New Jersey Gov. Phil Murphy (D) signed bills this week on consumer data privacy protections (S-332) and telephone line abandonment rules (A-1100). The legislature passed the bills earlier this month (see 2401080073). “I am heartened that consumers will now be given a say in the distribution of their personal information,” Murphy wrote in a signing statement. New Jersey is the 14th state with a comprehensive privacy law.
New Jersey legislators passed a comprehensive data privacy bill and proposed telephone line abandonment rules during floor sessions Monday. The Assembly voted 47-27 to pass S-332 after substituting into the bill language from A-1971. The Senate voted 34-1 for A-1100, which would require removing phone and cable lines that don’t terminate at both ends to equipment or to a customer premise, aren't in a safe condition or haven’t been operated for at least 24 consecutive months. The state privacy bill will “protect for the first time in New Jersey history our citizens’ and our children’s data, including personally identifiable information and sensitive data, and join the dozen-plus states that have beaten us to it,” said Assembly Judiciary Committee Chairman Raj Mukherji (D), who sponsored A-1971. “With no comprehensive federal framework to address this, unlike in Europe, it’s fallen to the states to fill the gaps and protect our citizens’ data.” Mukherji highlighted the bill’s inclusion of a universal opt-out mechanism, which would support using a browser plugin or setting to opt out of many sites. The Assembly adopted amendments to the privacy bill at a Dec. 21 floor session. Changes include clarifying that a controller isn’t required to authenticate opt-out requests and that the consumer’s option to opt out applies to data selling or targeted ads, according to a floor statement. Also, the amended bill extended the deadline for controllers to comply to six months from four. In addition, lawmakers added an exemption for data subject to the Gramm-Leach-Bliley Act. The Assembly Judiciary Committee passed A-1971 in December (see 2312180067), many months after the Senate approved S-332 last February (see 2302030065). Consumer Reports believes "the bill improved substantially as it has moved through the legislative process," said CR Policy Analyst Matt Schwartz. "The bill now includes baseline consumer privacy protections" and a universal opt-out mechanism that will make it "far more usable for consumers than what was previously being considered," he said. However, "we see room for improvement, particularly relating to the bill's data minimization and enforcement provisions." The Assembly passed the line abandonment bill last March (see 2303010017). The New Hampshire House last week completed a comprehensive privacy bill (SB-255). It passed the state's Senate last March (see 2303170035). The House Judiciary Committee amended and advanced the bill in November (see 2311080062).
Kentucky state representatives and senators will consider different comprehensive data privacy bills during the 2024 legislative session, which opened Tuesday. On day one Rep. Phillip Pratt (R) introduced the 22-page HB-24, while Sen. Whitney Westerfield (R) floated SB-15, a 31-page piece of legislation. The House bill would apply to businesses that process personal data of at least 100,000 consumers annually, while the number in the Senate version is 50,000. Both bills would also apply to companies that process data of at least 25,000 consumers while deriving more than 50% of gross revenue from selling personal data. Among the differences, SB-15 would allow consumers to use global privacy controls to opt out, such as through a browser plugin or setting. Both bills allow enforcement solely by the state attorney general, with a 30-day right to cure and no private right of action. In addition, both would take effect Jan. 1, 2026. Going into 2024, 13 states had comprehensive privacy laws.