Sponsored by:
Assemblywoman ANNETTE QUIJANO
District 20 (Union)
Assemblywoman ELLEN J. PARK
District 37 (Bergen)
SYNOPSIS
Establishes “Privacy Protection Act”; concerns collection and sharing of certain personal information.
CURRENT VERSION OF TEXT
As reported by the Assembly Appropriations Committee on January 8, 2026, with amendments.
An Act prohibiting the collection or sharing of certain personal information by government entities and health care facilities, and amending P.L.1997, c.188, and supplementing Title 26 and Title 52 of the Revised Statutes.
Be It Enacted by the Senate and General Assembly of the State of New Jersey:
1. (New section) This act shall be known and may be cited as the “Privacy Protection Act.”
2. (New section) The Legislature finds and declares that:
a. This State is committed to protecting the safety and constitutional rights of all persons and to conserving the State’s limited resources.
b. Individuals have a privacy interest in how their data is shared and used. Unrestricted, unauthorized, or undisclosed sharing may deter persons from accessing the care or services they need.
c. Therefore, it is fitting and proper to protect the rights of individuals to have access to and be provided with essential legal services in New Jersey to safeguard the privacy of persons seeking those services.
3. (New section) As used in this act:
“Automated license plate recognition information” means information or data collected through the use of an automated license plate recognition system.
“Automated license plate recognition system” means a searchable database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of license plates and the characters they contain into computer-readable data.
“Election agency” means the New Jersey Division of Elections, the New Jersey Election Law Enforcement Commission, county boards of elections, county superintendents of elections, county clerks, municipal clerks, fire district board clerks, school district business administrators, and school district board secretaries.
“Government entity” means any of the principal departments in the executive branch of State government, and any division, board, bureau, office, commission or other instrumentality within or created by a department and any independent State authority, commission, instrumentality or agency, including any public institution of higher education. The term also means any political subdivision of the State or combination of political subdivisions, and any division, board, bureau, office, commission or other instrumentality within or created by a political subdivision of the State or combination of political subdivisions, and any independent authority, commission, instrumentality or agency created by a political subdivision or combination of political subdivisions.
“Health care facility” means the same as set forth in subsection a. of section 2 of P.L.1971, c.136 (C.26:2H-2).
1“Judicial warrant” means a warrant based on probable cause and issued by a federal Article III judge or magistrate judge, or the State equivalent.1
“Record” means any paper, written or printed book, document, drawing, map, plan, photograph, microfilm, data processed or image processed document, information stored or maintained electronically or by sound-recording or in a similar device, or any copy thereof.
1[“Judicial warrant” means a warrant based on probable cause and issued by a federal Article III judge or magistrate judge, or the State equivalent. ]1
4. (New section) 1[a.]1 A government entity shall not request or collect information relating to a person’s immigration status, citizenship status, place of birth, social security number, or individual taxpayer identification number, except when this information is necessary to assess eligibility for, or to administer, a requested public service, benefit, or program.
5. (New section) a. Any record or information, whether written or oral, 1[collected pursuant to the provisions of subsection a. of section 4 of P.L. , c. (C. ) (pending before the Legislature as this bill)] concerning a person that is solicited, made, or kept to assess eligibility for, or to administer a service, benefit, or program that is requested, used, or delivered1 shall not be considered a governmental record pursuant to P.L.1963, c.73 (C.47:1A-1 et seq.), known commonly as the open public records act, and shall not be disclosed, except:
(1) as required to administer benefits, services, or programs pursuant to State or federal law;
(2) as required by subpoena, valid court order, judicial warrant, or federal law;
(3) by an election agency when the disclosure of a candidate’s citizenship status is a requirement for elected office; or
(4) pursuant to the provisions of subsection c. of this section.
b. (1) A government entity shall not sell, share, or transfer automated license plate recognition information concerning the operation of a person’s motor vehicle, except:
(a) to another government entity when permitted by law;
(b) pursuant to a subpoena, valid court order, or judicial warrant; or
(c) pursuant to the provisions of subsection c. of this section.
(2) For purposes of this subsection, the provision of data hosting services shall not be considered the sale, share, or transfer of automated license plate recognition information.
c. This section shall not prohibit the disclosure of any record or information when the person to whom the record or information pertains has knowingly provided written consent for the disclosure in the person’s language of choice. Written consent shall include:
(1) the exact record or information to be shared;
(2) the purpose for sharing the record or information;
(3) a statement clarifying that consent is voluntary and declining to provide consent shall not result in discrimination or retaliation by the government entity;
(4) a statement clarifying that consent may be revoked, but that revocation does not impact a record or information already shared under prior written consent provided pursuant to this section; and
(5) the person or agency to receive the record or information.
d. A government entity that is required, pursuant to a subpoena, valid court order, judicial warrant, or federal law, to disclose any record or information collected pursuant to the provisions of 1[subsection a. of]1 section 4 of P.L. , c. (C. ) (pending before the Legislature as this bill) or any automated license plate reader information shall provide notice to the person to whom the record or information pertains regarding the disclosure. The notice shall set forth the:
(1) specific record or information subject to disclosure;
(2) party to which the record or information was disclosed; and
(3) basis for disclosing the information.
e. All government entities shall review any applicable confidentiality policies, guidelines, and regulations and identify those changes necessary to ensure compliance with the provisions of this section and section 4 1of1 P.L. , c. (C. ) (pending before the Legislature as this bill) by any entity under its authority. Any necessary changes to those policies, guidelines, or regulations shall be made as expeditiously as possible, consistent with the entity’s procedures, but no later than one calendar year following the effective date of P.L. , c. (C. ) (pending before the Legislature as this bill), and shall be published prominently on the entity’s Internet website.
f. Nothing in this section shall be construed to prohibit or in any way restrict any action where the prohibition or restriction would be contrary to federal law, subpoena, valid court order, or judicial warrant.
g. A person who knowingly obtains, discloses, or uses any information or record collected pursuant to section 4 of P.L. , c. (C. ) (pending before the Legislature as this bill) or any automated license plate recognition information for a purpose not permitted pursuant to this section or section 4 of P.L. , c. (C. ) (pending before the Legislature as this bill) shall be subject to injunctive relief and civilly liable for damages to the person to whom the information pertains, or the person’s personal representative or guardian, who may bring an action in the Superior Court.
6. (New section) a. A health care facility shall not request or collect information relating to a person’s immigration status, citizenship status, place of birth, social security number, or individual taxpayer identification number, except when this information is necessary to 1ensure the safe and appropriate delivery of health care services including, but not limited to, the assessment, treatment, transfer, referral, billing, or discharge of the person as required by applicable State or federal law, or to1 assess eligibility for, or to administer, a requested public service, benefit, or program. 1[A health care facility shall retain information collected pursuant to the provisions of this subsection only for the amount of time necessary to assess eligibility for, or to administer, a requested public service, benefit, or program, or as otherwise required by law] Nothing in P.L. , c. (C. ) (pending before the Legislature as this bill) shall prohibit a health care facility from maintaining a person’s complete medical record subject to the “Health Insurance Portability and Accountability Act of 1996,” Pub.L. 104-1911 .
b. Any record or information, whether written or oral, 1[collected pursuant to the provisions of subsection a. of this section] concerning a person that is solicited, made or kept, to assess eligibility for, or to administer a health care service, benefit, or program that is requested, used, or delivered1 shall not be considered a governmental record pursuant to P.L.1963, c.73 (C.47:1A-1 et seq.), known commonly as the open public records act, and shall not be disclosed, except:
(1) as required to administer benefits, services, or programs pursuant to State or federal law;
(2) as required by subpoena, valid court order, judicial warrant, or federal law; or
(3) pursuant to the provisions of subsection c. of this section.
c. This section shall not prohibit the disclosure of any record or information collected pursuant to the provisions of subsection a. of this section when the person to whom the record or information pertains has knowingly provided written consent for the disclosure 1[in the person’s language of choice] . The Department of Health, in consultation with the Attorney General, shall develop and make publicly available standardized written consent forms translated into the most commonly encountered languages in the State. These forms shall constitute vital documents pursuant to section 2 of P.L.2023, c.263 (C.52:14-41). Use of a standardized form developed pursuant to this subsection shall constitute compliance with the written consent requirements of this section. A health care facility that uses a standardized form or provides consent through an interpreter-assisted process consistent with applicable State and federal law shall be deemed in compliance with this section1. Written consent shall include:
(1) the exact record or information to be shared;
(2) the purpose for sharing the record or information;
(3) a statement clarifying that consent is voluntary and declining to consent shall not result in discrimination or retaliation by the health care facility;
(4) a statement clarifying that consent may be revoked, but that revocation does not impact a record or information already shared under prior written consent provided pursuant to this section; and
(5) the person or agency to receive the record or information.
d. 1[ A health care facility that is required, pursuant to a subpoena, valid court order, judicial warrant, or federal law, to disclose any record or information collected pursuant to the provisions of subsection a. of this section shall provide notice to the person to whom the record or information pertains regarding the disclosure. The notice shall set forth the:
(1) specific record or information subject to disclosure;
(2) party to which the record or information was disclosed; and
(3) basis for disclosing the record or information.
e.]1 The Commissioner of Health 1[shall review the confidentiality policies, guidelines, and regulations applicable to health care facilities and identify any changes necessary to ensure compliance with the provisions of this section. Any necessary changes to those policies, guidelines, and regulations shall be made as expeditiously as possible, consistent with Department of Health guidelines or procedures, but no later than one calendar year next following the effective date of P.L. , c. (C. ) (pending before the Legislature as this bill), and shall be published prominently on the department’s Internet website] may adopt rules and regulations in accordance with the “Administrative Procedure Act,” P.L.1968, c.410 (C.52:14B-1 et seq.) as are necessary to effectuate the provisions of this section1.
1[f.] e.1 Nothing in this section shall be construed to prohibit or in any way restrict any action where the prohibition or restriction would be contrary to federal law, subpoena, valid court order, or judicial warrant issued by a State or federal judge.
1[g.] f.1 A person who knowingly obtains, discloses, or uses any record or information collected pursuant to the provisions of subsection a. of this section for a purpose not permitted under this section shall be subject to injunctive relief and civilly liable for damages to the person to whom the information pertains, or the person’s personal representative or guardian, who may bring an action in the Superior Court.
7. Section 2 of P.L.1997, c.188 (C.39:2-3.4) is amended to read as follows:
2. a. Notwithstanding the provisions of P.L.1963, c.73 (C.47:1A-1 et seq.) or any other law to the contrary, except as provided in this act, the New Jersey Motor Vehicle Commission and any officer, employee or contractor thereof shall not knowingly disclose or otherwise make available to any person personal information about any individual obtained by the commission in connection with a motor vehicle record.
b. A person requesting a motor vehicle record including personal information shall produce proper identification and shall complete and submit a written request form provided by the chief administrator for the commission's approval. The written request form shall bear notice that the making of false statements therein is punishable and shall include, but not be limited to, the requestor's name and address; the requestor's driver's license number or corporate identification number; the requestor's reason for requesting the record; the driver's license number or the name, address and birth date of the person whose driver record is requested; the license plate number or VIN number of the vehicle for which a record is requested; any additional information determined by the chief administrator to be appropriate and the requestor's certification as to the truth of the foregoing statements. Prior to the approval of the written request form, the commission may also require the requestor to submit documentary evidence supporting the reason for the request.
In lieu of completing a written request form for each record requested, the commission may permit a person to complete and submit for approval of the chief administrator or the chief administrator's designee, on a case by case basis, a written application form for participation in a public information program on an ongoing basis. The written application form shall bear notice that the making of false statements therein is punishable and shall include, but not be limited to, the applicant's name, address and telephone number; the nature of the applicant's business activity; a description of each of the applicant's intended uses of the information contained in the motor vehicle records to be requested; the number of employees with access to the information; the name, title, and signature of the authorized company representative; and any additional information determined by the chief administrator to be appropriate. The chief administrator may also require the applicant to submit a copy of its business credentials, such as a license to do business or a certificate of incorporation. Prior to approval by the chief administrator or the chief administrator's designee, the applicant shall certify in writing as to the truth of all statements contained in the completed application form.
c. Personal information shall be disclosed for use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls or advisories; performance monitoring of motor vehicles and dealers by motor vehicle manufacturers; maintenance of voter registration information; and removal of non-owner records from the original owner records of motor vehicle manufacturers to carry out the purposes of the Automobile Information Disclosure Act, Pub.L.85-506, the Motor Vehicle Information and Cost Saving Act, Pub.L.92-513, the National Traffic and Motor Vehicle Safety Act of 1966, Pub.L.89-563, the Anti-Car Theft Act of 1992, Pub.L.102-519, and the Clean Air Act, Pub.L.88-206, and may be disclosed as follows:
(1) For use by any government agency, including any court or law enforcement agency in carrying out its functions, or any private person or entity acting on behalf of a federal, State, or local agency in carrying out its functions.
(2) For use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles, motor vehicle parts and dealers; motor vehicle market research activities, including survey research; and the removal of non-owner records from the original owner records of motor vehicle manufacturers.
(3) For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only:
(a) to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and
(b) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against the individual.
(4) For use in connection with any civil, criminal, administrative or arbitral proceeding in any federal, State, or local court or agency or before any self-regulatory body, including service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a federal, State, or local court.
(5) For use in educational initiatives, research activities, and for use in producing statistical reports, so long as the personal information is not published, redisclosed, or used to contact individuals and, in the case of educational initiatives, only to organ procurement organizations as aggregated, non-identifying information.
(6) For use by any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, rating or underwriting.
(7) For use in providing notice to the owners of towed or impounded vehicles.
(8) For use by an employer or its agent or insurer to obtain or verify information relating to a holder of a commercial driver's license that is required under the "Commercial Motor Vehicle Safety Act," 49 U.S.C.App.s.2710 et seq.
(9) For use in connection with the operation of private toll transportation facilities.
(10) For use by any requestor, if the requestor demonstrates it has obtained the notarized written consent of the individual to whom the information pertains.
(11) For product and service mail communications from automotive-related manufacturers, dealers and businesses, if the commission has implemented methods and procedures to ensure that:
(a) individuals are provided an opportunity, in a clear and conspicuous manner, to prohibit such uses; and
(b) product and service mail communications from automotive-related manufacturers, dealers and businesses will not be directed at individuals who exercise their option under subparagraph (a) of this paragraph.
(12) For use by an organ procurement organization designated pursuant to 42 U.S.C. s.1320b-8 to serve in the State of New Jersey, or any donor registry established by any such organization, exclusively for the purposes of determining, verifying, and recording organ and tissue donor designation and identity. For these purposes, an organ procurement organization shall have electronic access at all times, without exception, to real-time organ donor designation and identification information. An organ procurement organization may also have information for research activities, pursuant to paragraph (5) of subsection c. of this section.
(13) As provided in section 2 of P.L.2021, c.139 (C.39:2-3.9).
d. As provided by the federal "Drivers' Privacy Protection Act of 1994," Pub.L.103-322, a person authorized to receive personal information under paragraphs (1) through (10) of subsection c. of this section may resell or redisclose the personal information only for a use permitted by paragraphs (1) through (10) of subsection c. of this section subject to regulation by the commission. A person authorized to receive personal information under paragraph (11) of subsection c. of this section may resell or redisclose the personal information pursuant to paragraph (11) of subsection c. of this section subject to regulation by the commission. An organization authorized to receive personal information under paragraph (12) of subsection c. of this section may redisclose the personal information only for the purposes set forth in that paragraph.
e. As provided by the federal "Drivers' Privacy Protection Act of 1994," Pub.L.103-322, a person authorized to receive personal information under this section who resells or rediscloses personal information covered by the provisions of P.L.1997, c.188 (C.39:2-3.3 et seq.) shall keep for a period of five years records identifying each person or entity that receives information and the permitted purpose for which the information will be used and shall make such records available to the commission upon request. Any person who receives, from any source, personal information from a motor vehicle record shall release or disclose that information only in accordance with P.L.1997, c.188 (C.39:2-3.3 et seq.).
f. The release of personal information under this section shall not include an individual's social security number except in accordance with applicable State or federal law.
g. Notwithstanding any provision to the contrary, the commission , or any government entity as defined in section 3 of P.L. , c. (C. ) (pending before the Legislature as this bill), shall not use, or disclose to any federal, State, or local law enforcement any motor vehicle record containing personal information, or any personal information, as this term is defined in section 1 of P.L.1997, c.188 (C.39:2-3.3), for any purposes related to Title 8 of the United States Code without the informed consent of the applicant, a warrant signed by a State or federal judge, lawful court order, or subpoena, except that nothing in this section shall be construed to prohibit, or in any way restrict, any action where such prohibition or restriction would be contrary to federal law.
When responding to a warrant, court order, or subpoena, the commission may disclose only those records or information specifically requested in the warrant, court order, or subpoena.
(P.L.2021, c.139, s.3)
8. If any section or provision of P.L. , c. (C. ) (pending before the Legislature as this bill) shall be declared to be unconstitutional, invalid or inoperative, in whole or in part, by a court of competent jurisdiction, the section or provision shall, to the extent that it is not unconstitutional, invalid or inoperative, be enforced and effectuated, and no such determination shall be deemed to invalidate or make ineffectual the remaining sections or provisions.
9. This act shall take effect immediately 1, except that section 6 shall take effect on the first day of the thirteenth month next following enactment1.