<Return to Articles
New Jersey Identity Theft Protection Act
The New Jersey Identity Theft Protection Act (the Act) took effect on January 1, 2006. The goal of the Act is to address a major law enforcement issue that has been created by the information age economy, namely personal identity theft. Several provisions of the Act create obligations upon all business in New Jersey to take steps to safeguard the personal financial information of individual customers and employees. The Act also contains a provision allowing individual consumers to request that credit reporting agencies place a security freeze on the individual's credit report so that the report can only be released with the prior written consent of the consumer.
The personal financial information that must be safeguarded refers to any electronic files or media containing the individuals name linked with any of the following:
- Social Security Number;
- Driver's license number or State Identification card number; or
- Account number or credit or debit card number in combination with any required security code, access code or password.
Once the business no longer needs the personal financial information, it must securely destroy the records by �shredding, erasing, or otherwise modifying the personal information . . . to make it unreadable, undecipherable or non-reconstructable through generally available means. The import of this requirement means that the business must do more than merely delete the information from its computer hard drive.
If a breach of security occurs and someone obtains unauthorized access to the data, the Act contains a disclosure requirement. The business must first report the breach of its security to the New Jersey State Police and then to the customer.
The Act contains provisions prohibiting the public display or other disclosure of an individual's personal information. The Act also contains certain prohibitions against mailing correspondence to an individual with that person's social security number unless the mailing is otherwise mandated by law.
Violation of the Act will subject the business to suit under the New Jersey Consumer Fraud Act. The New Jersey State Attorney General could bring suit directly under this Statute or an aggrieved person could bring a private cause of action. The Statute provides for recovery of both treble damages and recovery of attorney's fees by the aggrieved individual.
