New Jersey joins a growing contingent of states that have created general data privacy laws. As of February 2024, the following states, along with New Jersey, had enacted some form of consumer privacy laws:  California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah and Virginia. Other states, such as Florida, have enacted more targeted privacy laws that apply to specified entities like large tech companies. However, most of these state laws do not provide a private right of action empowering individuals to pursue damages for data privacy violations, instead reserving enforcement for the state. The New Jersey privacy law does not provide a private right of action, which means enforcement of S. 332 will fall to the state Attorney General.

Overview of New Jersey’s New Privacy Protection Law
S. 332 applies to entities conducting business in New Jersey or producing products or services targeting New Jersey residents that during a calendar year control or process the personal data of either:

(a) “100,000 consumers, excluding personal data processed solely for the purpose of completing a payment or transaction;” or

(b) 25,000 consumers if the company “derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data.”

S. 332 requires that for any company processing “sensitive data,” the individual whose data will be processed must either opt-in or provide consent.

“Sensitive data” includes but is not limited to:

• “precise geolocation data,”
• “religious beliefs,”
• “personal data collected from a known child,”
• “sex life” (undefined),
• “sexual orientation” and
• “biometric data.”

A limited number of entities are protected from the effects of S. 332, including state and local government agencies, financial institutions and their affiliates, HIPAA-defined protected health information used in federal clinical research, and personal data sales by the New Jersey Motor Vehicle Commission.

Under the law, a consumer has the right to opt out of personal data processing, including through universal opt-out mechanisms, for targeted advertising, personal data sales, or profiling to support decisions that have legal implications for the consumer. Additionally, an entity may only process personal data for the purpose it disclosed to consumers, unless the business obtains the consumer’s consent.

Businesses must keep track of what types of data they process and sell or provide to other companies in any manner, including in all jurisdictions in which they sell products or offer services.

Businesses Must Prepare for Privacy Laws, Including Ensuring Responsive Insurance
With new laws in New Jersey and elsewhere providing greater data privacy protections, companies will need to be aware of their potential liabilities under these laws.  Businesses must keep track of what types of data they process and sell or provide to other companies in any manner, including in all jurisdictions in which they sell products or offer services.  

One key source of liability protection for such businesses are insurance policies that should respond when companies are faced with claims of potential privacy law violations.  The legal battles that have played out with insurance companies regarding existing privacy laws are instructive.

Specifically, courts in Illinois have cleared up early uncertainty by ruling consistently in favor of policyholders where insurance coverage for violations of the Illinois Biometric Information Privacy Act (BIPA) is at issue.  In response, insurance companies have implemented several measures to try to avoid paying for these liabilities going forward, such as adding new exclusionary language to policies.  Thus, companies should be examining not only their use of biometrics and other personal data in the present, but also the terms of their current and renewal insurance policies with respect to privacy violation claims.

At renewal time, companies should be wary of any effort by insurance companies to insert more specific exclusionary language to limit coverage for claims under privacy laws.  As litigation stemming from such laws continues to grow, smart businesses will need to put themselves in the best position to limit these liabilities and increase insurance recovery.

About Anderson Kill
Anderson Kill practices law in the areas of Insurance Recovery, Commercial Litigation, Environmental Law, Estates, Trusts and Tax Services, Corporate and Securities, Antitrust, Banking and Lending, Bankruptcy and Restructuring, Real Estate and Construction, Foreign Investment Recovery, Public Law, Government Affairs, Employment and Labor Law, Captive Insurance, Intellectual Property, Corporate Tax, Hospitality, and Health Reform. Recognized nationwide by Chambers USA, and best-known for its work in insurance recovery, the firm represents policyholders only in insurance coverage disputes — with no ties to insurance companies and has no conflicts of interest. Clients include Fortune 1000 companies, small and medium-sized businesses, governmental entities, and nonprofits as well as personal estates. The firm has offices in New York, NY, Boston, MA, Denver, CO, Los Angeles, CA, Newark, NJ, Philadelphia, PA, Stamford, CT, and Washington, D.C.

ATTORNEY ADVERTISING. This publication was prepared by Anderson Kill P.C. to provide information of interest to readers. Distribution of this publication does not establish an attorney-client relationship or provide legal advice. Prior results do not guarantee a similar outcome. Future developments may supersede this information. We invite you to contact the authors with any questions. © 2024 Anderson Kill P.C.