On May 10, 2019, Governor Phil Murphy signed into law a bill
that expands businesses' notification requirements in the wake
of the growing incidence of cybersecurity breaches. This law, which
passed unanimously in both the Senate and the Assembly, broadens
the types of information whose theft triggers the requirements that
notices of data breaches be given, and makes special provision for
how that notice can be given.
New Jersey requires that "businesses" notify their
"customers" of a breach of security of computerized
records that include the customers' "personal
information." Before passage of the new law, New Jersey
defined "personal information" as an individual's
social security and driver's license numbers, as well as credit
card numbers and their associated security or access codes. Under
the new law, "personal information" now also includes the
individual's user name, email address, or any other identifying
information, such as a password or security question
