Overview
This legislation establishes a comprehensive framework requiring data brokers to delete consumers' personal data upon request, creating a centralized, state-administered deletion mechanism to facilitate that process. The bill addresses the growing concern over the unchecked collection and sale of personal data by entities that have no direct relationship with the consumers whose data they traffic. By empowering consumers with an affirmative right to demand deletion of their personal information and imposing ongoing obligations on data brokers to honor those requests, the bill represents a significant expansion of consumer data privacy protections in New Jersey. The legislation also creates a dedicated 'Data Broker Fund' to sustain the infrastructure necessary to operate the deletion mechanism, ensuring the program is self-funding through fees assessed on data brokers. The bill builds upon existing New Jersey data privacy law and complements federal statutory frameworks governing data privacy, credit reporting, and motor vehicle records.
Key Points
- Grants consumers the right to request deletion of their personal data held by data brokers
- Establishes a state-administered, centralized deletion mechanism accessible via the Division of Consumer Affairs website
- Imposes a 45-day cycle for data brokers to check for and process deletion requests
- Creates mandatory third-party audits of data broker compliance every three years
- Establishes the 'Data Broker Fund' to finance the deletion mechanism through data broker fees
Core Provisions
The bill's central obligation, set forth in §c, requires data brokers to delete a consumer's personal data upon receipt of a valid deletion request submitted through the state-administered deletion mechanism. Critically, this obligation is not a one-time event: under §c.(1), once a consumer has submitted a deletion request, the data broker must delete any personal data pertaining to that consumer that it subsequently acquires, on a rolling basis at least once every 45 days, unless the consumer affirmatively requests otherwise or an exemption under subsection d. applies. This prospective deletion requirement closes a significant loophole that would otherwise allow data brokers to simply re-acquire and re-sell data after an initial deletion. Section 2 directs the Division of Consumer Affairs to establish and maintain the deletion mechanism on its website, with the mechanism required to be accessible in any language spoken by consumers whose data has been collected and fully usable by consumers with disabilities [§2.a.(7), §2.a.(8)]. Section 3 mandates that data brokers access the deletion mechanism at least once every 45 days and process all pending deletion requests within that same 45-day window [§3.a]. Section 4 establishes a triennial independent third-party audit requirement, with data brokers obligated to submit audit reports and related materials to the Division within five business days of a written request [§4.a, §4.b.(1)]. Section 5 authorizes the Division to charge data brokers a fee to access the deletion mechanism, capped at the reasonable costs of establishing, maintaining, and providing access to the system. Section 6 creates the 'Data Broker Fund,' restricting its use solely to maintaining and updating the deletion mechanism [§6.b]. Implementation is set to begin on the first day of the thirteenth month following enactment, providing approximately one year for the Division and data brokers to prepare for compliance.
Legal References
- P.L.2023, c.266 (C.56:8-166.4)
- N.J. Senate Bill No. 4806, §§2-6
Implementation
The Division of Consumer Affairs within the Department of Law and Public Safety bears primary responsibility for implementing and administering the bill. The Division must build, launch, and maintain the centralized deletion mechanism on its website, ensuring it meets the multilingual and disability-accessibility requirements mandated by §2.a.(7) and §2.a.(8). The Division is authorized to collect fees from data brokers for access to the mechanism, with all collected fees deposited into the dedicated Data Broker Fund and restricted to costs associated with the mechanism itself. On the data broker side, compliance requires establishing internal processes to access the deletion mechanism on a minimum 45-day cycle, process all queued deletion requests within that period, and implement reasonable security procedures and practices to protect personal data throughout the deletion process. The triennial independent audit requirement under §4 creates an ongoing compliance verification structure, with the Division retaining authority to demand audit reports and supporting materials within five business days of a written request, providing a meaningful enforcement tool. The Attorney General holds overarching enforcement authority, consistent with the Division's role under existing New Jersey consumer protection law.
Key Points
- Division of Consumer Affairs administers and maintains the deletion mechanism
- Data brokers must access the mechanism and process requests on a 45-day cycle
- Independent third-party audits required every three years, with reports available to the Division on demand
- Data Broker Fund receives fee revenue and is restricted to mechanism maintenance costs
- Reasonable security procedures required of data brokers throughout the deletion process
Legal References
- P.L.2023, c.266 (C.56:8-166.4 et seq.)
- N.J. Senate Bill No. 4806, §§2-6
Impact
New Jersey consumers whose personal data has been collected and sold by data brokers without their direct consent are the primary beneficiaries of this legislation. The bill provides a single, accessible point of contact for consumers to exercise deletion rights across all registered data brokers, eliminating the burden of submitting individual requests to each broker separately. The multilingual and accessibility requirements ensure that the protections extend to non-English-speaking consumers and those with disabilities, broadening the practical reach of the law. For data brokers, the bill imposes significant administrative and operational burdens, including the cost of building systems to interface with the state deletion mechanism on a 45-day cycle, funding independent audits every three years, and paying access fees to the Division. These costs will fall disproportionately on smaller data brokers with fewer resources to absorb compliance overhead. The expected outcome is a measurable reduction in the unauthorized circulation of New Jersey consumers' personal data in secondary data markets, with the rolling 45-day re-deletion requirement being particularly impactful in preventing data brokers from circumventing one-time deletion requests through re-acquisition. No sunset provision is included, making these obligations permanent upon enactment.
Legal References
- P.L.2023, c.266 (C.56:8-166.4)
Legal Framework
The bill operates within New Jersey's existing consumer protection statutory framework, building directly on P.L.2023, c.266 (C.56:8-166.4), which established foundational definitions for 'consumer' and 'personal data' that this legislation incorporates by reference. The bill explicitly acknowledges the primacy of several federal statutory regimes and carves out exemptions for data governed by those laws. Data subject to the federal Fair Credit Reporting Act (15 U.S.C. §1681 et seq.) is excluded from the deletion obligation, as is data regulated under the Gramm-Leach-Bliley Act (15 U.S.C. §6801 et seq.), the Drivers' Privacy Protection Act of 1994 (18 U.S.C. §2721 et seq.), and data subject to the Federal Policy for the Protection of Human Subjects (45 C.F.R. Part 46). These carve-outs reflect a deliberate effort to avoid conflict with federal preemption doctrines and to prevent the bill from disrupting federally regulated industries such as financial services, credit reporting, and motor vehicle records. The bill also cross-references the opt-out of sale or sharing provisions in §7 of P.L.2023, c.266 (C.56:8-166.10), situating the deletion right within a broader suite of consumer data rights under New Jersey law. The definition of 'data broker' as an entity that collects or purchases personal data without a direct consumer relationship and sells or licenses it to third parties is the operative jurisdictional boundary, distinguishing regulated entities from businesses that collect data directly from their own customers.
Legal References
- P.L.2023, c.266 (C.56:8-166.4)
- P.L.2023, c.266 (C.56:8-166.10)
- Fair Credit Reporting Act, 15 U.S.C. §1681 et seq.
- Gramm-Leach-Bliley Act, 15 U.S.C. §6801 et seq.
- Drivers' Privacy Protection Act of 1994, 18 U.S.C. §2721 et seq.
- Health Information Technology for Economic and Clinical Health Act, 42 U.S.C. §17921 et seq.
- Federal Policy for the Protection of Human Subjects, 45 C.F.R. Part 46
Critical Issues
The most significant implementation challenge is the technical and operational complexity of building a centralized deletion mechanism that is multilingual, fully accessible to consumers with disabilities, and capable of processing requests from potentially millions of consumers across hundreds of registered data brokers. The Division of Consumer Affairs has not historically administered infrastructure of this scale, and the adequacy of the Data Broker Fund's fee-based financing model to cover actual development and maintenance costs is uncertain. If fees are set too low, the mechanism may be underfunded; if set too high, they may face legal challenge as exceeding the statutory cap of 'reasonable costs.' The 45-day rolling re-deletion requirement, while closing an important loophole, creates a continuous operational burden on data brokers that may be technically difficult to implement, particularly for brokers that aggregate data from numerous upstream sources and cannot easily track whether re-acquired data pertains to a consumer who has previously submitted a deletion request. The triennial audit requirement raises questions about auditor qualification standards, audit scope, and the enforceability of audit findings, none of which are fully specified in the bill. Opposition from the data broker industry is likely to focus on the compliance costs, the breadth of the re-deletion obligation, and the potential for the fee structure to function as a barrier to market entry. There is also a risk that the federal exemptions, while legally necessary, create confusion among consumers who may not understand why certain categories of their data are not subject to deletion, potentially undermining confidence in the program. Finally, the bill's interaction with the New Jersey Motor Vehicle Commission and federal motor vehicle records law under the Drivers' Privacy Protection Act warrants careful regulatory guidance to avoid inadvertent conflicts.
Legal References
- Drivers' Privacy Protection Act of 1994, 18 U.S.C. §2721 et seq.
- Fair Credit Reporting Act, 15 U.S.C. §1681 et seq.
- Gramm-Leach-Bliley Act, 15 U.S.C. §6801 et seq.
- P.L.2023, c.266 (C.56:8-166.4)