On January 16, Governor Murphy signed legislation requiring legal entities who collect consumer information to make certain disclosure to consumers. The law further requires that businesses provide consumers with an option to opt-in/opt-out of data collection. The bill underwent dramatic changes during the end of the last legislative session, leading to concerns there was not enough time for the business community to understand the full ramifications of the law.

What Organizations are Covered Under the Law?

The bill is very extensive and covers most organizations that collect consumer data. The bill encompasses any legal entity (including nonprofits) that alone or jointly with others, determines the purpose and means of possessing personal data.

Private Right of Action

One area of concern relates to private rights of action. While a last minute amendment was made attempting to prevent anyone other than the attorney general from bringing legal action, the words “or under any other law” were removed. This raised the concern private rights of action and lawsuits could be brought under other statutes.

Retail Loyalty Programs

The law also affects any business with a loyalty program. Specifically, there are three elements of the law concerning to these programs:

While loyalty programs are intended to provide the consumer with certain benefits, the law treats them the same way as a program that incentivizes the sale of customer data. This makes New Jersey an outlier when it comes to the treatment of loyalty programs, as most states make a clear distinction between these two areas.

Confusing language inserted into the bill last minute could burden the collection of data necessary for loyalty programs. One of the provisions of the law allows consumers to opt-out of data collection. Unfortunately, this language extends to the processing of data for loyalty programs. Consumers already opt-in to the collection of data when they sign-up for a loyalty program; a certain understanding exists that consumer data will be processed in the administration of loyalty programs. Under the law, consumers could be burdened to continually opt-in to remain in a loyalty program anytime data is processed.

There is ambiguous language in the bill related to valuation of consumer data. The law appears to try and mimic California language where any consumer data sold must provide benefits to the consumer of similar value. Instead, the New Jersey language is unclear on who is responsible for valuing the data. Equally as concerning, businesses with loyalty programs would have to attempt and put a valuation on a program that provides continuing benefits to consumers over the span of many years.

Penalties

Any violation under the law will fall under New Jersey’s Consumer Fraud Act, considered one of the strongest in the country.

When Does the Law Take Effect?

The law takes effect a year after enactment: January 16, 2025.