NJBIA and a host of business groups opposed on Monday a complex bill that requires online services to notify consumers of collection of personally identifiable information.
Bill A-1971 was voted on and advanced by the Assembly Judiciary Committee, even though stakeholders were only able to see the amendments of the 20-page bill minutes before the start of the committee meeting.
While appreciative of the work that the sponsor Assemblyman Raj Mukerji (D-33) has put in addressing concerns in the bill over the past six years, those opposing the legislation said it should not be rushed through the current legislative lame duck session.
“Anything that makes us an outlier in how we treat data privacy, IT, and innovation is something that hurts large business, and also the little guys,” NJBIA Chief of Government Affairs Christopher Emigholz said.
“For businesses that use lists, businesses that are marketing, tourism businesses, there’s a lot to be worried about with this bill. And we want to make sure we get it right.”
Andrew Kingman, representing State Privacy and Security Coalition, a multi-sector group that includes 33 companies and six trade associations, testified that there were two major issues upon a first glance of the amended bill.
The first was a shortened right-to-cure period, which allows parties a specified period to fix alleged violations before facing enforcement and penalties.
Kingman pointed out that New Jersey would be an outlier among the 12 states that have passed comprehensive data privacy laws for that limited period.
“This right to cure is good for consumers, because it allows them a way to receive individual redress within a defined period of time,” Kingman said. “It’s good for the Attorney General’s office, who will be charged with enforcing this act, because it helps them efficiently send out letters and enforce without full investigations.
“And it’s good for businesses who are good-faith actors because it gives them an opportunity to cure a violation in this very complex and operationally intensive law.”
Mukerji, however, said the bill was amended to have the right-to-cure period extended to 12 months, and that because the bill will likely not be heard again in a committee that he is “inclined to comport with majority of other states and amend the cure period to 18 months.”
Another major concern for the business opposition is the inclusion of a “rule making process” where the state Attorney General could create rules around the legislation.
“Our concerns about including rule making are not hypothetical,” Kingman said. “I’ve brought in rule making existing and proposed from California, which is one of only two states that have rule making.”
Being one of three states that have complementing rule making would work against interoperability between states – in lieu of the lack of a federal privacy act.
“Our concerns are that one of the significant benefits of this framework is we’re encouraging New Jersey to move toward interoperability, making sure that business is able to apply the same rules across states and the consumers have the same expectations for their privacy across states,” Kingman said.
“Our concerns are these regulations detract from this and they are ongoing – so businesses are never able to look at the law and understand what it means.”
Emigholz also called the timing of Monday’s hearing “interesting,” being that Gov. Phil Murphy was holding a press conference in nearby Princeton to announce plans to establish an Artificial Intelligence hub.
“The governor is making an innovation announcement this morning about AI,” Emigholz said. “We want to support innovation. Innovation is NJBIA’s mission statement. Innovation is an important multiplier in the economy and a lot of the companies, big and small startups, may be using these lists and need this data. We worry there’s a lot of things in this bill that stifle innovation.”
