New Jersey § 56:8-166

subject to the privacy, security, and breach notification rules issued by the United

States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations , established pursuant to the “Health Insurance Portability and Accountability Act

of 1996,” Pub.L.104-191 , and the “Health Information Technology for Economic and Clinical Health Act,” 42 U.S.C. s.17921 et seq. ; b. a financial institution, data, or an affiliate of a financial institution that

is subject to Title V of the federal “Gramm-Leach-Bliley Act,” 15 U.S.C. s.6801 et seq., and the rules and implementing regulations promulgated thereunder; c. the secondary market institutions identified in 15 U.S.C.s.6809(3)(D) and 12 C.F.R. s.1016.3(l)(3)(iii) ; d. an insurance institution subject to P.L.1985, c. 179 ( C.17:23A-1 et seq. ); e. the sale of a consumer's personal data by the New Jersey Motor Vehicle Commission

that is permitted by the federal “Drivers' Privacy Protection Act of 1994,” 18 U.S.C. s.2721 et seq. ; f. personal data collected, processed, sold, or disclosed by a consumer reporting

agency, as defined in 15 U.S.C. s.1681a(f) , if the collection, processing, sale, or disclosure of the personal data is limited,

governed, and collected, maintained, disclosed, sold, communicated, or used only as

authorized by the federal “Fair Credit Reporting Act,” 15 U.S.C. s. 1681 et seq., and implementing regulations; g. any State agency as defined in section 2 of P.L.1971, c. 182 ( C.52:13D-13 ), any political subdivision, and any division, board, bureau, office, commission,

or other instrumentality created by a political subdivision; or h. personal data that is collected, processed, or disclosed, as part of research conducted

in accordance with the Federal Policy for the protection of human subjects pursuant

to 45 C.F.R. Part 46 or the protection of human subjects pursuant to 21 C.F.R. Parts 50 and 56 .