal representative or guardian, may bring an action in the Superior Court for injunctive relief and damages against a government entity that knowingly obtains, discloses or uses covered information for a purpose the act does not permit (N.J.S.A. 52:4CC-5(g)).
What record it asks for
Logging duty
Sections 4 and 5 limit what a government entity may collect, disclose, sell or transfer, require notice to a person within 90 days of a compelled disclosure and a one-year review of confidentiality policies, and treat an agreement with another jurisdiction's law enforcement agency as a government record. The notice and the policy publication are communications and filings rather than a log of processing, access or decisions, and no log, retention period or audit is named.
- Kind
- None
- As of
What this law does
A government entity may not request or collect information from an individual or a non-governmental entity relating to a person's immigration status, citizenship status, place of birth, social security number or individual taxpayer identification number, except when this information is necessary to assess eligibility for, or to provide or administer, a public service, benefit, program, or professional qualification or license or as otherwise required by State law.
A government entity is a principal department of State government, a division, board, bureau, office, commission or other instrumentality within or created by a department, an independent State authority, commission, instrumentality or agency including a public institution of higher education, a political subdivision or combination of political subdivisions, and any division, board, bureau, office, commission, or other instrumentality, independent authority or agency within or created by one.
Information relating to a person's immigration status, citizenship status, place of birth, social security number or individual taxpayer identification number that is kept to assess eligibility for, or to provide or administer, a public service, benefit, program or professional qualification or license is not a government record under the Open Public Records Act and may not be disclosed except as the section lists.
A government entity may not sell, share or transfer automated license plate recognition information concerning the operation of a person's motor vehicle, except to another government entity when permitted by law, under a valid judicial order or judicial warrant, as subsection c. of the section allows, or to a law enforcement agency of another jurisdiction for a criminal investigation that certifies the information will not be used for civil immigration enforcement or be shared, sold, transferred or made searchable.
A government entity that is required by a valid judicial order, judicial warrant or federal law to disclose such information or any automated license plate reader information must notify the person to whom it pertains within 90 days of the disclosure, except where notice would compromise a criminal investigation.
If a law enforcement agency of another jurisdiction has used or shared automated license plate recognition information in violation of the act or an agreement made under it, the Attorney General may by order prohibit the sharing of that information with the agency or deny it access to the government entity.
Each government entity must review its confidentiality policies, guidelines and regulations, make the changes needed for compliance no later than one calendar year following the effective date of the act, and publish them prominently on its Internet website.
A government entity that knowingly obtains, discloses or uses such information, or any automated license plate recognition information, for a purpose the act does not permit is subject to injunctive relief and is civilly liable for damages to the person to whom the information pertains, who may bring an action in the Superior Court.
The Motor Vehicle Commission and any government entity may not use or disclose to any federal, State or local law enforcement any motor vehicle record containing personal information, or any personal information as section 1 of P.L.1997, c.188 defines it, for any purpose related to Title 8 of the United States Code without the informed consent of the applicant, a judicial warrant or a valid judicial order.
Nothing in the section prohibits or restricts any action where the prohibition, restriction or enforcement would be contrary to federal law, a judicial order or a judicial warrant. P.L.2026, c.4 was approved on and takes effect immediately, except that section 6 takes effect on the first day of the 13th month next following enactment.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .