New Jersey and New Hampshire are the first states out of the gate in what promises to be another busy year in state privacy legislation.
On January 16, New Jersey Governor Phil Murphy signed the New Jersey Data Privacy Act (NJDPA), making the Garden State the first to enact a comprehensive privacy law in 2024. New Hampshire is set to follow after Senate Bill 255 (SB255) passed the legislature on January 18 and is awaiting the governor's signature. Both pieces of legislation closely resemble frameworks established by other U.S. states, such as Colorado.
What is Notable about NJDPA and SB255?
The NJDPA and SB255 are largely consistent with other key state comprehensive privacy laws. However, there are some noteworthy differences in the two laws:
New Jersey
NJDPA does not exempt nonprofit organizations and lacks specific revenue thresholds seen in most other comprehensive privacy laws (the main exception is Colorado). New Jersey is also the first state to require consumer consent before processing financial information. Financial information is defined to include "a consumer's account number, account log-in, financial account or credit or debit card number, in combination with any required security code, access code or password that would permit access to a consumer's financial account."
Further, New Jersey joins only two other states (California and Colorado) in authorizing rulemaking to implement its privacy law, including regulations about opt-out signals. The law does not set a deadline to adopt regulations, but the degree of harmonization with other state regulations will bear close watching.
New Hampshire
New Hampshire's pending bill contains a low applicability threshold. As demonstrated in the below table, SB255 will apply to entities that control or process the personal data of only 35,000 New Hampshire residents, or 10,000 New Hampshire residents if the entity derives more than 25% of its gross revenue from the sale of personal data. Thus, New Hampshire's pending privacy bill is significant for its potential reach on businesses that may process such a relatively minimal amount of state resident personal data.
Click here to see how NJDPA and SB255 stacks up to other key state comprehensive privacy laws.
Looking Ahead
Although New Jersey and New Hampshire have many similarities to other comprehensive privacy laws, both laws add a layer of complexity to the greater state privacy landscape. As state privacy laws proliferate, keeping an eye on differences among them will be helpful in keeping privacy compliance programs up to date.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.