ASSEMBLY REGULATED PROFESSIONS COMMITTEE

STATEMENT TO

ASSEMBLY, No. 2549

STATE OF NEW JERSEY

DATED:  JUNE 2, 2022

     The Assembly Regulated Professions Committee reports favorably Assembly Bill No. 2549.

     This bill places certain requirements on consumer reporting agencies to protect the personal information of consumers, and to provide certain consumer protections in the event of a breach of security of that personal information. 

     The bill requires consumer reporting agencies, to the extent it is technologically feasible, to encrypt the personal information of consumers held by or transferred by the consumer reporting agency.  To the extent it is not technologically feasible to encrypt the information, the consumer reporting agency is required to implement and maintain alternative compensating controls consistent with industry standards and the consumer reporting agency’s assessment of risk, to protect the security, confidentiality and integrity of the personal information.

     Additionally, if a consumer is the victim of a breach of security concerning the consumer’s personal information, the bill provides that, upon request of the consumer, a consumer reporting agency must provide a free credit report to the consumer three times during any 12-month period.  Current law only requires one free credit report during any 12-month period.

     Finally, if the consumer reporting agency itself is the entity disclosing a breach of a consumer’s personal information, the bill requires the consumer reporting agency to offer to provide appropriate identity theft prevention and mitigation services at no cost to the consumer for not less than 60 months.  The consumer reporting agency must notify the consumer of this offer and is prohibited from placing any further conditions on the consumer, or otherwise requiring the consumer to waive any of the consumer’s rights, by the consumer accepting the offer.