Judiciary Committee hears testimony on bill letting judges, prosecutors and others force data brokers to stop disclosing home contact details

The Judiciary Committee on March 11 heard extended testimony on a bill (H.342) that would let a list of "covered persons" and their authorized agents notify data brokers to cease disclosing specified personal information.

The committee chair opened the hearing by explaining the committee's role: because some sections of the bill touch on damages, punitive awards and negligence standards, Judiciary would review those parts before sending the bill to the Commerce Committee for the technical privacy elements.

The bill defines covered persons to include active and former judges, law enforcement officers, prosecutors, public defenders, parole and probation officers, municipal employees and employees of the state Family Services Division, plus immediate family members. It identifies "protected information" as a home address, home telephone number (including personal cell phones used for personal communication), personal email address, Social Security or driver's license numbers, and a vehicle license plate or other unique vehicle identifiers. The bill would apply to entities defined in state law as data brokers: businesses that knowingly collect and sell or license brokered personal information about a consumer when the business does not have a direct relationship with that consumer.

Rick Segal, who said his portfolio is mostly Commerce Committee work, walked the committee through draft language and highlighted several points that drew committee questions: that a covered person or an authorized agent may send a written notice to a data broker requesting nondisclosure; that data brokers must "cease disclosing" the protected information no later than 10 days after receipt of notice; and that the secretary of state must publish a standard notice form within 90 days after July 1, 2025, though covered persons may use their own form until the secretary posts it.

A discrepancy in the draft drew repeated concern: one section sets a 10-day deadline, while another refers to 10 business days. Segal and committee members discussed whether the statute should use the same time frame in both places or instead tie compliance to a reasonableness/negligence standard. "I don't know where that was inspired from," Segal said of the 10-day timetable, and members suggested flagging the inconsistency for the Commerce Committee.

Matt Valerio, the defender general, told the committee that after surveying public defenders he consulted, those defenders were largely ambivalent and did not report widespread incidents prompting extra protections. "Nobody had any idea what this was about," Valerio said, summarizing the public defender community's response; he said public defenders he polled did not feel the bill was addressing a problem they had experienced.

By contrast, Matt Adkisson, chief executive officer of Atlas Data Privacy Organization, described the bill's national context and enforcement experience in New Jersey, where a statute called "Daniel's Law" was enacted after a violent incident involving a judge's family. Adkisson said his group helped implement that law and signed up roughly 20,000 covered persons to send nondisclosure requests; he said many data brokers complied within the 10-business-day window but a number refused and some large defendants mounted constitutional challenges. "Without enforcement, the bill means nothing," Adkisson told the committee, arguing that a private right of action and meaningful remedies are necessary for compliance.

The committee heard that the bill provides both civil remedies and potential punitive and attorney-fee awards: a plaintiff could recover actual damages or liquidated damages set at $1,000 per violation (whichever is greater), seek reasonable attorney's fees and equitable relief, and pursue punitive damages for willful or reckless violations. The draft makes ordinary negligence the baseline standard of liability except where punitive damages would require proof of willful or reckless disregard. Committee members asked whether liquidated damages of $1,000 per instance could create very large exposure where many covered people appear in a single dataset and whether that risk could produce abusive litigation or unworkable liability for brokers.

Committee members and witnesses also discussed operational questions: whether "cease disclosing" should require deletion from internal records or only removal from public-facing searchability; how an authorized agent must be designated (the draft allows a designated trustee, a notarized proxy or a parent or guardian for a minor); and whether the bill should treat information that is also publicly available on other websites as a defense. One subsection in the draft makes availability of the same information elsewhere not a defense to liability; several lawmakers asked whether that carve-out was appropriate if the same data also appeared on government or other non-broker websites.

Adkisson described litigation experience in New Jersey, said some defendants argued the law violated the First Amendment and that federal courts there upheld the statute at the trial level, and said Atlas and allied private counsel have invested substantial sums pursuing compliance. He told the committee that a mix of compliance exists in the data-broker industry: some firms complied quickly and others refused to comply in principle. He urged that private enforcement be retained so individuals whose notices are ignored have an avenue for remedy if state enforcement resources are limited.

No formal vote or motion was taken at the conclusion of the hearing. The chair and members said the committee's next step would be to collect further testimony from stakeholders and then consider whether to make a recommendation or pass the bill to the Commerce Committee for more detailed work on the privacy, registration, and technical compliance elements.

Members repeatedly flagged three practical questions for further work: (1) the 10 days versus 10 business days discrepancy and whether a flat deadline or a reasonableness standard tied to ordinary negligence is appropriate; (2) whether the statute should require deletion of records or merely the cessation of public disclosure/searchability; and (3) how enforcement would work in practice given the litigation costs and the possibility of large national companies that might resist compliance.

The committee paused after a lengthy hearing to complete testimony from additional witnesses in a later time slot.