Written by: Haim Ravia, Dotan Hammer
New Jersey Governor Mikie Sherrill signed Assembly Bill No. 5328, adopting sweeping new registration and disclosure requirements for data brokers and data collectors and imposing an outright ban on the sale of sensitive personal data.
The law amends the New Jersey Data Privacy Act (P.L.2023, c.266) and supplements Title 56 of the Revised Statutes. It took effect immediately upon the Governor’s signature, with the exception of the public registry requirement, which remains inoperative for 270 days following enactment (approximately March 27, 2027). The law defines a “data broker” as a person or legal entity that knowingly collects or purchases the personal data of a consumer with whom it does not have a direct relationship and sells or licenses that data to a third party. It also defines a “data collector” as a business that knowingly collects the personal data of a consumer with whom it has a direct relationship and sells or licenses such data to a data broker. It directs the Division of Consumer Affairs in the Department of Law and Public Safety to establish and maintain a public registry of data brokers and data collectors.
Each data broker and data collector engaged in selling or licensing the personal data of New Jersey consumers must register annually with the Division and pay a graduated registration fee ranging from $5,000, for those handling the data of 100,000 or fewer consumers in the State, to $1,500,000, for those handling the data of more than 4.5 million consumers. Registrants must disclose, among other things, their contact and website information; their opt-out and deletion mechanisms; a history of data breaches and other cybersecurity events, including the number of individuals affected by each; and their data collection practices with respect to the personal data of persons under the age of 18. A data broker or data collector that fails to register, pay the required fee, or update its information is liable for a civil penalty of $2,500 for each day of noncompliance.
The centerpiece of the law is a categorical prohibition: in no case shall a data broker or data collector sell or license “sensitive data” to any other individual or entity. Sensitive data is broadly defined to include personal data revealing racial or ethnic origin; religious beliefs; mental or physical health condition, treatment, or diagnosis; financial information; sex life or sexual orientation; citizenship or immigration status; status as transgender or non-binary; genetic or biometric data processed to uniquely identify an individual; personal data collected from a known child; and precise geolocation data. The prohibition is subject to enumerated exceptions, including for information governed by HIPAA, the Gramm-Leach-Bliley Act, and the Fair Credit Reporting Act. A data broker or data collector that sells, offers for sale, or licenses sensitive data in violation of the law is liable for a civil penalty of $50,000 for each record sold, offered for sale, or licensed — a per-record structure that commentators have described as making the measure among the costliest data broker laws in the nation.
Click here to read New Jersey Assembly Bill No. 5328.
