Requires controller or processor to de-identify personal data and prohibits re-identification of de-identified data.

This bill (S 4315) requires businesses that collect personal data (called "controllers" or "processors" under the law) to de-identify personal data before selling it. It prohibits these businesses from re-identifying de-identified data themselves or providing third parties with means to re-identify such data. The bill mandates the New Jersey Division of Consumer Affairs to establish standards for de-identification, with limited exceptions allowed only for medical research or environmental protection purposes. These requirements apply to most businesses handling personal data in New Jersey, with specific exemptions for healthcare, financial services, and government entities.