SENATE COMMERCE COMMITTEE

STATEMENT TO

SENATE, No. 332

STATE OF NEW JERSEY

DATED:  JUNE 9, 2022

      The Senate Commerce Committee reports favorably Senate Bill No. 332.

     This bill requires a commercial Internet website and online service operator (operator) to notify consumers of the collection and disclosure of “personally identifiable information,” as that term is defined in the bill, to third parties. An operator that collects through the Internet the personally identifiable information of a consumer is to provide on its Internet website or online service notification to a consumer that includes, but is not limited to:

     1)    the categories of the personally identifiable information that the operator collects through the Internet website or online service about a consumer who uses or visits its commercial Internet website or online service;

     2)    all third parties with which the operator may disclose a consumer’s personally identifiable information;

     3)    whether a third party may collect personally identifiable information about a consumer’s online activities over time and across different commercial Internet websites or online services when the consumer uses the Internet website or online service of the operator;

     4)    a description of the process for an individual consumer who uses or visits the commercial Internet website or online service to review and request changes to any of his or her personally identifiable information that is collected by the commercial Internet website or online service of the operator;

     5)    the process by which the operator notifies consumers who use or visit the commercial Internet website or online service of material changes to the notification required to be made available pursuant to this subsection, along with the effective date of the notice; and

     6)    information concerning one or more designated request addresses that a consumer may use to request information under the bill.

     This bill requires that an operator that discloses a consumer’s personally identifiable information to a third party is to make the following information available to the consumer free of charge upon receipt of a verified request from the consumer for this information through a designated request address: the consumer’s personally identifiable information that was disclosed; and the names and contact information of the third parties that received the consumer’s personally identifiable information. An operator that receives a request from a consumer is to provide a response to the consumer within 60 days of its verification and is to provide the information for all disclosures of personally identifiable information that occurred in the prior 12 months.

     The bill provides that an operator that collects the personally identifiable information of a consumer through its commercial Internet website or online service and sells the personally identifiable information of the consumer through the Internet is to clearly and conspicuously post a link on its commercial Internet website or online service, or in another prominently accessible location the commercial Internet website maintains for consumer privacy settings, to an Internet webpage maintained by the operator, which enables a consumer, by verified request, to opt out of the sale of the consumer’s personally identifiable information. The method in which a consumer may opt out shall be in a form and manner determined by the operator, provided that a consumer is not to be required to establish an account with the operator in order to opt out of the sale of a consumer’s personally identifiable information.

     An operator is to be prohibited from discriminating against a consumer if the consumer chooses to opt out of the sale of the consumer’s personally identifiable information. The provisions of the bill are not to prohibit the operator’s ability to offer consumers discounts, loyalty programs, or other incentives for the sale of the consumer’s personally identifiable information, or to provide different services to consumers that are reasonably related to the value of the relevant data.

     Further, the bill prohibits an operator from discriminating against or penalizing a consumer if the consumer chooses to opt out of the disclosure of the consumer’s personally identifiable information.

     The provisions of the bill are not to apply to certain types of information and institutions listed in the bill.

     Nothing in the bill is to require an operator to re-identify de-identified data or collect, retain, use, link, or combine personally identifiable information concerning a consumer that it would not otherwise collect, retain, use, link, or combine in the ordinary course of business.

     The Attorney General is to have sole authority to enforce a violation of the bill.

This bill was pre-filed for introduction in the 2022-2023 session pending technical review. As reported, the bill includes the changes required by technical review, which has been performed.