New Jersey-2022-A1399-Introduced

An Act concerning Internet service providers and personally identifiable information and supplementing P.L.1960, c.39 (C.56:8-1 et seq.).

Be It Enacted by the Senate and General Assembly of the State of New Jersey:

1. As used in P.L. , c. (C. ) (pending before the Legislature as this bill):

"Internet service provider" means a person, business, or organization qualified to do business in this State that provides individuals, businesses, or other entities with the ability to connect by wireline or radio frequency to the Internet through equipment that is located in this State.

"Online service" means an information service provided over the Internet, including, but not limited to, offsite data storage services and computer application services.

"Personally identifiable information" means any information that personally identifies, describes, or is able to be associated with a subscriber or users of a subscriber's account, including, but not limited to:

name, address, precise geolocation, social security number, or telephone number;

requests for specific materials or services from an Internet service provider;

online service use history;

Internet websites visited during use of a subscriber's account; or

the contents of a subscriber's communications or data-storage devices.

"Ordinary course of business" means debt-collection activities, order fulfillment, request processing, or the transfer of ownership.

"Subscriber" means a residential or business subscriber located in this State that subscribes with an Internet service provider to receive access to the Internet on equipment located in the State.

2. a. An Internet service provider shall keep confidential a subscriber's personally identifiable information unless the subscriber, expressly and in writing, authorizes the Internet service provider to disclose this information.

b. An Internet service provider shall provide written notice of the requirements of this section to each subscriber.

c. An Internet service provider shall not refuse to provide Internet service to a subscriber for not authorizing the Internet service provider to disclose a subscriber's personally identifiable information.

d. The requirements of subsection a. of this section shall not apply to disclosures incidental to the ordinary course of business of
the Internet service provider or investigations undertaken pursuant to the "New Jersey Wiretapping and Electronic Surveillance Control Act," P.L.1968, c. 409 (C.2A:156A-1 et seq.).

3. A waiver of the requirements, or an agreement that does not comply with, the provisions of P.L. , c. (C. ) (pending before the Legislature as this bill) shall be void and unenforceable.

4. It shall be an unlawful practice and violation of P.L.1960, c.39 (C.56:8-1 et seq.) to violate section 2 of P.L. , c. (C. ) (pending before the Legislature as this bill).

5. The Director of the Division of Consumer Affairs in the Department of Law and Public Safety shall promulgate rules and regulations, pursuant to the "Administrative Procedure Act," P.L.1968, c.410 (C.52:14B-1 et seq.), necessary to effectuate the purposes of P.L. , c. (C. ) (pending before the Legislature as this bill).

6. This act shall take effect immediately.

STATEMENT

This bill requires an Internet service provider (ISP) to keep confidential a subscriber's personally identifiable information unless the subscriber, expressly and in writing, authorizes the ISP to disclose this information. An ISP is required to provide written notice of this bill's requirements to each subscriber. An ISP is not to refuse to provide Internet service to a subscriber for not authorizing the ISP to disclose the subscriber's personally identifiable information. The provisions of this bill do not apply to disclosures incidental to the ISP's ordinary course of business or to investigations undertaken pursuant to the "New Jersey Wiretapping and Electronic Surveillance Control Act."

This bill provides that a violation of this bill is to be an unlawful practice in accordance with the State's Consumer Fraud Act.

In this bill, "personally identifiable information" means any information that personally identifies, describes, or is able to be associated with a subscriber or users of a subscriber's account, including, but not limited to: name, address, precise geolocation, social security number, or telephone number; requests for specific materials or services from an Internet service provider; online service use history; Internet websites visited during use of a subscriber's account; or the contents of a subscriber's communications or data-storage devices.

This bill also provides that "subscriber" means a residential or
business subscriber located in this State that subscribes with an Internet service provider to receive access to the Internet on equipment located in the State.