Revises requirements for disclosure of a breach of security of certain computerized records containing personal information.
Impact
The bill primarily revises New Jersey's approach to data breach notifications, aiming to standardize the time frame companies are required to notify affected individuals. By enforcing a deadline of five business days, it addresses concerns about delayed responses that could leave consumers vulnerable. Additionally, it clarifies that businesses must document their assessments of whether the misuse of information is possible, which they must verify through consultations with law enforcement agencies. This documentation is required to be retained for five years, ensuring a record of compliance is maintained.
Summary
Senate Bill S1352 seeks to amend existing laws regarding the disclosure protocols following a breach of security concerning personal information. Specifically, it updates the requirements introduced under the Identity Theft Prevention Act, P.L.2005, c.226, mandating that businesses and public entities in New Jersey notify affected customers within a maximum of five business days after discovering a breach. This notification must occur unless law enforcement determines delaying disclosure is necessary to avoid hindering an investigation. The bill emphasizes timely communication with customers to enhance data protection and accountability.
Contention
Notable points of contention around S1352 involve the balance between consumer protection and the operational burdens placed on businesses. Proponents of the bill argue that timely notifications are essential for consumer safety, particularly in the digital age where personal information is frequently targeted. Critics may express concerns regarding the potential costs for businesses in adapting to these stricter regulations, especially smaller companies that may lack resources to comply with enhanced cybersecurity measures and the administrative burden of adhering to tight notification timelines. Additionally, the documentation requirements could raise concerns about privacy and data management.
Requires certain notifications and free credit reports for customers following breach of security of personal information within business or public entity.
Requires certain notifications and free credit reports for customers following breach of security of personal information within business or public entity.
Provides for notification to the commissioner of insurance of breaches of data security in systems containing certain personal information relating to consumers. (8/1/16)
Requires certain notifications and free credit reports for customers following breach of security of personal information within business or public entity.
Requires certain notifications and free credit reports for customers following breach of security of personal information within business or public entity.