New Jersey Governor Signs Data-Breach Notification Amendment


By Joseph J. Lazzarotti, Jason C. Gavejian and Maya Atrakchi © Jackson Lewis May 21, 2019

Gov. Phil Murphy recently signed into law P.L.2019, c.95. an amendment enhancing New Jersey's data breach notification law by expanding the definition of personal information and updating notification requirements. The amendment was unanimously approved by the New Jersey General Assembly and Senate in late February. 

New Jersey's data breach notification law requires businesses to notify consumers of a breach of their personal information. Previously the law defined personal information as an individual's first name or first initial and last name linked with any one or more of the following data elements:

  • Social Security number.
  • Driver's license number or state-identification card number.
  • Account number or credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual's financial account.

The new law adds to the above list of data elements a user name, email address or any other account holder identifying information, in combination with any password or security question and answer that would permit access to an online account.

Notification Requirements

In addition, notification requirements are different for these added data elements. Under the amendment, businesses or public entities experiencing a breach involving a user name or password, in combination with any password or security question and answer that would permit access to an online account, and no other personal information, may notify affected consumers via electronic or other form that directs the customer whose personal information has been breached to promptly change any password and security question or answer, as applicable, or to take other appropriate steps to protect the online account with the businesses or public entities and all other online accounts for which the customer uses the same user name.

Further, for breaches involving an email account, a business or public entity shall not provide notice of the breach via the compromised email account. Instead, notice shall be provided by one of the other methods described in the law or by clear and conspicuous notice delivered to the customer online when the customer is connected to the online account from an IP address or online location from which the business or public entity knows the customer customarily accesses the account.

New Jersey has now become at least the 10th state to update its data breach notification law to specifically address online breaches. The new law will take effect Sept. 1.

Joseph J. Lazzarotti and Jason C. Gavejian are attorneys with Jackson Lewis in Morristown, N.J. Maya Atrakchi is an attorney with Jackson Lewis in New York City. © 2019 Jackson Lewis. All rights reserved. Reposted with permission. 


Job Finder

Find an HR Job Near You
Search Jobs
Post a Job

Earn a SHRM Talent Acquisition Specialty Credential.

Do you have what it takes to win the war for talent? Find out.

Do you have what it takes to win the war for talent? Find out.