This bill repeals the Privacy Protection Act, which currently restricts New Jersey government agencies and healthcare facilities from collecting specific personal data such as immigration status, citizenship, and Social Security numbers. By removing these restrictions, the legislation allows these entities to gather and share such information more freely, particularly when it may assist law enforcement or administrative processes. The act also eliminates the prohibition on selling or sharing automated license plate recognition data, while simultaneously removing the requirement for agencies to develop compliance policies and the legal ability for private citizens to sue for violations. Ultimately, the bill shifts the legal framework to permit broader data collection without the previous privacy constraints.
This bill repeals the Privacy Protection Act, which currently restricts state and local government agencies and health care facilities from collecting specific personal data. The law being removed prohibits these entities from asking for information such as immigration status, citizenship, place of birth, Social Security numbers, or taxpayer IDs unless it is strictly necessary for administering public services or benefits. Additionally, the repealed statute banned the sale or sharing of automated license plate recognition data and required organizations to create compliance policies while allowing private lawsuits against violators. By eliminating these restrictions, the bill allows government entities and health care facilities to collect and share the specified personal information without the previous legal barriers.
This bill establishes rules for how employers and public service providers in New Jersey can use artificial intelligence and electronic monitoring tools to make decisions about hiring, firing, and providing services. It specifically defines these technologies, such as systems that analyze data to predict job performance or determine eligibility for public benefits, and sets requirements for their use. The legislation mandates that these systems must be regularly audited by independent experts to ensure they do not discriminate and that workers have access to information about how these tools affect their employment or services. Additionally, the bill clarifies what constitutes biometric data and outlines protections for employees regarding surveillance and data collection practices.
This bill exempts specific entities and data types from New Jersey's personal data notification and disclosure requirements under P.L.2023, c.266. It applies to healthcare providers (covered by HIPAA), financial institutions (under Gramm-Leach-Bliley), insurance entities, state agencies, consumer reporting agencies (under FCRA), research organizations (using federal human subjects protections), and other federally regulated entities. The key mechanism removes the need for these entities to comply with NJ's data disclosure rules when handling information already governed by federal laws. The bill was withdrawn in 2026 after becoming redundant due to another enacted law (P.L.2025, c.367).
This bill (S 2956) exempts specific entities and types of personal data from New Jersey's privacy law requirements regarding notification and disclosure of personal data. It directly affects covered entities like healthcare providers under HIPAA, financial institutions under the Gramm-Leach-Bliley Act, insurance companies, state agencies, consumer reporting agencies, and research organizations conducting federally compliant studies. Key provisions remove obligations for these entities to notify consumers or disclose data when handling information already regulated by federal law (e.g., health data under HIPAA, financial data under Gramm-Leach-Bliley, or credit data under FCRA). The bill was withdrawn on January 13, 2026, as it was already enacted as P.L.2025, c.367.
