State laws governing the collection and use of personal
information continue to proliferate. The latest comes from New
Jersey, which on July 21, 2017, signed into law legislation that
restricts a merchant's ability to collect personal data of
shoppers and share such data with third parties. New
Jersey's Personal Information Privacy and
Protection Act permits retailers to scan an identification card
only for certain purposes—such as verifying the
consumer's identity—and requires retailers to store such
data securely. Further, a retailer may not share the data
with a third party unless the retailer discloses its data-sharing
practices to the consumer.
The law is particularly notable because it creates a private
cause of action for any person aggrieved by a violation. Merchants
are subject to civil penalties of $2,500 for the first offense and
$5,000 for subsequent offenses.
