NJ S4315

Requires data controllers or processors to de-identify personal data before selling it, removing information that could identify a specific individual

Prohibits controllers or processors from re-identifying previously de-identified data, providing third parties with means to re-identify data, or hiring third parties to re-identify data

Defines "re-identify" as linking de-identified data back to an identified or identifiable individual, or to a device linked to such an individual

Directs the Director of the Division of Consumer Affairs to establish standards for de-identification and allows limited exceptions only for medical studies or preventing/alleviating environmental hazards that benefit the public

Takes effect 365 days after enactment and amends New Jersey's existing data privacy law (P.L.2023, c.266) governing data brokers and personal data regulation