New Jersey § 56:8-166

necessary in relation to the purposes for which such data is processed, as disclosed

to the consumer; (2) except as otherwise provided in P.L.2023, c. 266 ( C.56:8-166.4 et seq. ), not process personal data for purposes that are neither reasonably necessary to,

nor compatible with, the purposes for which such personal data is processed, as disclosed

to the consumer, unless the controller obtains the consumer's consent; (3) take reasonable measures to establish, implement, and maintain administrative,

technical, and physical data security practices to protect the confidentiality, integrity,

and accessibility of personal data and to secure personal data during both storage

and use from unauthorized acquisition. The data security practices shall be appropriate to the volume and nature of the personal

data at issue; (4) not process sensitive data concerning a consumer without first obtaining the consumer's

consent, or, in the case of the processing of personal data concerning a known child,

without processing such data in accordance with COPPA; (5) not process personal data in violation of the laws of this State and federal laws

that prohibit unlawful discrimination against consumers; (6) provide an effective mechanism for a consumer to revoke the consumer's consent

under this section that is at least as easy as the mechanism by which the consumer

provided the consumer's consent and, upon revocation of such consent, cease to process

the data as soon as practicable, but not later than 15 days after the receipt of such

request; (7) not process the personal data of a consumer for purposes of targeted advertising,

the sale of the consumer's personal data, or profiling in furtherance of decisions

that produce legal or similarly significant effects concerning a consumer without

the consumer's consent, under circumstances where a controller has actual knowledge,

or willfully disregards, that the consumer is at least 13 years of age but younger

than 17 years of age; (8) specify the express purposes for which personal data are processed; and (9) not conduct processing that presents a heightened risk of harm to a consumer without

conducting and documenting a data protection assessment of each of its processing

activities that involve personal data acquired on or after the effective date of P.L.2023, c. 266 ( C.56:8-166.4 et seq. ) that present a heightened risk of harm to a consumer. b. Data protection assessments shall identify and weigh the benefits that may flow,

directly and indirectly, from the processing to the controller, the consumer, other

stakeholders, and the public against the potential risks to the rights of the consumer

associated with the processing, as mitigated by safeguards that the controller can

employ to reduce the risks. The controller shall factor into this assessment the use of de-identified data and

the reasonable expectations of consumers, as well as the context of the processing

and the relationship between the controller and the consumer whose personal data will

be processed. A controller shall make the data protection assessment available to the Division of

Consumer Affairs in the Department of Law and Public Safety upon request. The division may evaluate the data protection assessment for compliance with the duties

contained in this section and with other laws. Data protection assessments shall be confidential and exempt from public inspection

under P.L.1963 c.3 ( C.47:1A-1 et al.). The disclosure of a data protection assessment pursuant to a request from the division

under this section shall not constitute a waiver of any attorney-client privilege

or work-product protection that might otherwise exist with respect to the assessment

and any information contained in the assessment. c. For the purposes of this section, “ heightened risk ” includes: (1) processing personal data for purposes of targeted advertising or for profiling

if the profiling presents a reasonably foreseeable risk of: unfair or deceptive treatment

of, or unlawful disparate impact on, consumers; financial or physical injury to consumers;

a physical or other intrusion upon the solitude or seclusion, or the private affairs

or concerns, of consumers if the intrusion would be offensive to a reasonable person;

or other substantial injury to consumers; (2) selling personal data; and (3) processing sensitive data. d. A single data protection assessment may address a comparable set of processing

operations that include similar activities.