56:8-166.13 Applicability, personal data, exceptions, institutions, certain.
10. Nothing in P.L.2023, c.266 (C.56:8-166.4 et seq.) shall apply to: a. protected health information collected by a covered entity or business associate subject to the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the "Health Insurance Portability and Accountability Act of 1996" (“HIPAA”), Pub.L.104-191, and the "Health Information Technology for Economic and Clinical Health Act," 42 U.S.C. s.17921 et seq.; or information treated like protected health information collected, used, or disclosed by a covered entity or business associate under HIPAA when the information is used or disclosed in accordance with HIPAA and the information is afforded all the privacy protections and security safeguards of the federal laws and implementing regulations under HIPAA; b. a financial institution, data, or an affiliate of a financial institution that is subject to Title V of the federal "Gramm-Leach-Bliley Act," 15 U.S.C. s.6801 et seq., and the rules and implementing regulations promulgated thereunder; c. the secondary market institutions identified in 15 U.S.C. s.6809(3)(D) and 12 C.F.R. s.1016.3(l)(3)(iii); d. an insurance institution subject to P.L.1985, c.179 (C.17:23A-1 et seq.); e. the sale of a consumer's personal data by the New Jersey Motor Vehicle Commission that is permitted by the federal " Driver’s Privacy Protection Act of 1994," 18 U.S.C. s.2721 et seq.; f. personal data collected, processed, sold, or disclosed by a consumer reporting agency, as defined in 15 U.S.C. s.1681a(f), if the collection, processing, sale, or disclosure of the personal data is limited, governed, and collected, maintained, disclosed, sold, communicated, or used only as authorized by the federal "Fair Credit Reporting Act," 15 U.S.C. s.1681 et seq., and implementing regulations; g. any State agency as defined in section 2 of P.L.1971, c.182 (C.52:13D-13), any political subdivision, and any division, board, bureau, office, commission, or other instrumentality created by a political subdivision; h. personal data that is collected, processed, or disclosed, as part of research conducted in accordance with the Federal Policy for the protection of human subjects pursuant to 45 C.F.R. Part 46, human subjects research conducted in accordance with good clinical practice guidelines issued by The International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use, or research conducted in accordance with the protection of human subjects pursuant to 21 C.F.R. Parts 50 and 56; i. an insurance-support organization as defined in section 2 of P.L.1985, c.179 (C.17:23A-2); or j. a national securities association registered pursuant to section 15A of the “Securities Exchange Act of 1934,” 15 U.S.C. s.78a et seq., and any rules or regulations promulgated thereunder. L.2023, c.266, s.10; amended 2025, c.367, s.1.