Law note · New Jersey
New Jersey Data Privacy Act (NJDPA), publicly available information exemption and biometric definition
What it asks of an app
- Personal data that is lawfully made available through a government record or widely distributed media, or that a consumer has not restricted to a specific audience, falls outside the NJDPA's definition of personal data.
- The NJDPA's 25,000-consumer data-sale threshold has no percentage floor on how much of your revenue comes from selling personal data, unlike several peer states, so any revenue or in-kind discount from data sales can trigger it.
- Treat scraped facial images processed into facial mapping, facial geometry, or a facial template as biometric data under this Act's own explicit definition, not merely as a photograph.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics
What we found
Personal data excludes de-identified data and publicly available information, defined as information lawfully made available from government records or widely distributed media, or that a controller reasonably believes a consumer lawfully made available to the public and did not restrict to a specific audience, the ordinary exemption with no biometric carve-back.
The Act applies to a controller conducting business in New Jersey or targeting New Jersey residents that controls or processes personal data of at least 100,000 consumers, or of at least 25,000 consumers where the controller derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data; notably, unlike several peer states, this second limb carries no percentage threshold on how much revenue must come from data sales, a lower bar than most comparable state acts.
Biometric data is defined unusually explicitly to include, but not be limited to, fingerprint, voiceprint, eye retinas, irises, facial mapping, facial geometry, facial templates, or other unique biological, physical, or behavioral patterns or characteristics used to identify a specific individual, naming facial mapping, geometry, and templates outright where several peer states' definitions stop at fingerprint and voiceprint, directly relevant to a scraper harvesting faces from public photos for facial-recognition purposes.
Approved January 16, 2024, effective on the 365th day following enactment, January 15, 2025, per the Act's own enactment clause. Enforcement is by the Division of Consumer Affairs in the Office of the Attorney General with sole and exclusive authority; the statute expressly creates no private right of action.