Bill > S2316

This bill amends existing New Jersey law to impose stricter regulations on data brokers and data collectors, defining them as entities that knowingly collect or purchase personal data from consumers with whom they have no direct relationship and then sell or license that data to third parties, with specific exemptions for certain entities like government agencies and financial institutions. Key provisions include prohibiting data brokers and data collectors from selling or licensing "sensitive data," which encompasses a broad range of personal information including health, financial, and precise location data, and requiring these entities to register annually with the Division of Consumer Affairs and pay a tiered registration fee based on the number of consumers whose data they handle, with penalties for non-compliance. The bill also mandates that data controllers, which are entities that collect and process personal data, limit data collection to what is necessary, obtain consent for processing sensitive data, and implement robust security measures, with specific requirements for data protection assessments for processing activities that present a heightened risk of harm to consumers.