Bill

Bill > A4070


NJ A4070

NJ A4070
Establishes "Privacy Protection Act"; concerns collection and sharing of certain personal information.


summary

Introduced
02/05/2026
In Committee
02/12/2026
Crossed Over
Passed
Dead

Introduced Session

2026-2027 Regular Session

Bill Summary

This bill establishes the "Privacy Protection Act" concerning the collection and sharing of certain personal information by State and local government entities and health care facilities. Under the bill, government entities and health care facilities are prohibited from requesting or collecting information relating to a person's immigration status, citizenship status, place of birth, social security number, and individual taxpayer identification number unless it is necessary to assess eligibility for, or to administer, a requested public service, benefit, program, professional qualification or licensure. For a health care facility, the bill provides an exception when this information is necessary to ensure the safe and appropriate delivery of health care services. The bill provides that any information collected for that purpose, whether written or oral, concerning a person that is solicited, made or kept to assess eligibility for, or to administer the services, benefits, programs, professional qualifications, or licensure that is requested, used, or delivered is not considered a government record under the open public records act and is not to be disclosed except: (1) as required to administer benefits or services pursuant to State or federal law; (2) as required by a subpoena, valid court order, or warrant issued by a State or federal judge, or pursuant to federal law; (3) by an election agency when the disclosure of a candidate's citizenship status is a requirement for elected office; or (4) upon obtaining written consent from the person to whom the information pertains. The bill makes an exception to this requirement for a health care facility when the information is necessary to ensure the safe and appropriate delivery of health care services and as required by applicable State and federal law, including the "Health Insurance Portability and Accountability Act of 1996." The bill requires the Commissioner of Health to consult with the Attorney General (AG) to develop and publish standardized written consent forms in the most commonly encountered languages of the State to provide health care facilities a method to comply with the written consent requirements of the bill. In addition, the bill prohibits a government entity from selling, sharing, or transferring automated license plate recognition information concerning the operation of a person's motor vehicle, except: (1) to another government entity when permitted by law; (2) pursuant to a subpoena, valid court order, or judicial warrant; or (3) upon obtaining written consent from the person to whom the information pertains. Under the bill, a government entity's use of a third-party automated license plate recognition system vendor or service for its own data storage purposes is not be considered the sale, share, or transfer of automated license plate recognition information, provided that such vendor or service not sell, share, transfering, or make searchable to other entities or persons information without the authorization of the government entity. The bill requires that written consent for the disclosure of information be in the person's language of choice and that it include: (1) the exact record or information to be shared; (2) the purpose for sharing the record or information; (3) a statement clarifying that consent is voluntary and declining to consent will not result in discrimination or retaliation by the government entity or health care facility; (4) a statement clarifying that consent may be revoked, but that revocation does not impact any record or information already shared under prior written consent granted pursuant to the provisions of the bill; and (5) the person or agency to receive the record or information. In addition, the bill requires a government entity that discloses any record or information pursuant to a subpoena, valid court order, judicial warrant, or federal law to provide notice of the disclosure to the person to whom the record or information pertains within 90 days of the disclosure. The notice is required to set forth the: (1) specific record or information subject to disclosure; (2) party to which the record or information was disclosed; and (3) basis for disclosing the information. Under the bill, government entities are required to review their confidentiality policies, guidelines, and regulations and identify any changes necessary to ensure compliance with the provisions of the bill and make any changes as expeditiously as possible, but no later than one calendar year following the bill's effective date. The bill also requires these entities to prominently post these policies on their websites. The bill provides that the Commissioner of Health may adopt rules and regulations pursuant to the "Administrative Procedure Act" necessary to effectuate the bill's provisions as they relate to health care facilities. In addition, the bill specifies that, in addition to any officer, employee, or contractor of the New Jersey Motor Vehicle Commission (MVC), as provided under current law, a government entity, as defined by the bill, is also prohibited from disclosing any motor vehicle records containing personal information for any purposes related to Title 8 of the United States Code without the informed consent of the applicant, a warrant signed by a State or federal judge, lawful court order, or subpoena, except when it would be contrary to federal law. Under the bill, when responding to a warrant, court order, or subpoena requiring the disclosure of motor vehicle information, a government entity may disclose only those records or information specifically requested in the warrant, court order, or subpoena. A violation of the bill's provisions by a government entity may result in injunctive relief and civil liability for the damages to the person to whom the information pertains or that person's representative or guardian. A violation of the bill by a health care facility would result in penalties and enforcement by the Department of Health consistent with the department's authority under existing law and as a condition of licensure. The bill is effective immediately, except for the provisions regarding the Department of Health, which are effective one year after enactment.

AI Summary

This bill, titled the "Privacy Protection Act," aims to safeguard personal information collected and shared by state and local government entities and health care facilities. It prohibits these entities from requesting or collecting sensitive data like immigration status, citizenship, place of birth, Social Security numbers, or individual taxpayer identification numbers unless it's essential for determining eligibility for or administering public services, benefits, programs, or professional licenses. For health care facilities, an exception exists when this information is crucial for providing safe and appropriate care. Any information collected for these purposes is generally not considered a public record and cannot be disclosed unless required by law, a court order, by an election agency for specific candidacy requirements, or with the individual's explicit written consent. The bill also restricts government entities from selling or sharing automated license plate recognition (ALPR) data, which is information gathered by systems that read vehicle license plates, except under specific legal circumstances or with consent. It mandates that written consent forms clearly state what information will be shared, why, that consent is voluntary, and that it can be revoked. Furthermore, government entities must notify individuals within 90 days if their information is disclosed due to a subpoena, court order, warrant, or federal law, detailing what was shared, to whom, and the reason. All affected entities must review and update their privacy policies within a year of the bill's enactment and post them online. The bill also clarifies that health care facilities must maintain compliance with federal laws like the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and requires the Commissioner of Health to work with the Attorney General to create standardized consent forms in multiple languages for health care facilities. Violations by government entities can lead to legal action and civil liability, while health care facilities face penalties and enforcement by the Department of Health.

Committee Categories

Military Affairs and Security

Sponsors (5)

Last Action

Reported out of Assembly Committee, 2nd Reading (on 02/12/2026)

bill text


bill summary

Loading...

bill summary

Loading...

bill summary

Loading...