New Jersey Senate Bill S1389

New Jersey 2024-2025 Regular Session

• Introduced: 1/9/24
• Refer: 1/9/24
• Chaptered: 1/9/24
• Passed: 1/9/24

Caption

Requires notification to consumers of collection and disclosure of personal data by certain entities.

Impact

The implications of S1389 are significant, as it strengthens consumer rights related to personal data. Consumers will gain the right to confirm whether a controller is processing their data, correct inaccuracies, delete their data, and opt out of various forms of processing, including targeted advertising and data sales. This creates a protective framework for consumers against misuse of their personal information, potentially leading to increased trust in online services. Furthermore, the bill requires controllers to complete data protection assessments and make these assessments available to the Division of Consumer Affairs, thus increasing accountability.

Summary

Senate Bill S1389, introduced in the New Jersey 221st Legislature, establishes important regulations concerning the collection and processing of personal data by certain entities, referred to as 'controllers'. The bill mandates that controllers must provide clear notification to consumers regarding the collection and disclosure of their personal data, ensuring consumers are fully informed of how their information is being used. Additionally, the bill sets forth specific requirements for consumer consent, emphasizing the need for a clear affirmative act from consumers before their data can be processed or shared with third parties.

Contention

Notably, S1389 has sparked discussions regarding its enforcement mechanisms and the limitations it places on entities that process personal data. While proponents argue the need for stronger privacy protections and consumer rights, some industry stakeholders voice concerns over the compliance burdens and the potential for conflicting regulations with existing federal laws. The bill is designed to exclude certain data types, including health information regulated by HIPAA and personal data collected by financial institutions, which has been a point of contention in discussions surrounding its broader applicability and effectiveness.