S4806

An Act concerning the deletion of personal data and supplementing Title 56 of the Revised Statutes.

Be It Enacted by the Senate and General Assembly of the State of New Jersey:

1. As used in P.L. , c. (C. ) (pending before the Legislature as this bill):

“Consumer” means the same as that term is defined in section 1 of P.L.2023, c.266 (C.56:8-166.4).

“Controller” means the same as that term is defined in section 1 of P.L.2023, c.266 (C.56:8-166.4).

“Data broker” means a person or legal entity, including, but not limited to, a controller, that knowingly collects or purchases the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sells or licenses that data to a third party. A third party shall not include a processor if licensure or disclosure of personal data to the processor is solely to process the personal data on the data broker’s behalf. “Data broker” shall not include a government entity, including any federal agency or State agency as defined in section 2 of P.L.1971, c.182 (C.52:13D-13), any political subdivision, or any division, board, bureau, office, commission, or other instrumentality created by a political subdivision. Examples of a direct relationship include if the consumer is a past or present: (1) customer, client, subscriber, or user of the person or legal entity’s goods or services; (2) employee, contractor, or agent of the person or legal entity; (3) investor in the person or legal entity; or (4) donor to the person or legal entity.

“Deletion mechanism” means the deletion mechanism established pursuant to subsection a. of section 2 of P.L. , c. (C. ) (pending before the Legislature as this bill).

“Deletion request” means a single verifiable consumer request for every data broker, or associated service provider or contractor of the data broker, that maintains any personal data related to that consumer to delete the consumer’s personal data.

“Division” means the Division of Consumer Affairs in the Department of Law and Public Safety.

“Personal data” means the same as that term is defined in section 1 of P.L.2023, c.266 (C.56:8-166.4).

“Processor” means the same as that term is defined in section 1 of P.L.2023, c.266 (C.56:8-166.4).

2. a. The Attorney General shall establish and maintain a deletion mechanism that:

(1) implements and maintains reasonable security procedures and practices, including, but not limited to, administrative, physical, and technical safeguards to protect consumers’ personal data from unauthorized use, disclosure, access, destruction, or modification. The security practices and procedures shall be appropriate to the nature of the information and the purposes for which the personal data will be used;

(2) allows a consumer to make a deletion request at no cost to the consumer;

(3) allows a consumer to selectively exclude a data broker or data brokers from a deletion request;

(4) allows a consumer to request to alter a previous deletion request after at least 45 days have passed since the consumer made a deletion request;

(5) allows a consumer to securely submit information in one or more ways, as determined by the division, as part of or to aid in a deletion request;

(6) allows a data broker registered with the division pursuant to section 2 of P.L.2026, c.25 (C.56:8-166.20) to determine whether a consumer has submitted a deletion request and shall not allow the disclosure of any additional personal data when the data broker accesses the deletion mechanism unless otherwise specified in P.L. , c. (C. ) (pending before the Legislature as this bill);

(7) allows a consumer to make a deletion request in any language spoken by any consumer for whom personal data has been collected by a data broker;

(8) is readily accessible and usable by consumers with disabilities; and

(9) allows a consumer, or an authorized agent of the consumer, to verify the status of the consumer’s deletion request.

b. The deletion mechanism shall be accessible through the division’s Internet website together with a description of:

(1) the deletion mechanism, including the process for submitting a deletion request and examples of the types of information that may be deleted; and

(2) the actions a data broker is required to take pursuant to section 3 of P.L. , c. (C. ) (pending before the Legislature as this bill).

3. a. A data broker shall access the deletion mechanism at least once every 45 days and shall:

(1) within 45 days after receiving a deletion request, process all deletion requests and delete all personal data related to the consumers making the deletion requests consistent with the requirements of section 2 of P.L. , c. (C. ) (pending before the Legislature as this bill); and

(2) direct all service providers or contractors associated with the data broker to delete all personal data in their possession related to the consumer making the deletion request.

b. If a data broker denies a consumer’s deletion request because the deletion request cannot be verified, the data broker shall process, or direct all service providers or contractors associated with the data broker to process, the deletion request as an opt-out of the sale or sharing of the consumer’s personal data, as provided for under section 7 of P.L.2023, c.266 (C.56:8-166.10), within 45 days of receiving the request.

c. After a consumer has submitted a deletion request and the data broker has deleted the consumer’s personal data pursuant to this section, the data broker shall:

(1) delete any of the consumer’s personal data that the data broker subsequently acquires at least once every 45 days unless the consumer requests otherwise or the deletion is not required pursuant to subsection d. of this section; and

(2) not sell or share any of the consumer’s personal data that the data broker subsequently acquires unless the consumer requests otherwise or selling or sharing the personal data is permitted under P.L.2023, c.266 (C.56:8-166.4 et seq.).

d. A data broker shall not be required to delete a consumer’s personal data pursuant to this section if deleting the consumer’s personal data would restrict a data broker’s ability to:

(1) comply with federal or State law or regulations;

(2) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, State, municipal, or other governmental authorities;

(3) cooperate with law enforcement agencies concerning conduct or activity that the data broker reasonably and in good faith believes may violate federal, State, or municipal ordinances or regulations;

(4) investigate, establish, exercise, prepare for, or defend legal claims;

(5) provide a product or service specifically requested by a consumer;

(6) perform under a contract to which a consumer is a party, including fulfilling the terms of a written warranty;

(7) take steps at the request of a consumer prior to entering into a contract;

(8) take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or another individual;

(9) prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity, preserve the integrity or security of systems, or investigate, report, or prosecute those responsible for any such action; or

(10) engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board that determines, or similar independent oversight entities that determine:

(a) whether the deletion of the information is likely to provide substantial benefits that do not exclusively accrue to the data broker,

(b) the expected benefits of the research outweigh the privacy risks, and

(c) whether the data broker has implemented reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with re-identification.

4. a. Three years after the effective date of P.L. , c. (C. ) (pending before the Legislature as this bill), and every three years thereafter, a data broker shall undergo an audit by an independent third party to determine compliance with P.L. , c. (C. ) (pending before the Legislature as this bill).

b. A data broker shall:

(1) submit a report resulting from each audit and any related materials to the division within five business days of a written request from the division; and

(2) maintain the report and materials described in paragraph (1) of this subsection for at least six years.

5. The division may charge a data broker a fee to access the deletion mechanism pursuant to section 3 of P.L. , c. (C. ) (pending before the Legislature as this bill) that does not exceed the reasonable costs of establishing, maintaining, and providing access to the deletion mechanism.

6. a. There is established in the Department of the Treasury a special, nonlapsing fund to be known as the “Data Broker Fund.” The fund shall be administered by the State Treasurer and shall be credited with:

(1) all monies received through the collection of fees pursuant to section 5 of P.L. , c. (C. ) (pending before the Legislature as this bill); and

(2) any return on investment of monies deposited in the fund.

b. Monies in the fund shall be used solely for the purpose of maintaining and updating the deletion mechanism.

7. Nothing in P.L. , c. (C. ) (pending before the Legislature as this bill) shall apply to:

a. protected health information collected by a covered entity or business associate subject to the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the “Health Insurance Portability and Accountability Act of 1996,” Pub.L.104-191, and the “Health Information Technology for Economic and Clinical Health Act,” 42 U.S.C. s.17921 et seq.;

b. a financial institution, data, or an affiliate of a financial institution that is subject to Title V of the federal “Gramm-Leach-Bliley Act,” 15 U.S.C. s.6801 et seq., and the rules and implementing regulations promulgated thereunder;

c. the secondary market institutions identified in 15 U.S.C. s.6809(3)(D) and 12 C.F.R. s.1016.3(l)(3)(iii);

d. an insurance institution subject to P.L.1985, c.179 (C.17:23A-1 et seq.);

e. the sale of a consumer’s personal data by the New Jersey Motor Vehicle Commission that is permitted by the federal “Drivers’ Privacy Protection Act of 1994,” 18 U.S.C. s.2721 et seq.;

f. personal data collected, processed, sold, or disclosed by a consumer reporting agency, as defined in 15 U.S.C. s.1681a(f), if the collection, processing, sale, or disclosure of the personal data is limited, governed, and collected, maintained, disclosed, sold, communicated, or used only as authorized by the federal “Fair Credit Reporting Act,” 15 U.S.C. s.1681 et seq., and implementing regulations;

g. any State agency, as defined in section 2 of P.L.1971, c.182 (C.52:13D-13), any political subdivision, and any division, board, bureau, office, commission, or other instrumentality created by a political subdivision; or

h. personal data that is collected, processed, or disclosed as part of research conducted in accordance with the Federal Policy for the Protection of Human Subjects pursuant to 45 C.F.R. Part 46 or the human subject protection requirements under 21 C.F.R. Parts 50 and 56.

8. This act shall take effect on the first day of the thirteenth month next following the date of enactment. However, the Attorney General may take any anticipatory administrative action in advance as shall be necessary for the implementation of this act.

STATEMENT

This bill requires the Attorney General to establish and maintain a deletion mechanism in the Division of Consumer Affairs in the Department of Law and Public Safety (division) by which a consumer may request every data broker, or associated service provider or contractor of the data broker, that maintains personal data related to that consumer to delete the consumer’s personal data (deletion request) and edit a deletion request. The deletion mechanism is to meet certain requirements, as outlined in the bill.

The bill also requires a data broker to access the deletion mechanism at least once every 45 days and respond to a deletion request within 45 days. The bill permits the division to charge a data broker a fee to access the deletion mechanism, provided that the fee does not exceed the reasonable costs of establishing, maintaining, and providing access to the deletion mechanism.

Under the bill, the deletion mechanism is to be accessible on the division’s Internet website together with a description of the deletion mechanism and certain requirements for data brokers established by the bill. The bill provides that certain information and entities are exempt from the provisions of the bill, as outlined in the bill.

Additionally, the bill requires a data broker to undergo an independent audit every three years after the bill’s effective date to ensure compliance with the bill’s provisions. Under the bill, a data broker is to submit a report resulting from each audit and any related materials to the division within five business days of a written request from the division and to keep records associated with each audit for at least six years.

The bill also establishes a fund, to be known as the “Data Broker Fund,” that is to be administered by the State Treasurer and credited with: (1) all monies received through the collection of fees pursuant to the bill; and (2) any return on investment of monies deposited in the fund. The bill provides that all monies deposited into the fund are to be used solely for the purpose of updating and maintaining the deletion mechanism.