The New Jersey Supreme Court recently ruled on a significant case involving data privacy protections under Daniel's Law. The court determined that the law does not require a mental state for actual damages liability. This ruling affects individuals whose personal information is disclosed without consent, particularly those in sensitive positions like law enforcement.
In the case of Atlas Data Privacy Corp. v. We Inform, LLC (A-8-25), the court addressed a certified question from the Third Circuit regarding the mental state necessary to establish liability under Daniel's Law. The law was enacted to protect certain public officials, including police and correctional officers, from having their home addresses and phone numbers disclosed. The ruling clarifies how the law applies to data brokers and other entities that may share personal information.
The plaintiffs in this case include Atlas Data Privacy Corporation and several individuals, including police officers who allege that their personal information was improperly disclosed. They claimed that various defendants, including data aggregators and marketing companies, continued to disclose their information despite receiving cease-and-desist notices. The defendants argued that Daniel's Law was unconstitutional because it did not specify a mental state for liability.
The dispute began when the defendants filed motions to dismiss, claiming that the law's lack of a mental state requirement for actual damages made it unconstitutional. The district court ruled against the defendants, stating that a strict liability standard would likely be unconstitutional. It suggested that a negligence standard would be more appropriate, as it aligns with common law torts related to privacy violations.
The case was then appealed to the Third Circuit, which certified questions to the New Jersey Supreme Court regarding whether Daniel's Law requires a mental state for liability. The court accepted the reformulated question: What mental state, if any, is required to establish liability under Daniel's Law?
In its ruling, the New Jersey Supreme Court held that Daniel's Law does not impose a mental state requirement for actual damages liability. The court emphasized that the statute's language is clear and does not indicate that a mental state is necessary for liability to attach. Justice Pierre-Louis, writing for a unanimous court, stated, "Neither Section 166.1(c)(1) nor the other subsections in Section 166.1 require a mental state for the award of actual damages under Section 166.1(c)(1)." This decision clarifies that entities can be held liable for disclosing personal information without needing to prove intent or negligence.
The court also noted that the absence of a mental state requirement in the actual damages provision is significant, especially since other sections of Daniel's Law do include such requirements. The court reasoned that if the legislature intended to impose a mental state for actual damages, it would have included that language in the statute. The court further explained that the legislative history of Daniel's Law supports this interpretation, as the legislature had previously included a mental state requirement but later removed it in amendments.
This ruling has important implications for individuals seeking to protect their personal information under Daniel's Law. It means that data brokers and other entities can be held liable for disclosing personal information without needing to prove intent or negligence. This decision aims to enhance the protections for individuals in sensitive positions, such as law enforcement officers, who may face threats due to the disclosure of their personal information.
The New Jersey Supreme Court's ruling also raises questions about the broader implications for privacy laws in the state. By clarifying the liability standards under Daniel's Law, the court has set a precedent that may influence future cases involving data privacy and disclosure. The decision underscores the importance of protecting individuals' personal information, particularly in an era where data breaches and privacy violations are increasingly common.
Looking ahead, it remains to be seen whether the defendants will seek to appeal this ruling or if any related cases will emerge that challenge the interpretation of Daniel's Law. The court's decision provides a clearer framework for how the law will be applied, potentially impacting ongoing and future litigation involving data privacy issues.