NJ Privacy Bill Advances to Floor
New Jersey privacy legislation will go to the Assembly floor, despite opposition from tech and business groups, the chamber’s Judiciary Committee decided Monday. In a 4-0 vote, with one abstention, the panel advanced the proposal with amendments. One change increased the time businesses would have to cure violations to 18 months, from six in the original bill (A-1971/S-332). Industry groups especially objected to the bill's creation of a rulemaking process at the Department of Law and Public Safety’s Consumer Affairs Division.
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
"I'm sick of traveling to other jurisdictions or going to Europe and surfing to a webpage and being offered choices or control that my constituents and I don't have here in New Jersey,” said Judiciary Chair Raj Mukherji (D). If enacted, the “long overdue” law can be refined next session, he said. Assemblyman Robert Auth (R) abstained because he said remaining concerns should be addressed before the bill goes to the floor.
Mukherji amended the bill mid-hearing after Andrew Kingman, State Privacy and Security Coalition general counsel, raised concerns about the length of the proposed right to cure being less than other states that provide 18 months. The bill possibly won't be heard again in committee during the lame-duck session, the two months since the Nov. 7 election and the end of December. "I'm inclined to comport with the majority of other states and amend the cure period to 18 months,” said Mukherji: That will help small businesses that need more time.
“This bill is not yet ready for prime time,” argued Kingman, saying it is “very complex and operationally intensive.” In particular, the coalition worries about the bill including a rulemaking process because businesses want uniform rules across states, he said. "Regulations detract from this and also are ongoing, so businesses are never able to look at the law and understand entirely what it means." In California, one state with a law that required rulemaking, "the regulations exceed the length of the statute,” Kingman said. “It puts businesses in a very awkward position because they either have to delay putting in some of their operational requirements to see what the rules are going to be, or they have to spend a lot of resources and man hours trying to operationalize something that at a later date could be changed.”
The New Jersey Chamber of Commerce doesn’t trust the “regulatory arena,” said Michael Egenton, executive vice president-government relations. Bills can get "get taken out of context," forcing businesses to spend "countless hours, months and years in the regulatory agency to correct this."
Rulemaking may not go beyond what legislation requires, New Jersey Assistant Attorney General Stephanie Doherty responded later in the hearing. "State agencies can't ... go rogue,” The AG office supports the bill because it “provides protections to consumers that [are] greatly needed,” she said.
"Anything that makes us an outlier in how we treat data privacy" can hurt small and large businesses alike, said Christopher Emigholz, New Jersey Business and Industry Association chief government affairs office. Egenton urged the committee to press pause and take up the bill early next year instead. “We're almost there. I don't see a pressing need." South Jersey Chamber of Commerce Manager Government Relations Hilary Chebra also raised concerns the process is moving too fast. She and several other witnesses noted they received the latest amendments that morning.
New Jersey should wait until next year, NetChoice and TechNet witnesses agreed. "This bill should not be rushed through the remaining hours of a lame duck,” said Amy Bos, NetChoice director-state and federal affairs. Since there is no federal law, New Jersey should align with other states' privacy laws, she said.
New Jersey should set strong privacy rules, "regardless of whether a federal law is passed on the issue,” countered Dillon Reisman, American Civil Liberties Union-New Jersey staff attorney. Amendments seem to be moving the bill in the right direction, including by recognizing the need for individual data rights and by including data minimization requirements for businesses, he said. However, he said, more time could still help the bill.
Elsewhere in Trenton the same day, Gov. Phil Murphy (D) announced plans to build an AI hub at Princeton University. The hub will convene AI researchers, industry officials, startups and others to research and advance ethical AI, the governor’s office said.