Page 305 - GDPR and US States General Privacy Laws Deskbook

305 | New Jersey Privacy Act
“Designated request address” means an electronic mail address, Internet website, or toll-free telephone number that a
consumer may use to request the information required to be provided pursuant to section 3 of P.L., c. (C.) (pending before
the Legislature as this bill).
“Personal data” means any information that is linked or reasonably linkable to an identified or identifiable person. “Personal
data” shall not include de-identified data or publicly available information.
“Precise geolocation data” means information derived from technology, including, but not limited to, global positioning
system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of an
individual with precision and accuracy within a radius of 1,750 feet. “Precise geolocation data” does not include the content
of communications, or any data generated by or connected to advanced utility metering infrastructure systems or equipment
for use by a utility.
“Process” or “processing” means an operation or set of operations performed, whether by manual or automated means, on
personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification
of personal data, and also includes the actions of a controller directing a processor to process personal data.
“Processor” means a person, private entity, public entity, agency, or other entity that processes personal data on behalf of
the controller.
“Profiling” means any form of automated processing performed on personal data to evaluate, analyze or predict personal
aspects related to an identified or identifiable individual’s economic situation, health, personal preferences, interests,
reliability, behavior, location or movements.
“Publicly available information” means information that is lawfully made available from federal, State, or local government
records, or widely-distributed media or information that a controller has a reasonable basis to believe a consumer has
lawfully made available to the general public and has not restricted to a specific audience.
“Sale” means the sharing, disclosing, or transferring of personal data for monetary or other valuable consideration by the
controller to a third party. “Sale” shall not include:
The disclosure of personal data to a processor that 6[only]6 processes the personal data on the controller’s behalf;
The disclosure of personal data to a third party for the purposes of providing a product or service requested by the
consumer;
The disclosure or transfer of personal data to an affiliate of the controller;
The disclosure of personal data that the consumer intentionally made available to the general public through a mass
media channel and did not restrict to a specific audience; or
The disclosure or transfer of personal data to a third party as an asset that is part of a proposed or actual merger, acquisition,
bankruptcy, or other transaction in which the third party assumes control of all or part of the controller’s assets.
“Sensitive data” means personal data revealing racial or ethnic origin; religious beliefs; mental or physical health condition,
treatment, or diagnosis; financial information 6, which shall include a consumer’s account number, account log-in, financial
account, or credit or debit card number, in combination with any required security code, access code, or password that would
permit access to a consumer’s financial account6; sex life or sexual orientation; citizenship or immigration status; status
as transgender or non-binary; genetic or biometric data that may be processed for the purpose of uniquely identifying an
individual; personal data collected from a known child; or precise geolocation data.
“Targeted advertising” means displaying 6[an]6 advertisements to a consumer where the advertisement is selected based
on personal data obtained or inferred from that consumer’s activities over time and across nonaffiliated Internet web
sites or online applications to predict such consumer’s preferences or interests. “Targeted advertising” shall not include:
advertisements based on activities within a controller’s own internet websites or online applications; advertisements based
on the context of a consumer’s current search query, visit to an internet website or online application; advertisements
directed to a consumer in response to the consumer’s request for information or feedback; or processing personal data
solely to measure or report advertising frequency, performance, or reach.