A6125

An Act concerning the protection of certain private information and amending various parts of statutory law.

Be It Enacted by the Senate and General Assembly of the State of New Jersey:

1. Section 1 of P.L.2015, c.226 (C.2C:20-31.1) is amended to read as follows:

1. a. For the purposes of this section:

"Authorized person" means a covered person or any of the following persons hereby authorized to submit or revoke a request for the redaction or nondisclosure of a home address or unpublished telephone number on behalf of a covered person pursuant to subsection c. of this section:

(1) on behalf of any federal judge, a designee of the United States Marshals Service or of the clerk of any United States District Court;

(3) on behalf of any immediate family member who is a minor and who is otherwise entitled to address redaction or nondisclosure pursuant to this act, P.L.2021, c.371 (C.47:1B-1 et al.), the parent or legal guardian thereof;

(4) with the covered person’s written consent, the covered person’s employer;

(5) with the covered person’s written consent, any union, benevolent association, or other labor association in which the covered person is a member or to which the covered person pays dues; and

(6) an agent designated by the covered person, in writing.

“Covered entity” means a person, business, or association that discloses or re-discloses on the Internet the covered information of a covered person.

“Covered information” means the home address or unpublished home telephone number of a covered person.

"Covered person" means an active, formerly active, or retired judicial officer, law enforcement officer, [or] child protective investigator in the Division of Child Protection and Permanency, member of the Legislature, or municipal court administrator, as those terms are defined by section 1 of P.L.1995, c.23 (C.47:1A-1.1), or prosecutor and any immediate family member residing in the same household as the judicial officer, law enforcement officer, child protective investigator in the Division of Child Protection and Permanency, [or] prosecutor, member of the Legislature, or municipal court administrator.

"Home telephone number" means any telephone number used primarily for personal communications, including a landline or cellular telephone number.

"Immediate family member" means a spouse, child, or parent of, or any other family member related by blood or by law to, an active, formerly active, or retired judicial officer, law enforcement officer, [or] child protective investigator in the Division of Child Protection and Permanency, member of the Legislature, or municipal court administrator, as those terms are defined by section 1 of P.L.1995, c.23 (C.47:1A-1.1), or prosecutor and who resides in the same household as the judicial officer, law enforcement officer, child protective investigator in the Division of Child Protection and Permanency, [or] prosecutor, member of the Legislature, or municipal court administrator.

"News media" means newspapers, magazines, press associations, news agencies, wire services, or other similar printed means of disseminating news to the general public.

"Person" shall not be construed to include in any capacity the custodian of a government record as defined in section 1 of P.L.1995, c.23 (C.47:1A-1.1).

b. Upon notification pursuant to subsection c. of this section, and not later than [10] 45 business days after receipt thereof, a person shall not knowingly, with purpose to expose another to harassment or risk of harm to life or property, or in reckless disregard of the probability of such exposure, post, repost, publish, or republish on the Internet, or otherwise make available, the home address or unpublished home telephone number of any covered person, except in compliance with any court order, law enforcement investigation, or request by a government agency or person duly acting on behalf of the agency.

c. An authorized person, as defined in subsection a. of this section, seeking to prohibit the disclosure of the home address or unpublished home telephone number of any covered person consistent with subsection b. of this section shall provide written notice to the person from whom the authorized person is seeking nondisclosure that the authorized person is an authorized person and requesting that such person cease the disclosure of such information and remove the protected information from the Internet or where otherwise made available.

d. A reckless violation of subsection b. of this section is a crime of the fourth degree. A purposeful violation of subsection b. of this section is a crime of the third degree.

e. This section shall not be construed to prohibit a person, business, covered entity, or association that has received information as unredacted pursuant to the provisions of sections 1 through 3 of P.L.2021, c.371 (C.47:1B-1 through C.47:1B-3) from making the information available consistent with the purposes for which the person, business, covered entity, or association received the information. A person, business, covered entity, or association that uses or makes available the information in a way that is inconsistent with the purposes for which the person, business, covered entity, or association received the information shall be liable as provided pursuant to subsection d. of this section.

f. Nothing herein shall be construed to impose liability on the news media for failure to remove information from previously printed newspapers, and nothing herein shall be construed to impose liability relating to telephone directories or directory assistance unless the covered person has requested to be unpublished in the directory and directory assistance by the applicable publication deadline.

(cf: P.L.2023, c.113, s.5)

2. Section 1 of P.L.1995, c.23 (C.47:1A-1.1) is amended to read as follows:

1. As used in P.L.1963, c.73 (C.47:1A-1 et seq.) as amended and supplemented:

"Biotechnology" means any technique that uses living organisms, or parts of living organisms, to make or modify products, to improve plants or animals, or to develop micro-organisms for specific uses; including the industrial use of recombinant DNA, cell fusion, and novel bioprocessing techniques.

"Child protective investigator in the Division of Child Protection and Permanency" means an employee of the Division of Child Protection and Permanency in the Department of Children and Families whose primary duty is to investigate reports of child abuse and neglect, or any other employee of the Department of Children and Families whose duties include investigation, response to, or review of allegations of child abuse and neglect.

"Commercial purpose" means the direct or indirect use of any part of a government record for sale, resale, solicitation, rent, or lease of a service or any use by which the user expects a profit either through commission, salary, or fee. "Commercial purpose" shall not include the use of a government record for any purpose by:

(1) the news media, or any parent company, subsidiary, or affiliate of any news media, as defined by section 2 of P.L.1977, c.253 (C.2A:84A-21a) ;

(2) any news, journalistic, educational, scientific, scholarly, or governmental organization;

(3) any person authorized to act on behalf of a candidate committee, joint candidate committee, political committee, continuing political committee, political party committee, or legislative leadership committee, as defined by section 3 of P.L.1973, c.83 (C.19:44A-3), registered with the New Jersey Election Law Enforcement Commission;

(4) any labor organization;

(5) any contractor signatory to a collective bargaining agreement seeking information material to the enforcement of State or federal statutes or regulations regarding, but not limited to, wage and hour protections, workplace safety, or public procurement and public bidding, including, but not limited to, requests for certified payrolls or information about all bids submitted in response to a public procurement process subsequent to the deadline for the submission of all bids for that solicitation;

(6) any employee, agent, contractor, or affiliates of any entity identified in paragraphs (1) through (5) of this definition in this section; or

(7) any non-profit entity, including organizations or individuals qualified for exemption from federal taxation pursuant to section 501(c)(3) of the federal Internal Revenue Code, 26 U.S.C. s.501(c)(3) and section 501(c)(4) of the federal Internal Revenue Code, 26 U.S.C. s.501(c)(4), when the entity does not sell, resell, solicit, rent, or lease a government record to an unaffiliated third party in a way in which the entity expects a fee.

"Constituent" means any State resident or other person communicating with a member of the Legislature.

"Criminal investigatory record" means a record which is not required by law to be made, maintained or kept on file that is held by a law enforcement agency which pertains to any criminal investigation or related civil enforcement proceeding.

"Custodian of a government record" or "custodian" means in the case of a municipality, the municipal clerk and in the case of any other public agency, the officer officially designated by formal action of that agency's director or governing body, as the case may be.

"Government record" or "record" means any paper, written or printed book, document, drawing, map, plan, photograph, microfilm, data processed or image processed document, information stored or maintained electronically or by sound-recording or in a similar device, or any copy thereof, that has been made, maintained or kept on file in the course of his or its official business by any officer, commission, agency or authority of the State or of any political subdivision thereof, including subordinate boards thereof, or that has been received in the course of his or its official business by any such officer, commission, agency, or authority of the State or of any political subdivision thereof, including subordinate boards thereof. The terms shall not include inter-agency or intra-agency advisory, consultative, or deliberative material

"Labor organization" means any organization which exists and is constituted for the purpose, in whole or in part, of collective bargaining, of dealing with employers concerning grievances, terms or conditions of employment, or of other mutual aid or protection in connection with employment.

A government record shall not include the following information which is deemed to be confidential for the purposes of P.L.1963, c.73 (C.47:1A-1 et seq.) as amended and supplemented:

information received by a member of the Legislature from a constituent or information held by a member of the Legislature concerning a constituent, including, but not limited to, information in written form or contained in any e-mail or computer data base, or in any telephone record whatsoever, unless it is information the constituent is required by law to transmit;

any memorandum, correspondence, notes, report or other communication prepared by, or for, the specific use of a member of the Legislature in the course of the member's official duties, except that this provision shall not apply to an otherwise publicly-accessible report which is required by law to be submitted to the Legislature or its members;

any copy, reproduction or facsimile of any photograph, negative or print, including instant photographs and videotapes of the body, or any portion of the body, of a deceased person, taken by or for the medical examiner at the scene of death or in the course of a post mortem examination or autopsy made by or caused to be made by the medical examiner except for use by a legal next of kin, a legal representative, or an attending physician of the deceased person, for use as a court of this State permits, or for use by any law enforcement agency in this State or any other state or federal law enforcement agency;

criminal investigatory records;

the portion of any criminal record concerning a person's detection, apprehension, arrest, detention, trial or disposition for unlawful manufacturing, distributing, or dispensing, or possessing or having under control with intent to manufacture, distribute, or dispense, marijuana or hashish in violation of paragraph (11) of subsection b. of N.J.S.2C:35-5, or a lesser amount of marijuana or hashish in violation of paragraph (12) of subsection b. of that section, or a violation of either of those paragraphs and a violation of subsection a. of section 1 of P.L.1987, c.101 (C.2C:35-7) or subsection a. of section 1 of P.L.1997, c.327 (C.2C:35-7.1) for distributing, dispensing, or possessing, or having under control with intent to distribute or dispense, on or within 1,000 feet of any school property, or on or within 500 feet of the real property comprising a public housing facility, public park, or public building, or for obtaining, possessing, using, being under the influence of, or failing to make lawful disposition of marijuana or hashish in violation of paragraph (3) or (4) of subsection a., or subsection b., or subsection c. of N.J.S.2C:35-10, or for a violation of any of those provisions and a violation of N.J.S.2C:36-2 for using or possessing with intent to use drug paraphernalia with that marijuana or hashish;

victims' records, except that a victim of a crime shall have access to the victim's own records;

any written request by a crime victim for a record to which the victim is entitled to access as provided in this section, including, but not limited to, any law enforcement agency report, domestic violence offense report, and temporary or permanent restraining order;

personal firearms records, except for use by any person authorized by law to have access to these records or for use by any government agency, including any court or law enforcement agency, for purposes of the administration of justice;

personal identifying information received by the Division of Fish and Wildlife in the Department of Environmental Protection in connection with the issuance of any license authorizing hunting with a firearm;

trade secrets and proprietary commercial or financial information obtained from any source. For the purposes of this paragraph, trade secrets shall include software, applications, and code obtained by a public body under a licensing agreement which prohibits its disclosure;

any record within the attorney-client privilege. This paragraph shall not be construed as exempting from access attorney or consultant bills or invoices except that such bills or invoices may be redacted to remove any information protected by the attorney-client privilege;

administrative or technical information regarding computer hardware, tablets, telephones, electronic computing devices, software applications, and networks or devices which operate on or as a part of a computer network or related technologies within the same, which shall include system logs, event logs, transaction logs, tracing logs, or any logs which are reasonably construed to be similar to the same and generated by the devices or servers covered within this paragraph, which, if disclosed, could jeopardize computer security, or related technologies;

emergency or security information or procedures for any buildings or facility which, if disclosed, would jeopardize security of the building or facility or persons therein;

security measures and surveillance techniques which, if disclosed, would create a risk to the safety of persons, property, electronic data or software;

security alarm system activity and access reports, including video footage, for any public building, facility, or grounds unless the request identifies a specific incident that occurred, or a specific date and limited time period at a particular public building, facility, or grounds, and is deemed not to compromise the integrity of the security system by revealing capabilities and vulnerabilities of the system;

information which, if disclosed, would give an advantage to competitors or bidders, including detailed or itemized cost estimates prior to bid opening;

information generated by or on behalf of public employers or public employees in connection with any sexual harassment complaint filed with a public employer or with any grievance filed by or against an individual or in connection with collective negotiations, including documents and statements of strategy or negotiating position;

information which is a communication between a public agency and its insurance carrier, administrative service organization or risk management office;

information which is to be kept confidential pursuant to court order;

any copy of form DD-214, NGB-22, or that form, issued by the United States Government, or any other certificate of honorable discharge, or copy thereof, from active service or the reserves of a branch of the Armed Forces of the United States, or from service in the organized militia of the State, that has been filed by an individual with a public agency, except that a veteran or the veteran's spouse or surviving spouse shall have access to the veteran's own records;

any copy of an oath of allegiance, oath of office or any affirmation taken upon assuming the duties of any public office, or that oath or affirmation, taken by a current or former officer or employee in any public office or position in this State or in any county or municipality of this State, including members of the Legislative Branch, Executive Branch, Judicial Branch, and all law enforcement entities, except that the full name, title, and oath date of that person contained therein shall not be deemed confidential;

that portion of any document which discloses the social security number, credit card number, debit card number, bank account information, month and day of birth, any personal email address required by a public agency for government applications, services, or programs, any telephone number or driver license number of any person, or, in accordance with section 2 of P.L.2021, c.371 (C.47:1B-2), that portion of any document which discloses the home address, whether a primary or secondary residence, of any active, formerly active, or retired judicial officer, law enforcement officer, child protective investigator in the Division of Child Protection and Permanency, member of the Legislature, municipal court administrator, or prosecutor, or, as defined in section 1 of P.L.2021, c.371 (C.47:1B-1), any immediate family member thereof; except for use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf thereof, or any private person or entity seeking to enforce payment of court-ordered child support; except with respect to the disclosure of driver information by the New Jersey Motor Vehicle Commission as permitted by section 2 of P.L.1997, c.188 (C.39:2-3.4); except with respect to the disclosure of information included in records and documents maintained by the Department of the Treasury in connection with the State's business registry programs; and except that a social security number contained in a record required by law to be made, maintained or kept on file by a public agency shall be disclosed when access to the document or disclosure of that information is not otherwise prohibited by State or federal law, regulation or order or by State statute, resolution of either or both houses of the Legislature, Executive Order of the Governor, rule of court or regulation promulgated under the authority of any statute or executive order of the Governor;

that portion of any document that discloses the personal identifying information of any person provided to a public agency for the sole purpose of receiving official notifications;

a list of persons identifying themselves as being in need of special assistance in the event of an emergency maintained by a municipality for public safety purposes pursuant to section 1 of P.L.2017, c.266 (C.40:48-2.67) and their personal identifying information;

a list of persons identifying themselves as being in need of special assistance in the event of an emergency maintained by a county for public safety purposes pursuant to section 6 of P.L.2011, c.178 (C.App.A:9-43.13) and their personal identifying information;

that portion of any document that requires and would disclose personal identifying information of persons under the age of 18 years, except with respect to the disclosure of driver information by the New Jersey Motor Vehicle Commission as permitted by section 2 of P.L.1997, c.188 (C.39:2-3.4) or the disclosure of driver information to any insurer or insurance support organization, or a self-insured entity, or its agents, employees, or contractors, for use in connection with claims investigation activities, antifraud activities, rating, or underwriting, and except with respect to the disclosure of voter information on voter and election records pursuant to section 8 of P.L.2024, c.16 (C.47:1A-5.3);

personal identifying information disclosed on domestic animal permits, licenses, and registration;

structured reference data that helps to sort and identify attributes of the information it describes, referred to as metadata, or any extrapolation or compilation thereof, which shall include the SMTP header properties of emails, except that portion that identifies authorship, identity of editor, and time of change;

New Jersey State Firemen's Association financial relief applications;

owner and maintenance manuals;

data classified under the "Health Insurance Portability and Accountability Act of 1996," Pub.L.104-191; and

any indecent or graphic images of a person's intimate parts, as defined in section 10 of P.L.2024, c.16 (C.47:1A-5.2), that are captured in a photograph or video recording without the prior written consent of the subject of the photograph or video footage, as defined in section 10 of P.L.2024, c.16 (C.47:1A-5.2).

A government record shall not include, with regard to any public institution of higher education, the following information which is deemed to be privileged and confidential:

pedagogical, scholarly and/or academic research records and/or the specific details of any research project conducted under the auspices of a public higher education institution in New Jersey, including, but not limited to, research, development information, testing procedures, or information regarding test participants, related to the development or testing of any pharmaceutical or pharmaceutical delivery system, except that a custodian may not deny inspection of a government record or part thereof that gives the name, title, expenditures, source and amounts of funding and date when the final project summary of any research will be available;

test questions, scoring keys and other examination data pertaining to the administration of an examination for employment or academic examination;

records of pursuit of charitable contributions or records containing the identity of a donor of a gift if the donor requires non-disclosure of the donor's identity as a condition of making the gift provided that the donor has not received any benefits of or from the institution of higher education in connection with such gift other than a request for memorialization or dedication;

valuable or rare collections of books or documents obtained by gift, grant, bequest or devise conditioned upon limited public access;

information contained on individual admission applications; and

information concerning student records or grievance or disciplinary proceedings against a student to the extent disclosure would reveal the identity of the student.

Nothing in this section shall be construed to limit the requirements to provide and make publicly available the information pursuant to section 5 of P.L.1963, c.150 (C.34:11-56.29) and section 5 of P.L.1999, c.238 (C.34:11-56.52).

"Judicial officer" means any active, formerly active, or retired federal, state, county, or municipal judge, including a judge of the Tax Court and any other court of limited jurisdiction established, altered, or abolished by law, a judge of the Office of Administrative Law, a judge of the Division of Workers' Compensation, and any other judge established by law who serves in the executive branch.

"Law enforcement agency" means a public agency, or part thereof, determined by the Attorney General to have law enforcement responsibilities.

"Law enforcement officer" means a person whose public duties include the power to act as an officer for the detection, apprehension, arrest, and conviction of offenders against the laws of this State.

"Member of the Legislature" means any person elected or selected to serve in the New Jersey Senate or General Assembly.

“Municipal court administrator” means a person employed by a county or municipality in accordance with subsection a. of N.J.S.2B:12-10. “Municipal court administrator” includes a deputy administrator and acting administrator designated as such in accordance with subsection b. of N.J.S.2B:12-10.

"Personal firearms record" means any information contained in a background investigation conducted by the chief of police, the county prosecutor, or the Superintendent of State Police, of any applicant for a permit to purchase a handgun, firearms identification card license, or firearms registration; any application for a permit to purchase a handgun, firearms identification card license, or firearms registration; any document reflecting the issuance or denial of a permit to purchase a handgun, firearms identification card license, or firearms registration; and any permit to purchase a handgun, firearms identification card license, or any firearms license, certification, certificate, form of register, or registration statement. For the purposes of this paragraph, information contained in a background investigation shall include, but not be limited to, identity, name, address, social security number, telephone number, fax number, driver's license number, email address, or social media address of any applicant, licensee, registrant, or permit holder.

"Public agency" or "agency" means any of the principal departments in the Executive Branch of State Government, and any division, board, bureau, office, commission or other instrumentality within or created by such department; the Legislature of the State and any office, board, bureau or commission within or created by the Legislative Branch; and any independent State authority, commission, instrumentality or agency. The terms also mean any political subdivision of the State or combination of political subdivisions, and any division, board, bureau, office, commission or other instrumentality within or created by a political subdivision of the State or combination of political subdivisions, and any independent authority, commission, instrumentality or agency created by a political subdivision or combination of political subdivisions.

"Victim of a crime" means a person who has suffered personal or psychological injury or death or incurs loss of or injury to personal or real property as a result of a crime, or if such a person is deceased or incapacitated, a member of that person's immediate family.

"Victim's record" means an individually identifiable file or document held by a victims' rights agency which pertains directly to a victim of a crime except that a victim of a crime shall have access to the victim's own records.

"Victims' rights agency" means a public agency, or part thereof, the primary responsibility of which is providing services, including, but not limited to, food, shelter, or clothing, medical, psychiatric, psychological or legal services or referrals, information and referral services, counseling and support services, or financial services to victims of crimes, including victims of sexual assault, domestic violence, violent crime, child endangerment, child abuse or child neglect, and the Victims of Crime Compensation Board, established pursuant to P.L.1971, c.317 (C.52:4B-1 et seq.) and continued as the Victims of Crime Compensation Office pursuant to P.L.2007, c.95 (C.52:4B-3.2 et al.) and Reorganization Plan No. 001-2008.

As used in this section, "personal identifying information" means information that may be used, alone or in conjunction with any other information, to identify a specific individual. Personal identifying information shall include, but shall not be limited to, the following data elements: name, social security number, credit card number, debit card number, bank account information, month and day of birth, any personal email address required by a public agency for government applications, services, or programs, personal telephone number, the street address portion of any person's primary or secondary home address, or driver license number of any person. "Personal identifying information" shall not include any street address, mailing address, email address, or telephone number of a public agency. "Personal identifying information" shall not include the email address of a governmental affairs agent.

(cf: P.L.2024, c.16, s.1)

3. Section 6 of P.L.2001, c.404 (C.47:1A-5) is amended to read as follows:

6. a. The custodian of a government record shall permit the record to be inspected, examined, and copied by any person during regular business hours; or in the case of a municipality having a population of 5,000 or fewer according to the most recent federal decennial census, a board of education having a total district enrollment of 500 or fewer, or a public authority having less than $10 million in assets, during not less than six regular business hours over not less than three business days per week or the entity's regularly-scheduled business hours, whichever is less; unless a government record is exempt from public access by: P.L.1963, c.73 (C.47:1A-1 et seq.) as amended and supplemented; any other statute; resolution of either or both houses of the Legislature; regulation promulgated under the authority of any statute or Executive Order of the Governor; Executive Order of the Governor; Rules of Court; any federal law; federal regulation; or federal order. Prior to allowing access to any government record, the custodian thereof shall redact from that record any information which discloses the social security number, credit card number, personal telephone number, or driver license number of any person, or, in accordance with section 2 of P.L.2021, c.371 (C.47:1B-2), the home address, whether a primary or secondary residence, of any active, formerly active, or retired judicial officer, prosecutor, law enforcement officer, or child protective investigator in the Division of Child Protection and Permanency, member of the Legislature, a municipal court administrator, or, as defined in section 1 of P.L.2021, c.371 (C.47:1B-1), any immediate family member thereof; except for use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf thereof, or any private person or entity seeking to enforce payment of court-ordered child support; except with respect to the disclosure of driver information by the New Jersey Motor Vehicle Commission as permitted by section 2 of P.L.1997, c.188 (C.39:2-3.4); and except that a social security number contained in a record required by law to be made, maintained or kept on file by a public agency shall be disclosed when access to the document or disclosure of that information is not otherwise prohibited by State or federal law, regulation or order or by State statute, resolution of either or both houses of the Legislature, Executive Order of the Governor, rule of court or regulation promulgated under the authority of any statute or executive order of the Governor. Except where an agency can demonstrate an emergent need, a regulation that limits access to government records shall not be retroactive in effect or applied to deny a request for access to a government record that is pending before the agency, the council or a court at the time of the adoption of the regulation.

b. (1) A copy or copies of a government record may be purchased by any person upon payment of the fee prescribed by law or regulation.

Except as otherwise provided by law or regulation and except as provided in paragraph (2) of this subsection, the fee assessed for the duplication of a government record embodied in the form of printed matter shall be $0.05 per letter size page or smaller, and $0.07 per legal size page or larger. Access to electronic records and non-printed materials shall be provided free of charge, but the public agency may charge for the actual costs of any needed supplies such as computer discs. No fee shall be charged if the request is completed by directing the requestor to the requested government record that is available on the public agency's website or the website of another public agency.

(2) No fee shall be charged to a victim of a crime for a copy or copies of a record to which the crime victim is entitled to access, as provided in section 1 of P.L.1995, c.23 (C.47:1A-1.1).

c. Whenever the nature, format, manner of collation, or volume of a government record embodied in the form of printed matter to be inspected, examined, or copied pursuant to this section is such that the record cannot be reproduced by ordinary document copying equipment in ordinary business size or involves an extraordinary expenditure of time and effort to accommodate the request, the public agency may charge, in addition to the actual cost of duplicating the record, a special service charge that shall be based upon the actual direct cost of providing the copy or copies, and such special service charge shall be reasonable. The custodian shall provide the requestor with an explanation for and an itemized list of the fees or charges.

The requestor shall have the opportunity to review and object to any fee or charge prior to it being incurred. There shall be a rebuttable presumption that the fees or charges presented by the custodian are reasonable. If the requestor objects to the fees or charges, the burden of proof shall be on the requestor to demonstrate that the fees or charges are unreasonable.

d. A custodian shall permit access to a government record and provide a copy thereof in the medium or format requested if the public agency maintains the record in that medium or format. If the public agency does not maintain the record in the medium or format requested, the custodian shall convert the record to the medium or format requested, if the medium or format is available to the public agency and does not require a substantial amount of manipulation or programming of information technology or the services of a third-party vendor. If the public agency converts the record to the medium or format requested, the agency may charge, in addition to the actual cost of duplication, a special service fee that shall be reasonable and shall be based on the cost for any extensive use of information technology, or for the labor cost of personnel providing the service, that is actually incurred by the agency or attributable to the agency for the programming, clerical, and supervisory assistance required, or both. If the public agency does not maintain the record in the electronic medium or format requested, and the medium or format is not available to the public agency without a substantial amount of manipulation or programming of information technology, the custodian shall be under no obligation to convert the record to the electronic medium or format requested but shall, at a minimum, provide a copy in the electronic format maintained by the public agency.

e. Immediate access ordinarily shall be granted to budgets, bills, vouchers, contracts, including collective negotiations agreements and individual employment contracts, and public employee salary and overtime information. Immediate access to government records shall not be required to be granted for documents over 24 months old.

Government records shall be made available to the public on a publicly available website to the extent feasible. A public agency may enter into shared services agreements for providing certain government records electronically.

If the government record in a complete and unabridged form is readily available on a public agency's website, the custodian may require the requestor to obtain the record from the website, which shall contain a search bar feature on its home page. The custodian shall provide the requestor with directions to assist in finding the record on the website, including providing the website URL address and the location on the website of the search bar, menu button, tab, link, landing page, or equivalent, which contains the requested record. If the requestor does not respond to the custodian within seven business days of the custodian providing information about a record on the public agency's website, the request shall be deemed fulfilled unless the version of the government record on the public agency's website fails to contain non-protected information contained in the original record, in which case the custodian shall produce the original version of the record subject to any redactions required by law. If, after the custodian has provided instructions on how to find a record on a public agency's website, the requestor is unable to find the record upon making a good faith effort to locate the record on the website, the requestor shall notify the custodian within seven business days of the custodian providing the information. Upon receiving such a request for assistance from a requestor, the custodian shall make a reasonable attempt to assist the requestor in finding the record on the website within seven business days of the requestor notifying the custodian. If the requestor is still unable to locate the record and requests a physical copy, the custodian shall provide the requestor with a physical copy of the record for a fee not exceeding two times the cost of the production of the document. The custodian shall provide the requestor with the physical copy of the record within seven business days of the request for a physical copy.

f. The custodian of a public agency shall adopt the form established by the Government Records Council pursuant to subsection b. of section 8 of P.L.2001, c.404 (C.47:1A-7),for the use of any person who requests access to a government record held or controlled by the public agency. The form shall provide space for the name, address, email address and telephone number of the requestor and a brief description of the government record sought. A request shall be submitted by a requestor in the form adopted by the custodian and the custodian may deny a request that is incomplete, except that a requestor indicating the request is being submitted anonymously shall not be grounds for denial. A completed form adopted by the custodian, a letter, or an email from a requestor including all of the information required on the adopted form shall suffice in place of a completed form as a valid government record request. If the letter or email from a requestor includes substantially more information than required on the adopted form and requires more than reasonable effort to clarify the information, the custodian may deny the request. If a letter or an email from a requestor does not include all of the information required on the adopted form, the custodian may deny the record request. A request may be submitted anonymously provided, however, that anonymous requestors shall not be permitted to institute proceedings pursuant to section 7 of P.L.2001, c.404 (C.47:1A-6). A request that is submitted anonymously shall not be considered incomplete.

The form also shall include space for a requestor to certify whether the government record will be used by that requestor or another person for a commercial purpose, and the requestor shall be required to provide this information for the request to be fulfilled.

The form shall include space for the custodian to indicate which record will be made available, when the record will be available, and the fees to be charged. The form shall also include the following: (1) specific directions and procedures for requesting a record; (2) a statement as to whether prepayment of fees or a deposit is required; (3) the time period within which the public agency is required by P.L.1963, c.73 (C.47:1A-1 et seq.) as amended and supplemented, to make the record available; (4) a statement of the requestor's right to challenge a decision by the public agency to deny access and the procedure for filing an appeal; (5) space for the custodian to list reasons if a request is denied in whole or in part; (6) space for the requestor to sign and date the form; (7) space for the custodian to sign and date the form if the request is fulfilled or denied. The custodian may require a deposit against costs for reproducing documents sought through a request whenever the custodian anticipates that the information thus requested will cost in excess of $5 to reproduce.

Custodians who have adopted electronic government record request forms shall provide directions on how to submit requests for government records, including any required forms, on the public agency's website.

Custodians shall be permitted to provide an electronic response to any electronic records request if government records are available electronically.

g. A request for access to a government record shall be in writing and hand-delivered, mailed, transmitted electronically, or otherwise conveyed to the appropriate custodian. A public agency may make available to the public on its website an online form, portal, or software for transmitting requests electronically. The form established by the Government Records Council, pursuant to subsection b. of section 8 of P.L.2001, c.404 (C.47:1A-7), may be submitted electronically or by fax. Each submission of a government record request form or an email record request shall be made to the custodian of not more than one public agency. Submission of repeated requests to multiple custodians in the same public agency for the same record, while an identical or substantially similar request is pending in the agency, shall permit the custodian to deny the request.

A custodian shall promptly comply with a request to inspect, examine, copy, or provide a copy of a government record. If the custodian is unable to comply with a request for access, the custodian shall indicate the specific basis therefor on the request form and promptly return it to the requestor. The custodian shall sign and date the form and provide the requestor with a copy thereof. If the custodian of a government record asserts that part of a particular record is exempt from public access pursuant to P.L.1963, c.73 (C.47:1A-1 et seq.) as amended and supplemented, the custodian shall delete or excise from a copy of the record that portion which the custodian asserts is exempt from access and shall promptly permit access to the remainder of the record. If a request for access to a government record would substantially disrupt agency operations, the custodian may deny access to the record after informing the requestor of the potential disruption to agency operations and attempting to reach a reasonable solution with the requestor that accommodates the interests of the requestor and the agency.

A party to a legal proceeding may not request a government record if the record sought is the subject of a court order, including a pending discovery request, and a custodian shall not be required to complete such a request. The requestor shall be required to certify whether the government record is being sought in connection with a legal proceeding and identify the proceeding for the request to be fulfilled. For purposes of this provision, a party to a legal proceeding shall include a party subject to a court order, any attorney representing that party, and any person acting as an agent for or on behalf of that party. Nothing in this paragraph shall bar a request for a government record filed by a labor organization or by a contractor signatory to a collective bargaining agreement seeking information material to the enforcement of State or federal statutes or regulations regarding, but not limited to, wage and hour protections, workplace safety, or public procurement and public bidding, including, but not limited to, requests for certified payrolls or information about all bids submitted in response to a public procurement process subsequent to the deadline for the submission of all bids for that solicitation, when the request by the labor organization or contractor signatory is not sought in connection with or in furtherance of discovery requests in a court proceeding.

A custodian shall not be required to complete a request, including for, but not limited to, mail, email, text messages, correspondence, or social media postings and messages, if the request does not identify a specific job title or accounts to be searched, a specific subject matter, and is not confined to a reasonable time period, or if the custodian determines that the request would require research and the collection of information from the contents of government records and the creation of new government records setting forth that research and information. It shall be sufficient for a requestor to identify specific individuals by the individual's job title and position.

h. Any officer or employee of a public agency who receives a request for access to a government record shall forward the request to the custodian of the record or direct the requestor to the custodian of the record. The request shall not be considered submitted until it is received by the custodian of records.

i. (1) Unless a shorter time period is otherwise provided by statute, regulation, or executive order, a custodian of a government record shall grant access to a government record or deny a request for access to a government record as soon as possible, but not later than seven business days after receiving the request, or 14 business days if the request is for a commercial purpose or if the records have to be reviewed by the public agency for the purpose of the agency's compliance with P.L.2021, c.371 (C.47:1B-1 et seq.), but the custodian shall notify the requestor of the additional response time within seven business days, provided that the record is currently available and not in storage or archived. The response time periods of seven or 14 business days, as established in this subsection, shall be an additional seven business days longer if the public agency is a fire district which employs one or fewer full-time employees who serve as custodians. If a commercial requestor would like to receive the record within seven business days, as established in this subsection, the custodian shall provide the requestor with a copy of the record and may charge a special service fee not exceeding two times the cost of the production of the record.

In the event a records custodian is unable to fulfill a records request due to unforeseen circumstances or circumstances that otherwise reasonably necessitate additional time to fulfill the records request, the custodian shall be entitled to a reasonable extension of any response deadline and shall notify the requestor of the time extension within seven business days after receiving the request.

In the event a custodian fails to respond within seven business days or 14 business days, as appropriate, after receiving a request, the failure to respond shall be deemed a denial of the request, unless the requestor has elected not to accurately identify themselves or to provide an accurate address, email address, or telephone number. If the requestor has elected not to accurately identify themselves or to provide an accurate address, email address, or telephone number, the custodian shall not be required to respond until the requestor contacts the custodian seeking a response to the original request.

If the government record is in storage or archived, the requestor shall be so advised within seven or 14 business days, as appropriate, after the custodian receives the request. The requestor shall be advised by the custodian when the record can be made available, which shall be no more than 21 business days from the date the requestor is so advised. If the record is not made available by that time, access shall be deemed denied.

A public agency shall not be considered to be in possession of a public record that is created, maintained, or received by another public agency and made available to the public agency either by remote access to a computer network or by distribution as a courtesy copy, unless the agency that created, maintained, or received the record resides within the judicial branch of the State Government. A records custodian of a public agency that receives a request for a record created, maintained, or received by another public agency shall not be obligated to provide the record to the requestor. In the event the custodian does not provide the record, the custodian shall direct the requestor within seven business days to the public agency that, to the best of their knowledge, created, maintains, or received the requested record, at which time the request shall be considered completed.

The custodian shall not be required to complete an identical request for access to a government record from the same requestor if the information has not changed. Nothing in this section shall prevent a requestor from filing periodic requests regarding regularly updated public records, including, but not limited to, certified payrolls, permits, and licensing applications.

A requestor shall have 14 business days to retrieve the government records following notice from the custodian that the request has been completed and the records are available.

(2) During a period declared pursuant to the laws of this State as a state of emergency, public health emergency, or state of local disaster emergency, the deadlines by which to respond to a request for, or grant or deny access to, a government record under paragraph (1) of this subsection or subsection e. of this section shall not apply, provided, however, that the custodian of a government record shall make a reasonable effort, as the circumstances permit, to respond to a request for access to a government record within seven business days or 14 business days, as appropriate, or as soon as possible thereafter.

j. A custodian shall include information on the public agency's website and public records request form regarding a requestor's right to appeal a denial of, or failure to provide, access to a government record and the procedure by which an appeal may be filed, which shall include the website address and toll-free information line phone number of the Government Records Council.

k. The files maintained by the Office of the Public Defender that relate to the handling of any case shall be considered confidential and shall not be open to inspection by any person unless authorized by law, court order, or the State Public Defender.

(cf: P.L.2024, c.16, s.2)

4. Section 1 of P.L.2021, c.371 (C.47:1B-1) is amended to read as follows:

1. a. As used in [this act,] P.L.2021, c.371 (C.47:1B-1 et al.), as amended and supplemented:

"Authorized person" means a covered person or any of the following persons hereby authorized to submit or revoke a request for the redaction or nondisclosure of a home address on behalf of a covered person:

(1) on behalf of any federal judge, a designee of the United States Marshals Service or of the clerk of any United States District Court, provided that the designee submits the affirmation required under subsection d. of section 2 of P.L.2021, c.371 (C.47:1B-2) signed by each federal judge for whom a request or revocation is made;

(2) on behalf of any covered person who is deceased or medically or psychologically incapacitated, a person acting on behalf of the covered person as a designated trustee, as an estate executor, or pursuant to a written power of attorney or other legal instrument, provided that the person signs and submits the affirmation required under subsection d. of section 2 of P.L.2021, c.371 (C.47:1B-2) in the stead of the covered person; [and]

(3) on behalf of any immediate family member who is a minor and who is otherwise entitled to address redaction or nondisclosure pursuant to this act, the parent or legal guardian thereof;

(4) with the covered person’s written consent, the covered person’s employer;

(5) with the covered person’s written consent, any union, benevolent association, or other labor association in which the covered person is a member or to which the covered person pays dues; and

(6) an agent designated by the covered person, in writing.

“Covered information” means the home address or unpublished home telephone number of a covered person.

"Covered person" means an active, formerly active, or retired judicial officer, law enforcement officer, [or] child protective investigator in the Division of Child Protection and Permanency, member of the Legislature, or municipal court administrator, as those terms are defined by section 1 of P.L.1995, c.23 (C.47:1A-1.1), or prosecutor, and any immediate family member residing in the same household as the judicial officer, law enforcement officer, child protective investigator in the Division of Child Protection and Permanency, [or] prosecutor, member of the Legislature, or municipal court administrator.

"Immediate family member" means a spouse, child, or parent of, or any other family member related by blood or by law to, an active, formerly active, or retired judicial officer, law enforcement officer, [or] child protective investigator in the Division of Child Protection and Permanency, member of the Legislature, or municipal court administrator, as defined by section 1 of P.L.1995, c.23 (C.47:1A-1.1), or prosecutor and who resides in the same household as the judicial officer, law enforcement officer, child protective investigator in the Division of Child Protection and Permanency, [or] prosecutor, member of the legislature, or municipal court administrator.

"Member of the Legislature" means any person elected or selected to serve in the New Jersey Senate or General Assembly.

b. There is established in the Department of Community Affairs an office to be known as the Office of Information Privacy. The office shall be led by a director, who shall be appointed by and serve at the pleasure of the Commissioner of Community Affairs and who may hire staff as necessary.

c. The director shall establish:

(1) a secure portal through which an authorized person may submit or revoke a request for the redaction or nondisclosure of a covered person's home address from certain records and Internet postings, as provided in section 2 of P.L.2021, c.371 (C.47:1B-2); and such requests shall not be subject to disclosure under P.L.1963, c.73 (C.47:1A-1 et seq.);

(2) a process by which an authorized person may petition the director for reconsideration of a denial of such request or any revocations thereof;

(3) a process by which a person or entity may request receipt of a record that does not contain redactions, or of information that is not disclosable, resulting from subsection a. of section 2 of P.L.2021, c.371 (C.47:1B-2); and

(4) a process for the evaluation of any other exceptions to the requirement for redaction or nondisclosure pursuant to section 2 of P.L.2021, c.371 (C.47:1B-2), whether categorical or individualized. The director may grant an exception to any person or entity for the receipt of the unredacted records or information pursuant to this process.

d. The director shall evaluate and either approve or deny a request submitted pursuant to subsection c. of this section and any revocations thereof.

e. (1) The director may enter into any agreement or contract necessary to effectuate the purposes of this act.

(2) The director may issue any guidance, guidelines, decisions, or rules and regulations necessary to effectuate the purposes of this act. The rules and regulations shall be effective immediately upon filing with the Office of Administrative Law for a period not to exceed 18 months, and shall, thereafter, be amended, adopted, or readopted in accordance with the provisions of the "Administrative Procedure Act," P.L.1968, c.410 (C.52:14B-1 et seq.).

(cf: P.L.2023, c.113, s.3)

5. Section 2 of P.L.2021, c.371 (C.47:1B-2) is amended to read as follows:

2. a. An authorized person seeking the redaction or nondisclosure of the home address of any covered person from certain records and Internet postings consistent with section 2 of P.L.2015, c.226 (C.47:1-17), section 1 of P.L.1995, c.23 (C.47:1A-1.1), or section 6 of P.L.2001, c.404 (C.47:1A-5) shall submit a request in accordance with section 1 of P.L.2021, c.371 (C.47:1B-1) to the Office of Information Privacy through the secure portal established by the office. The address shall only be subject to redaction or nondisclosure if a request is submitted to and approved by the Director of the Office of Information Privacy.

b. (1) A public agency shall redact or cease to disclose, in accordance with section 6 of P.L.2001, c.404 (C.47:1A-5) and section 1 of P.L.1995, c.23 (C.47:1A-1.1), respectively, the home address of a covered person approved by the Office of Information Privacy not later than 30 days following the approval. A public agency shall also discontinue the redaction or nondisclosure of the home address of any covered person for whom a revocation request has been approved not later than 30 days following the approval.

(2) A custodian of a public agency who makes a reasonable effort to comply with this subsection shall be presumed to have acted without willful, purposeful, or reckless disregard of the law.

c. An immediate family member who has sought and received approval under subsection a. of this section and who no longer resides with the active, formerly active, or retired judicial officer, law enforcement officer, child protective investigator in the Division of Child Protection and Permanency, [or] prosecutor, member of the Legislature, or municipal court administrator shall submit through the portal a revocation request not later than 30 days from the date on which the immediate family member no longer resided with the judicial officer, law enforcement officer, child protective investigator in the Division of Child Protection and Permanency, [or] prosecutor, member of the Legislature, or municipal court administrator.

d. A person submitting a request pursuant to subsection a. of this section shall affirm in writing that the person understands that certain rights, duties, and obligations are affected as a result of the request, including:

(1) the receipt of certain notices from non-governmental entities as would otherwise be required pursuant to the "Municipal Land Use Law," P.L.1975, c.291 (C.40:55D-1 et seq.);

(2) the signing of petitions related to the nomination or election of a candidate to public office or related to any public question;

(3) the eligibility or requirements related to seeking or accepting the nomination for election or election to public office, or the appointment to any public position;

(4) the sale or purchase of a home or other property, recordation of a judgment, lien or other encumbrance on real or other property, and any relief granted based thereon;

(5) the ability to be notified of any class action suit or settlement; and

(6) any other legal, promotional, or official notice which would otherwise be provided to the person but for the redaction or nondisclosure of such person's home address pursuant to subsection a. of this section.

(cf: P.L.2024, c.16, s.6)

6. Section 3 of P.L.2015, c.225 (C.56:8-166.1) is amended to read as follows:

3. Not later than one year following the date of enactment of P.L. , c. (C. ) (pending before the Legislature as this bill), the director of the Office of Information Privacy, established pursuant to section 1 of P.L.2021, c.371 (C.47:1B-1), shall establish a secure portal that, at no cost to the covered person or authorized person, allows a covered person or an authorized person acting on the covered person’s behalf, through a single verified request as defined in subsection d. of this section, to request that each covered entity to which this section applies not disclose or re-disclose on the Internet or otherwise make available, the covered person’s covered information.

a. The secure portal established pursuant to subsection a. of this section shall:

(1) [Upon notification pursuant to paragraph (2) of this subsection, and not later than 10 business days following receipt thereof, a person, business, or association shall not disclose or re-disclose on the Internet or otherwise make available, the home address or unpublished home telephone number of any covered person, as defined in subsection d. of this section.] (Deleted by amendment, P.L. , c. (C. ) (pending before the Legislature as this bill)

(2) [An authorized person seeking to prohibit the disclosure of the home address or unpublished home telephone number of any covered person consistent with paragraph (1) of this subsection shall provide written notice to the person from whom the authorized person is seeking nondisclosure that the authorized person is an authorized person and requesting that the person cease the disclosure of the information and remove the protected information from the Internet or where otherwise made available.] (Deleted by amendment, P.L. , c. (C. ) (pending before the Legislature as this bill)

(3) [An immediate family member who has provided notice pursuant to paragraph (2) of this subsection and who no longer resides with the judicial officer, law enforcement officer, child protective investigator in the Division of Child Protection and Permanency, or prosecutor shall provide notice to that effect to the person, business, or association not later than 30 days from the date on which the immediate family member no longer resided with the judicial officer, law enforcement officer, child protective investigator in the Division of Child Protection and Permanency, or prosecutor.] (Deleted by amendment, P.L. , c. (C. ) (pending before the Legislature as this bill)

(4) automatically hash all information submitted for inclusion in the secure portal;

(5) allow the director to maintain independent hashed registries of each type of information obtained through such portal;

(6) allow covered entities to submit hashed queries to such independent hashed registries;

(7) establish a process for authorized persons to submit requests in list form or bulk, provided the lists or bulk submissions include the verifying information required by this subsection or the director;

(8) establish a process for covered entities to report requests processed pursuant to this subsection and requests the covered entity is unable to process because the request cannot be verified or because processing is otherwise not required by this section; and

(9) establish a process for covered and authorized persons to look up or view the covered entities that have processed or denied a covered person’s request and the reasons for the denial.

b. A [person, business, or association that violates subsection a. of this section shall be liable to the covered person or the covered person's assignee, who may bring a civil action in the Superior Court] covered entity shall:

(1) access the secure portal at least once during each 45-day period to determine whether a request has been approved to prevent disclosure of a covered person’s covered information;

(2) pay an initial fee, and an annual fee thereafter, to access the secure portal. The Director of the Office of Information Privacy shall establish the fees required pursuant to this paragraph;

(3) retain a record of requests processed and the minimum data necessary for the purpose of ensuring the covered person’s covered information remains undisclosed and not use such retained information for any other purpose;

(4) certify to the Director of the Office of Information Privacy not less than once during each 45-day period regarding:

(a) each date the covered entity accessed the secure portal;

(b) each covered person for whom the entity has processed a request approved by the director; and

(c) each request on behalf of a covered person that was received by the covered entity and approved by the director, but that the covered entity was unable to process and the reason the covered entity was unable to process the request; and

(5) be subject to penalties for failure to comply with the provisions of this section.

c. [The] In addition to any other penalty provided by law, a covered entity that fails to access the secure portal in violation of subsection b. of this section shall be subject to a civil penalty in the amount of $200 for each 45-day period that the entity fails to access the portal, which shall be collected and enforced by the Commissioner of the Department of Consumer Affairs in the Department of Law and Public Safety in a summary proceeding pursuant to the "Penalty Enforcement Law of 1999," P.L.1999, c.274 (C.2A:58-10 et seq.). The Superior Court shall have jurisdiction of proceedings for the enforcement of the penalty provided by this section.

Prior to bringing an enforcement action pursuant to this subsection the director shall issue a notice to the covered entity, including an opportunity to cure the alleged noncompliance. The notice shall outline the actions to be taken in order to cure the alleged noncompliance. If the covered entity fails to cure the alleged violation within 30 days after receiving notice of alleged noncompliance, an enforcement action may be brought.

In an action relating to a violation of this section, court [shall] may award:

(1) actual damages, but not less than liquidated damages computed at the rate of $1,000 for each negligent or intentional violation of this act;

(2) punitive damages upon proof of willful or reckless disregard of the law;

(3) reasonable attorney's fees and other litigation costs reasonably incurred; and

(4) any other preliminary and equitable relief as the court determines to be appropriate.

d. For the purposes of this section:

["Assignee" means a person or entity to whom or which an authorized person has assigned, in writing, a covered person's right to bring a civil action for a violation of subsection a. of this section.]

(1) on behalf of any federal judge, a designee of the United States Marshals Service or of the clerk of any United States District Court;

(3) on behalf of any immediate family member who is a minor and who is otherwise entitled to address redaction or nondisclosure pursuant to this act, the parent or legal guardian thereof;

(4) with the covered person’s written consent, the covered person’s employer;

(5) with the covered person’s written consent, any union, benevolent association, or other labor association in which the covered person is a member or to which the covered person pays dues; and

(6) an agent designated by the covered person, in writing.

“Covered entity” means a person, business, or association that discloses or re-discloses on the Internet the covered information of a covered person.

“Covered information” means the home address or unpublished home telephone number of a covered person.

"Covered person" means an active, formerly active, or retired judicial officer, law enforcement officer, [or] child protective investigator in the Division of Child Protection and Permanency, as those terms are defined by section 1 of P.L.1995, c.23 (C.47:1A-1.1), or prosecutor, member of the Legislature, or municipal court administrator, and any immediate family member residing in the same household as such judicial officer, law enforcement officer, child protective investigator in the Division of Child Protection and Permanency, [or] prosecutor, member of the Legislature, or municipal court administrator.

“Director” means the Director of the Office of Information Privacy established pursuant to section 1 of P.L.2021, c.371 (C.47:1B-1).

"Disclose" shall mean to solicit, sell, manufacture, give, provide, lend, trade, mail, deliver, transfer, post, publish, distribute, circulate, disseminate, present, exhibit, advertise, or offer[, and shall include making available or viewable within a searchable list or database, regardless of whether a search of such list or database is actually performed].

“Hash data” means to input data into a cryptographic, one-way, collision-resistant formula or function that maps a bit string of arbitrary length to a fixed-length bit string to produce a cryptographically secure value.

“Hashed” means the type of value produced by hashing data.

“Hashed data” means data that has been hashed. Hashed data also may be referred to as “hash values,” “hash codes,” or “hashes.”

“Hashed registry” means a table or index of hashed data.

“Hashed query” means a query submitted to a hashed registry.

"Home telephone number" means any telephone number used primarily for personal communications, including a landline or cellular telephone number.

"Immediate family member" means a spouse, child, or parent of, or any other family member related by blood or by law to, an active, formerly active, or retired judicial officer, law enforcement officer, or child protective investigator in the Division of Child Protection and Permanency, as those terms are defined by section 1 of P.L.1995, c.23 (C.47:1A-1.1), or prosecutor and who resides in the same household as such judicial officer, law enforcement officer, child protective investigator in the Division of Child Protection and Permanency, [or] prosecutor, member of the Legislature, or municipal court administrator.

“Member of the Legislature” means any person elected or selected to serve in the New Jersey Senate or General Assembly.

"News media" means newspapers, magazines, press associations, news agencies, wire services, or other similar printed means of disseminating news to the general public.

"Person" shall not be construed to include in any capacity the custodian of a government record as defined in section 1 of P.L.1995, c.23 (C.47:1A-1.1).

“Verified request” means the process through which a covered person, or an authorized person acting on a covered person’s behalf, may submit a request pursuant to subsection a. of this section, and by which a covered entity can reasonably authenticate the request and the covered person to whom the request pertains using commercially reasonable means.

e. This section shall not be construed to prohibit a person, business, covered entity, or association that has received information as unredacted pursuant to the provisions of sections 1 through 3 of P.L.2021, c.371 (C.47:1B-1 through C.47:1B-3) from making the information available consistent with the purposes for which the person, business, or association received the information. A person, business, or association that uses or makes available the information in a way that is inconsistent with the purposes for which the person, business, or association received the information shall be liable as provided pursuant to subsection c. of this section.

g. In establishing the secure portal pursuant to this section, the director shall develop and establish:

(1) a process for verifying and authenticating a request submitted by an authorized person for the redaction or nondisclosure of covered information from certain records and Internet postings, as provided in section 2 of P.L.2021, c.371 (C.47:1B-2) or section 3 of P.L.2015, c225 (C.56:8-166.1). Such requests shall not be subject to disclosure under P.L.1963, c.73 (C.47:1A-1 et seq.);

(2) a standard form through which an authorized person may submit or revoke a request for the redaction or nondisclosure of covered information from certain records and Internet postings. The form shall:

(a) require an authorized person to submit covered information; and

(b) allow an authorized person to submit or revoke request for the redaction or nondisclosure of the covered information of a single person, or multiple persons on a single form;

(3) reasonable security procedures and practices necessary to protect the information contained in the secure portal from unauthorized access, use, disclosure, destruction, or modification. The director shall annually evaluate the security procedures and practices, and revise them as the director deems appropriate;

(4) an initial fee and, thereafter, an annual fee, for a covered entity to access the secure portal;

(5) procedures for maintaining on the portal independent, searchable registries of each type of covered information; and

(6) a process for a covered entity to certify to the director:

(a) each date that the covered entity has accessed the registry;

(b) the covered information for each covered person for whom the covered entity has processed a request;

(c) each request to protect the covered information of a covered person that was approved by the director and received by the covered entity, but was unable to be processed by the covered entity, and the reason the covered entity was unable to process the request; and

(7) a process for an immediate family member who no longer resides with a covered person to submit a revocation request through the portal.

h. An immediate family member who has previously submitted a request for the redaction or nondisclosure of covered information and no longer resides with the covered person shall submit a revocation request pursuant to paragraph (7) of subsection g. of this section not later than 30 days from the date on which the immediate family member no longer resided with the covered person.

i. A covered entity that makes a reasonable effort to comply with the provisions of subsection b. of this section shall be presumed to have acted without willful, purposeful, or reckless disregard of the law.

j. The director may enter into any agreement or contract as may be necessary to effectuate the purposes of this section.

k. The director may issue any guidance, guidelines, decisions, or rules and regulations necessary to effectuate the purposes of this section. The rules and regulations shall be effective immediately upon filing with the Office of Administrative Law for a period not to exceed 18 months, and shall, thereafter, be amended, adopted, or readopted in accordance with the provisions of the “Administrative Procedure Act,” P.L.1968, c.410 (C.52:14B-1 et seq.).

(cf: P.L.2023, c.113, s.6)

7. Section 8 of P.L.2020, c.125 (C.56:8-166.3) is amended to read as follows:

8. This act shall be liberally construed in order to accomplish its purpose and the public policy of this State, which is to enhance the safety and security of certain public officials in the justice system, including judicial officers, law enforcement officers, child protective investigators in the Division of Child Protection and Permanency, [and] prosecutors, members of the Legislature, and municipal court administrators, who serve or have served the people of New Jersey, and the immediate family members of these individuals, to foster the ability of these public servants who perform critical roles in the justice system to carry out their official duties without fear of personal reprisal from affected individuals related to the performance of their public functions. For the purposes of this section, "child protective investigator in the Division of Child Protection and Permanency" has the same meaning as is provided in section 1 of P.L.1995, c.23 (C.47:1A-1.1).

(cf: P.L.2023, c.113, s.7)

8. Section 10 of P.L.2023, c.266 (C.56:8-166.13) is amended to read as follows:

10. Nothing in section 3 of P.L.2015, 226 (C.56:8-166.1), section 8 of P.L.2020, c.125 (C:56:8-166.3), and P.L.2023, c.266 (C.56:8-166.4 et seq.) shall apply to:

a. protected health information collected by a covered entity or business associate subject to the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the "Health Insurance Portability and Accountability Act of 1996," Pub.L.104-191, and the "Health Information Technology for Economic and Clinical Health Act,"42 U.S.C. s.17921 et seq.;

b. a financial institution, data, or an affiliate of a financial institution that is subject to Title V of the federal "Gramm-Leach-Bliley Act," 15 U.S.C. s.6801 et seq., and the rules and implementing regulations promulgated thereunder;

c. the secondary market institutions identified in 15 U.S.C. s.6809(3)(D) and 12 C.F.R. s.1016.3(l)(3)(iii);

d. an insurance institution subject to P.L.1985, c.179 (C.17:23A-1 et seq.);

e. the sale of a consumer's personal data by the New Jersey Motor Vehicle Commission that is permitted by the federal "Drivers' Privacy Protection Act of 1994," 18 U.S.C. s.2721 et seq.;

f. personal data collected, processed, sold, or disclosed by a consumer reporting agency, as defined in 15 U.S.C. s.1681a(f), if the collection, processing, sale, or disclosure of the personal data is limited, governed, and collected, maintained, disclosed, sold, communicated, or used only as authorized by the federal "Fair Credit Reporting Act," 15 U.S.C. s.1681 et seq., and implementing regulations;

g. any State agency as defined in section 2 of P.L.1971, c.182 (C.52:13D-13), any political subdivision, and any division, board, bureau, office, commission, or other instrumentality created by a political subdivision; or

h. personal data that is collected, processed, or disclosed, as part of research conducted in accordance with the Federal Policy for the protection of human subjects pursuant to 45 C.F.R. Part 46 or the protection of human subjects pursuant to 21 C.F.R. Parts 50 and 56.

(cf: P.L.2023, c.266, s.9)

9. Section 12 of P.L.2023, c.266 (C.56:8-166.15) is amended to read as follows:

12. a. Nothing in section 3 of P.L.2015, 226 (C.56:8-166.1), section 8 of P.L.2020, c.125 (C:56:8-166.3), and P.L.2023, c.266 (C.56:8-166.4 et seq.) shall be construed to restrict a controller's or processor's ability to:

(1) comply with federal or State law or regulations;

(2) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, State, municipal, or other governmental authorities;

(3) cooperate with law enforcement agencies concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate federal, State, or municipal ordinances or regulations;

(4) investigate, establish, exercise, prepare for, or defend legal claims;

(5) provide a product or service specifically requested by a consumer;

(6) perform under a contract to which a consumer is a party, including fulfilling the terms of a written warranty;

(7) take steps at the request of a consumer prior to entering into a contract;

(8) take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or another individual, and where the processing cannot be manifestly based on another legal basis;

(9) prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity, preserve the integrity or security of systems, or investigate, report, or prosecute those responsible for any such action;

(10) engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board that determines, or similar independent oversight entities that determine,

(a) whether the deletion of the information is likely to provide substantial benefits that do not exclusively accrue to the controller,

(b) the expected benefits of the research outweigh the privacy risks, and

(c) whether the controller has implemented reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with re-identification;

(11) assist another controller, processor, or third party with any of the obligations under P.L.2023, c.266 (C.56:8-166.4 et seq.); or

(12) personal data for reasons of public interest in the area of public health, community health, or population health, but solely to the extent that such processing is

(a) subject to suitable and specific measures to safeguard the rights of the consumer whose personal data is being processed, and

(b) under the responsibility of a professional subject to confidentiality obligations under federal, State, or local law.

b. The obligations imposed on controllers or processors under P.L.2023, c.266 (C.56:8-166.4 et seq.) shall not restrict a controller's or processor's ability to collect, use or retain data for internal use to:

(1) conduct internal research to develop, improve, or repair products, services, or technology;

(2) effectuate a product recall;

(3) identify and repair technical errors that impair existing or intended functionality; or

(4) perform internal operations that are reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer's existing relationship with the controller, or are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party. Personal data collected, used, or retained pursuant to this subsection shall, where applicable, take into account the nature and purpose or purposes of such collection, use or retention. Such data shall be subject to reasonable administrative, technical, and physical measures to protect the confidentiality, integrity, and accessibility of the personal data and to reduce reasonably foreseeable risks of harm to consumers relating to such collection, use, or retention of personal data.

c. The obligations imposed on controllers or processors under P.L.2023, c.266 (C.56:8-166.4 et seq.) shall not apply where compliance by the controller or processor with the provisions of law would violate an evidentiary privilege under the laws of this State. Nothing in P.L.2023, c.266 (C.56:8-166.4 et seq.) shall be construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of the State as part of a privileged communication.

d. Personal data that are processed by a controller pursuant to an exception provided by this section:

(1) shall not be processed for any purpose other than a purpose expressly listed in this section; and

(2) shall be processed solely to the extent that the processing is necessary, reasonable, and proportionate to the specific purpose or purposes listed in this section.

e. If a controller processes personal data pursuant to an exemption in this section, the controller bears the burden of demonstrating that such processing qualifies for the exemption and complies with the requirements in this section.

f. Processing personal data for the purposes expressly identified in this section shall not solely make a legal entity a controller with respect to such processing if such entity would not otherwise meet the definition of a controller.

(cf: P.L.2023, c.266, s.12)

10. This act shall take effect on the first day of the seventh month next following the date of enactment.

STATEMENT

This bill expands protections provided under “Daniel’s Law,” which shields the home addresses and personal information of certain public officials and employees, to include members of the Legislature and municipal court administrators. The bill also requires the Director of the Office of Information Privacy (OIP) in the Department of Community Affairs to establish a secure portal for the purpose of prohibiting disclosure of personal information by private entities. In addition, the bill establishes civil penalties for a private entity’s failure to comply with the procedures and requirements established under the bill.

Covered Persons Under Daniel’s Law

New Jersey's “Daniel's Law,” P.L.2021, c.371, was enacted to prevent harm by limiting public access to personal information of certain public officials who request protection under the law. Currently, the protections are afforded to active, formerly active, or retired judicial officers, prosecutors, law enforcement officers, child protective investigators, and immediate family members residing in the same household as these individuals. This bill would extend those protections to members of the Legislature and municipal court administrators.

Expanded Definitions

The bill expands the meaning of certain terms under Daniel’s law and establishes and defines several new terms. The new definitions include “covered entity,” “covered information,” “hashed,” “hashed data,” “hashed query,” “hashing data,” “hashed registry,” “member of the Legislature,” and “municipal court administrator.”

“Covered entity” is defined under the bill to mean a person, business, or association that discloses or re-discloses on the Internet the covered information of a covered person. “Covered information” means the home address or home telephone number of a covered person. “Municipal court administrator” is defined as a person employed by a county or municipality in accordance with subsection a. of N.J.S.A.2B:12-10 and includes a deputy administrator and acting administrator designated as such in accordance with subsection b. of N.J.S.A.2B:12-10.

“Hashed” means the type of value produced by hashing data. “Hashed data” means data that has been hashed. Hashed data also may be referred to as “hash values,” “hash codes,” or “hashes.” “Hashing data” means to input data into a cryptographic, one-way, collision-resistant formula or function that maps a bit string of arbitrary length to a fixed-length bit string to produce a cryptographically secure value. “Hashed query” means a query submitted to a hashed registry. “Hashed registry” means a table or index of hashed data.

Under the bill, the definition of “authorized person” is expanded to include, with the covered person’s written consent, (1) the covered person’s employer; (2) any union, benevolent association, or other labor association in which the covered person is a member or to which the covered person pays dues; (3) or a person designated, in writing, by the covered person to serve as the covered person’s agent.

Establishment of New Secure Portal Binding on Private Actors

Daniel’s Law established the OIP, and required the director of the OIP to establish a secure portal for these public servants to apply for redaction protections. This bill requires the director of OIP to establish a separate secure portal for prohibiting the disclosure of personal information by private, covered entities. Specifically, the bill requires the director of OIP to establish:

· a process for verifying and authenticating a request submitted by an authorized person for the redaction or nondisclosure of a covered person's covered information from certain records and Internet postings, as provided under current law;

· a standard form through which an authorized person may submit or revoke a request for the redaction or nondisclosure of a covered person's covered information from certain records and Internet postings. The form is must:

o require an authorized person to submit the covered information;

o allow an authorized person to submit or revoke request for the redaction or nondisclosure of the covered information of a single person, or multiple persons on a single form;

· reasonable security procedures and practices necessary to protect the information contained in the secure portal from unauthorized access, use, disclosure, destruction, or modification. The director is required to annually evaluate the security procedures and practices, and revise them as the director deems appropriate; and

· an initial fee and, thereafter, an annual fee, for a covered entity to access the portal;

· and implement procedures for maintaining on the portal independent, searchable registries of each type of covered information; and

· a process for a covered entity to certify to the director each date that the covered entity has accessed the registry; the covered information for each covered person for whom the covered entity has processed a request; and each request to protect the covered information for a covered person that was approved by the director and received by the covered entity, but was unable to be processed by the covered entity and the reason the covered entity was unable to process the request.

Required Certifications and Penalties

The bill requires a covered entity to access the secure portal at least once during each 45-day period to determine whether a request to prevent disclosure of a covered person’s covered information has been approved by the director. The bill further requires a covered entity to certify to the director not less than once during each 45-day period:

· each date that the covered entity accessed the secure portal;

· each covered person for whom the covered entity has processed a request approved by the director; and

· each request on behalf of a covered person that was received by a covered entity and approved by the director, but that the covered entity was unable to process and the reason the covered entity was unable to process the request.

In addition to any other penalty provided by law, a covered entity that fails to access the secure portal as required under the bill is be subject to a civil penalty in the amount of $200 for each 45-day period that the entity fails to access the portal. Prior to initiating an enforcement action, the Commissioner of the Department of Community Affairs is required to issue a notice to the covered entity of the violation, and provide the covered entity an opportunity to cure the violation within 30 days of the notice. If the covered entity fails to cure the violation within the 30-day period, the commissioner shall initiate an enforcement action.