An Act prohibiting the collection or sharing of certain personal information by government entities and health care facilities, amending P.L.1997, c.188, and supplementing Title 26 and Title 52 of the Revised Statutes.
Be It Enacted by the Senate and General Assembly of the State of New Jersey:
C.52:4CC-1 Short title.
1. This act shall be known and may be cited as the “Privacy Protection Act.”
C.52:4CC-2 Findings, declarations.
2. The Legislature finds and declares that:
a. This State is committed to protecting the safety and constitutional rights of all persons and to conserving the State’s limited resources.
b. Individuals have a privacy interest in how their data is shared and used. Unrestricted, unauthorized, or undisclosed sharing may deter persons from accessing the care or services they need.
c. Therefore, it is fitting and proper to protect the rights of individuals to have access to and be provided with essential services in New Jersey to safeguard the privacy of persons seeking those services.
C.52:4CC-3 Definitions.
“Automated license plate recognition information” means information or data collected through the use of an automated license plate recognition system.
“Automated license plate recognition system” means a searchable database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of license plates and the characters they contain into computer-readable data.
“Election agency” means the New Jersey Division of Elections, the New Jersey Election Law Enforcement Commission, county boards of elections, county superintendents of elections, county clerks, municipal clerks, fire district board clerks, school district business administrators, and school district board secretaries.
“Government entity” means any of the principal departments in the executive branch of government of the State of New Jersey, and any division, board, bureau, office, commission or other instrumentality within or created by a department, and any independent authority, commission, instrumentality, or agency, including any public institution of higher education, of the State of New Jersey. The term also means any political subdivision of the State of New Jersey or combination of political subdivisions, and any division, board, bureau, office, commission, or other instrumentality within or created by a political subdivision of the State of New Jersey or combination of political subdivisions, and any independent authority, commission, instrumentality, or agency created by a political subdivision or combination of political subdivisions.
“Health care facility” means the same as set forth in subsection a. of section 2 of P.L.1971, c.136 (C.26:2H-2).
“Judicial order” means an order issued by a federal Article III judge or magistrate judge, or the State equivalent.
“Judicial warrant” means a warrant based on probable cause and issued by a federal Article III judge or magistrate judge, or the State equivalent.
"Patient" means a patient, resident, client, or any term used by a health care facility to refer to the individuals to whom a health care facility is providing care, including, but not limited to, a person who is being or has been screened or assessed for care by the health care facility.
“Record” means any paper, written or printed book, document, drawing, map, plan, photograph, microfilm, data-processed or image-processed document, information stored or maintained electronically or by sound-recording or in a similar device, or any copy thereof.
C.52:4CC-4 Limit on government entities requesting, collecting information from an individual, non-government entity.
4. a. A government entity shall not request or collect information from an individual or a non-governmental entity relating to a person’s immigration status, citizenship status, place of birth, social security number, or individual taxpayer identification number, except when this information is necessary to assess eligibility for, or to provide or administer, a public service, benefit, program, or professional qualification or license or as otherwise required by State law.
b. Nothing in this section shall be construed to prohibit or in any way restrict any action where the prohibition, restriction, or enforcement would be contrary to federal law, including 8 U.S.C. s.1373 and 8 U.S.C. s.1644, a judicial order, or a judicial warrant.
C.52:4CC-5 Certain personal information not considered government record, exceptions.
5. a. Any record or information, whether written or oral, relating to a person’s immigration status, citizenship status, place of birth, social security number, or individual taxpayer identification number that is solicited, made, or kept to assess eligibility for, or to provide or administer a public service, benefit, program, or professional qualification or license that is requested, used, or delivered, shall not be considered a governmental record pursuant to P.L.1963, c.73 (C.47:1A-1 et seq.), known commonly as the open public records act, and shall not be disclosed, except:
(1) as required pursuant to federal or State law to assess eligibility for, or to provide or administer, services, benefits, programs, or professional qualifications or licenses;
(2) as required by valid judicial order, judicial warrant, or as required by federal law;
(3) by an election agency when the disclosure of a candidate’s citizenship status is a requirement for elected office; or
(4) pursuant to the provisions of subsection c. of this section.
b. (1) A government entity shall not sell, share, or transfer automated license plate recognition information concerning the operation of a person’s motor vehicle, except:
(a) to another government entity when permitted by law;
(b) pursuant to a valid judicial order or judicial warrant;
(c) pursuant to the provisions of subsection c. of this section; or
(d) to a law enforcement agency of another jurisdiction for the purpose of a criminal investigation, provided that the receiving law enforcement agency certifies, electronically or in writing, to the government entity sharing the information that:
(i) the information shall not be used for any purpose related to civil immigration enforcement;
(ii) the information shall not be shared, sold, transferred, or made searchable by the receiving law enforcement agency; and
(iii) the receiving agency is bound by the same restrictions, use limitations, and data security requirements applicable to the government entity under New Jersey law and in accordance with any regulations and protocols established by the New Jersey State Police and directives or guidance issued by the Attorney General of New Jersey .
(2) (a) Any agreement executed pursuant to subparagraph (d) of paragraph (1) of subsection b. of this section shall be considered a governmental record pursuant to P.L.1963, c.73 (C.47:1A-1 et seq.), known commonly as the open public records act.
(b) If it is found that a law enforcement agency of another jurisdiction has used or shared automated license plate recognition information in violation of P.L.2026, c.4 (C.52:4CC-1 et al.) or any agreement executed pursuant to subparagraph (d) of paragraph (1) of subsection b. of this section, the Attorney General may, by order, prohibit the sharing of automated license plate recognition information with that law enforcement agency or deny access to the government entity.
(3) For purposes of this subsection, a government entity’s use of a third-party automated license plate recognition system vendor or service shall not be considered the sale, sharing, or transfer of automated license plate recognition information, provided that the vendor or service not sell, share, transfer, or make searchable to other entities or persons automated license plate recognition information unless the vendor or service meets the requirements of paragraph (1) of this subsection and receives authorization from the government entity.
c. This section shall not prohibit the disclosure of any record or information when the person to whom the record or information pertains has knowingly provided written consent for the disclosure. A government entity may develop and make publicly available a standardized written consent form that shall constitute a vital document pursuant to section 2 of P.L.2023, c.263 (C.52:14-41). Written consent shall include:
(1) the exact record or information to be shared;
(2) the purpose for sharing the record or information;
(3) a statement clarifying that consent is voluntary and declining to provide consent shall not result in discrimination or retaliation by the government entity;
(4) a statement clarifying that consent may be revoked, but that revocation does not impact a record or information already shared under prior written consent provided pursuant to this section; and
(5) the person or agency to receive the record or information.
d. Except where the provision of notice would compromise a criminal investigation, a government entity that is required, pursuant to a valid judicial order, judicial warrant, or as required by federal law, to disclose any record or information described in section 4 of P.L.2026, c.4 (C.52:4CC-4) or any automated license plate reader information shall provide notice of the disclosure to the person to whom the record or information pertains within 90 days of the disclosure. The notice shall set forth the:
(1) specific record or information subject to disclosure;
(2) party to which the record or information was disclosed; and
(3) basis for disclosing the information.
e. All government entities shall review any applicable confidentiality policies, guidelines, and regulations and identify those changes necessary to ensure compliance with the provisions of this section and section 4 of P.L.2026, c.4 (C.52:4CC-4) by any entity under its authority. Any necessary changes to those policies, guidelines, or regulations shall be made as expeditiously as possible, consistent with the entity’s procedures, but no later than one calendar year following the effective date of P.L.2026, c.4 (C.52:4CC-1 et al.), and shall be published prominently on the entity’s Internet website.
f. Nothing in this section shall be construed to prohibit or in any way restrict any action where the prohibition, restriction, or enforcement would be contrary to federal law, including 8 U.S.C. s.1373 and 8 U.S.C. s.1644, a judicial order, or a judicial warrant.
g. A government entity that knowingly obtains, discloses, or uses any information or record described in section 4 of P.L.2026, c.4 (C.52:4CC-4) or any automated license plate recognition information for a purpose not permitted pursuant to this section or section 4 of P.L.2026, c.4 (C.52:4CC-4) shall be subject to injunctive relief and civilly liable for damages to the person to whom the information pertains, or the person’s personal representative or guardian, who may bring an action in the Superior Court.
C.26:2H-5.37 Limit on health care facilities requesting, collecting information from a patient.
6. a. A health care facility shall not request or collect information relating to a patient’s immigration status, citizenship status, place of birth, social security number, or individual taxpayer identification number, except when this information is necessary to ensure the safe and appropriate delivery of health care services, including, but not limited to, the assessment, treatment, transfer, referral, billing, or discharge of the person, as required by applicable State or federal law, or to assess eligibility for, or to provide or administer, a public service, benefit, or program. Nothing in P.L.2026, c.4 (C.52:4CC-1 et al.) shall prohibit a health care facility from maintaining a patient’s complete medical record subject to the “Health Insurance Portability and Accountability Act of 1996,” Pub.L. 104-191.
b. Any record or information, whether written or oral, relating to a patient’s immigration status, citizenship status, place of birth, social security number, or individual taxpayer identification number that is solicited, made, or kept to assess eligibility for or to administer a health care service, benefit, or program that is requested, used, or delivered shall not be considered a governmental record pursuant to P.L.1963, c.73 (C.47:1A-1 et seq.), known commonly as the open public records act, and shall not be disclosed, except:
(1) as required pursuant to federal or State law to assess eligibility for, or to provide or administer, benefits, services, or programs;
(2) as required by valid judicial order, judicial warrant, or as required by federal law; or
(3) pursuant to the provisions of subsection c. of this section.
c. This section shall not prohibit the disclosure of any record or information described in subsection a. of this section when the patient to whom the record or information pertains has knowingly provided written consent for the disclosure. The Department of Health, in consultation with the Attorney General, shall develop and make publicly available a standardized written consent form that shall constitute a vital document pursuant to section 2 of P.L.2023, c.263 (C.52:14-41). Use of a standardized form developed pursuant to this subsection shall constitute compliance with the written consent requirements of this section. A health care facility that uses a standardized form or provides consent through an interpreter-assisted process consistent with applicable State and federal law shall be deemed in compliance with the consent requirements of this section. Written consent shall include:
(1) the exact record or information to be shared;
(2) the purpose for sharing the record or information;
(3) a statement clarifying that consent is voluntary and declining to consent shall not result in discrimination or retaliation by the health care facility;
(4) a statement clarifying that consent may be revoked, but that revocation does not impact a record or information already shared under prior written consent provided pursuant to this section; and
(5) the person or agency to receive the record or information.
d. The Commissioner of Health may adopt rules and regulations in accordance with the “Administrative Procedure Act,” P.L.1968, c.410 (C.52:14B-1 et seq.) as are necessary to effectuate the provisions of this section.
e. Nothing in this section shall be construed to prohibit or in any way restrict any action where the prohibition, restriction, or enforcement would be contrary to federal law, including 8 U.S.C. s.1373 and 8 U.S.C. s.1644, a judicial order, or a judicial warrant.
f. (1) A health care facility that knowingly obtains, discloses, or uses any record or information described in subsection a. of this section for a purpose not permitted under this section shall be subject to penalties and enforcement by the Department of Health consistent with the department’s authority pursuant to Title 26 of the Revised Statutes and as a condition of licensure. Any patient to whom the information pertains, or the patient’s personal representative or guardian, may file a complaint with the Department of Health in a form, manner, and medium prescribed thereby alleging such violation.
(2) The Department of Health may adopt any policies, guidelines, or, pursuant to the “Administrative Procedure Act,” P.L.1968, c.410 (C.52:14B-1 et seq.), rules and regulations necessary to effectuate or enforce the provisions of this subsection.
7. Section 2 of P.L.1997, c.188 (C.39:2-3.4) is amended to read as follows:
C.39:2-3.4 Disclosure of personal information connected with motor vehicle record.
2. a. Notwithstanding the provisions of P.L.1963, c.73 (C.47:1A-1 et seq.) or any other law to the contrary, except as provided in this act, the New Jersey Motor Vehicle Commission and any officer, employee, or contractor thereof shall not knowingly disclose or otherwise make available to any person personal information about any individual obtained by the commission in connection with a motor vehicle record.
b. A person requesting a motor vehicle record including personal information shall produce proper identification and shall complete and submit a written request form provided by the chief administrator for the commission's approval. The written request form shall bear notice that the making of false statements therein is punishable and shall include, but not be limited to, the requestor's name and address; the requestor's driver's license number or corporate identification number; the requestor's reason for requesting the record; the driver's license number or the name, address, and birth date of the person whose driver record is requested; the license plate number or VIN number of the vehicle for which a record is requested; any additional information determined by the chief administrator to be appropriate; and the requestor's certification as to the truth of the foregoing statements. Prior to the approval of the written request form, the commission may also require the requestor to submit documentary evidence supporting the reason for the request.
In lieu of completing a written request form for each record requested, the commission may permit a person to complete and submit for approval of the chief administrator or the chief administrator's designee, on a case by case basis, a written application form for participation in a public information program on an ongoing basis. The written application form shall bear notice that the making of false statements therein is punishable and shall include, but not be limited to, the applicant's name, address, and telephone number; the nature of the applicant's business activity; a description of each of the applicant's intended uses of the information contained in the motor vehicle records to be requested; the number of employees with access to the information; the name, title, and signature of the authorized company representative; and any additional information determined by the chief administrator to be appropriate. The chief administrator may also require the applicant to submit a copy of its business credentials, such as a license to do business or a certificate of incorporation. Prior to approval by the chief administrator or the chief administrator's designee, the applicant shall certify in writing as to the truth of all statements contained in the completed application form.
c. Personal information shall be disclosed for use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles and dealers by motor vehicle manufacturers; maintenance of voter registration information; and removal of non-owner records from the original owner records of motor vehicle manufacturers to carry out the purposes of the Automobile Information Disclosure Act, Pub.L.85-506, the Motor Vehicle Information and Cost Saving Act, Pub.L.92-513, the National Traffic and Motor Vehicle Safety Act of 1966, Pub.L.89-563, the Anti-Car Theft Act of 1992, Pub.L.102-519, and the Clean Air Act, Pub.L.88-206, and, except as otherwise provided by subsection g. of this section, may be disclosed only as follows:
(1) For use by any government agency, including any court or law enforcement agency in carrying out its functions, or any private person or entity acting on behalf of a federal, State, or local agency in carrying out its functions.
(2) For use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles, motor vehicle parts, and dealers; motor vehicle market research activities, including survey research; and the removal of non-owner records from the original owner records of motor vehicle manufacturers.
(3) For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only:
(a) to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and
(b) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against the individual.
(4) For use in connection with any civil, criminal, administrative, or arbitral proceeding in any federal, State, or local court or agency or before any self-regulatory body, including service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a federal, State, or local court.
(5) For use in educational initiatives, research activities, and for use in producing statistical reports, so long as the personal information is not published, redisclosed, or used to contact individuals and, in the case of educational initiatives, only to organ procurement organizations as aggregated, non-identifying information.
(6) For use by any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, rating, or underwriting.
(7) For use in providing notice to the owners of towed or impounded vehicles.
(8) For use by an employer or its agent or insurer to obtain or verify information relating to a holder of a commercial driver's license that is required under the "Commercial Motor Vehicle Safety Act," 49 U.S.C.App.s.2710 et seq.
(9) For use in connection with the operation of private toll transportation facilities.
(10) For use by any requestor if the requestor demonstrates it has obtained the notarized written consent of the individual to whom the information pertains.
(11) For product and service mail communications from automotive-related manufacturers, dealers, and businesses if the commission has implemented methods and procedures to ensure that:
(a) individuals are provided an opportunity, in a clear and conspicuous manner, to prohibit such uses; and
(b) product and service mail communications from automotive-related manufacturers, dealers, and businesses will not be directed at individuals who exercise their option under subparagraph (a) of this paragraph.
(12) For use by an organ procurement organization designated pursuant to 42 U.S.C. s.1320b-8 to serve in the State of New Jersey, or any donor registry established by any such organization, exclusively for the purposes of determining, verifying, and recording organ and tissue donor designation and identity. For these purposes, an organ procurement organization shall have electronic access at all times, without exception, to real-time organ donor designation and identification information. An organ procurement organization may also have information for research activities, pursuant to paragraph (5) of subsection c. of this section.
(13) As provided in section 2 of P.L.2021, c.139 (C.39:2-3.9).
(14) As provided in section 1 of P.L.2025, c.388 (C.18A:4-2.1).
d. As provided by the federal "Drivers' Privacy Protection Act of 1994," Pub.L.103-322, a person authorized to receive personal information under paragraphs (1) through (10) of subsection c. of this section may resell or redisclose the personal information only for a use permitted by paragraphs (1) through (10) of subsection c. of this section subject to regulation by the commission. A person authorized to receive personal information under paragraph (11) of subsection c. of this section may resell or redisclose the personal information pursuant to paragraph (11) of subsection c. of this section subject to regulation by the commission. An organization authorized to receive personal information under paragraph (12) of subsection c. of this section may redisclose the personal information only for the purposes set forth in that paragraph.
e. As provided by the federal "Drivers' Privacy Protection Act of 1994," Pub.L.103-322, a person authorized to receive personal information under this section who resells or rediscloses personal information covered by the provisions of P.L.1997, c.188 (C.39:2-3.3 et seq.) shall keep, for a period of five years, records identifying each person or entity that receives information and the permitted purpose for which the information will be used and shall make such records available to the commission upon request. Any person who receives, from any source, personal information from a motor vehicle record shall release or disclose that information only in accordance with P.L.1997, c.188 (C.39:2-3.3 et seq.).
f. The release of personal information under this section shall not include an individual's social security number, except in accordance with applicable State or federal law.
g. Notwithstanding any provision to the contrary, the commission, or any government entity as defined in section 3 of P.L.2026, c.4 (C.52:4CC-3), shall not use or disclose to any federal, State, or local law enforcement any motor vehicle record containing personal information, or any personal information, as this term is defined in section 1 of P.L.1997, c.188 (C.39:2-3.3), for any purposes related to Title 8 of the United States Code without the informed consent of the applicant, a judicial warrant, or valid judicial order, except that nothing in this section shall be construed to prohibit, or in any way restrict, any action where such prohibition or restriction would be contrary to federal law.
When responding to a judicial warrant or valid judicial order, the commission may disclose only those records or information specifically requested in the judicial warrant or valid judicial order.
C.52:4CC-6 Severability.
8. If any section or provision of P.L.2026, c.4 (C.52:4CC-1 et al.) shall be declared to be unconstitutional, invalid, or inoperative, in whole or in part, by a court of competent jurisdiction, the section or provision shall, to the extent that it is not unconstitutional, invalid, or inoperative, be enforced and effectuated, and no such determination shall be deemed to invalidate or make ineffectual the remaining sections or provisions.
9. This act shall take effect immediately, except that section 6 shall take effect on the first day of the 13th month next following enactment.
Approved March 25, 2026.