Personal Information and Privacy Protection Act - New Jersey State
On September 15, 2016, the New Jersey Senate unanimously approved a bill that restricts the collection and use of personal information by retailers for certain purposes. The bill is known as the “Personal Information and Privacy Protection Act.” [https://legiscan.com/NJ/text/S1913/id/1419389/New_Jersey-2016-S1913-Amended.html] The law provides that a retailer may only scan a person’s “identification card” (i.e., a driver’s license or similar identification) for the following purposes:
- To verify the authenticity of the identification or to verify the identity of the individual where payment is made by other than cash or a refund is sought;
- The verify the individual’s age in connection with the purchase of age-restricted goods (i.e., alcohol);
- To prevent fraud or criminal activity in connection with the return of goods and the business uses a fraud prevention service company or system;
- To establish or maintain a contractual relationship;
- To record, retain or transmit information required by law;
- To transmit information to a consumer reporting agency, financial institution or debt collector to be used as permitted by the federal Fair Credit Reporting Act, the Gramm-Leach-Bliley Act and the Fair Debt Collection Practices Act;
- To record, retain or transmit information by a covered entity governed by the medical privacy and security rules under HIPPA.
Where such collection is permitted, the retailer may only collect the person’s name, address, date of birth, the State issuing the identification card and the identification card number.
No retailer may retain information set forth in 1 and 2 above. Any information retained in 3-7 above shall be securely stored, and any breach promptly reported to the Division of State Police in the Department of Law and Public Safety and any affected person.
No such information may be provided to a third party for any purpose (including marketing, etc.) not expressly provided in the law.
Violation of the law subjects the retailer to criminal and civil liability.