Privacy, Cybersecurity & the Law

Some examples include:

Data breach response and notification. A business that suffers a breach of security must disclose it to affected New Jersey residents in the most expedient time possible and without unreasonable delay. The breach must be reported to the Division of State Police in advance of notifying customers. N.J.S.A. 56:8-163. Consumer Fraud Act exposure may follow close behind. N.J.S.A. 56:8-1 et seq. Engage counsel early enough that the facts are developed under privilege rather than in an email thread that later becomes an exhibit.

Unauthorized access and computer fraud, on both sides. A person or enterprise damaged in business or property by the unauthorized access, alteration, destruction, or taking of computer data may sue in the Superior Court for compensatory and punitive damages, the costs of investigation and litigation, and a reasonable attorney’s fee. N.J.S.A. 2A:38A-3. The same conduct carries criminal exposure from the fourth degree to the first. N.J.S.A. 2C:20-25. Federally, the Computer Fraud and Abuse Act supplies a civil action, 18 U.S.C. § 1030(g), narrower than it once was: a person authorized to access a computer does not exceed that authorization merely by using it for an improper purpose. Van Buren v. United States, 593 U.S. 374 (2021).

Devices, passcodes, and searches. Police generally may not search the digital contents of a phone seized on arrest without a warrant. Riley v. California, 573 U.S. 373 (2014). Historical cell-site location records generally require one as well. Carpenter v. United States, 585 U.S. 296 (2018). Whether you can be compelled to give up a passcode is a harder question, and New Jersey has answered it: our Supreme Court held that compelled disclosure of a cellphone passcode did not violate the privilege against self-incrimination on that record. State v. Andrews, 243 N.J. 447 (2020). Say nothing and call counsel before unlocking anything.

Security researchers and disclosure. Vulnerability research, coordinated disclosure, and red-team work draw scrutiny under the same statutes that punish intrusion. If a subpoena, a preservation demand, or a cease-and-desist letter arrives, do not answer it alone. We assess the scope of the demand, assert the protections available, and respond on your behalf.

Cell phones, tower records, and location data. Criminal cases often involve cell phones. Individuals have been traced with exceptional accuracy through tower records. There are even more nefarious means of exposing the data and hardware within a cell phone. One limit is worth stating plainly: a law enforcement agency seeking subscriber records from a provider must show specific and articulable facts that the records are relevant and material to an ongoing criminal investigation. N.J.S.A. 2A:156A-29. If your matter involves cell phone towers, call us.

Breach notification under N.J.S.A. 56:8-163; Consumer Fraud Act claims under N.J.S.A. 56:8-1 et seq. and 56:8-19; the civil action for computer-related damage under N.J.S.A. 2A:38A-3; computer criminal activity under N.J.S.A. 2C:20-25; the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, and its civil remedy at § 1030(g), as construed in Van Buren v. United States, 593 U.S. 374 (2021); Daniel’s Law takedown demands and liquidated damages under N.J.S.A. 56:8-166.1; trade secret misappropriation under N.J.S.A. 56:15-1 et seq. and 18 U.S.C. § 1836; warrant requirements for device searches under Riley v. California, 573 U.S. 373 (2014), and for cell-site location records under Carpenter v. United States, 585 U.S. 296 (2018); and compelled passcode disclosure under State v. Andrews, 243 N.J. 447 (2020); and disclosure of subscriber records under the New Jersey Wiretapping and Electronic Surveillance Control Act, N.J.S.A. 2A:156A-29. This summary is for general information only and is not legal advice.