1. What is your state’s law on the use of CBD oil in products to be sold to the public, i.e. cosmetics, etc.?

In New Jersey, CBD oil derived from cannabis/marijuana can only be sold through a licensed medical marijuana dispensary to program participants. However, CBD oil derived from industrial hemp can be sold broadly and is available statewide. FDA regulations regarding health claims and use as a food additive still apply to CBD.

2. Regarding privacy issues, has your state adopted its own version of GDPR or how is your state dealing with GDPR requirements? What other privacy laws has your state adopted recently in response to concerns about the lack of protections for consumers?

New Jersey has a data breach notification law known as the “Identity Theft Protection Act.” The Act requires notification of consumers when personal information is stolen, as well as notification to the State Police and credit bureaus for larger breaches. The Act also allows for private suits with potential treble damages.

New Jersey recently amended the Act to include online account information in the definition of personal information for purposes of the Act.

The New Jersey Attorney General’s office also recently created its own civil enforcement unit, the Data Privacy & Cybersecurity Section, tasked with investigating and enforcing the laws regarding date breaches.