1. United States
2. N.J.
3. Letter

The current Privacy Protection Act, S3522, removes a protection that last session’s bill, S5037, explicitly included and that applied to all patients regardless of immigration status. Last session’s bill, S5037, required health care facilities to notify any patient when their protected information, including immigration status, social security number, or place of birth, was disclosed. That provision was removed entirely from the current bill, S3522. Here is what that means in plain terms. A federal agency can issue an administrative subpoena for your medical records without asking a judge. No court review. No judicial oversight. The bar is so low that an agency only needs to claim the records might be relevant to something it is investigating. Under the last session’s bill, S5037, your hospital would have been required to tell you when your records were handed over for any reason, whether voluntarily, under subpoena, or pursuant to a court order. Under the current bill, S3522, it does not. You would never know it happened. That applies to every patient in every New Jersey hospital. The woman who came here for reproductive care. The transgender patient here for gender affirming care. Any New Jersey resident, citizen or not, documented or not. That notification requirement existed in last session’s bill. It was removed from the current bill. That is a choice. The license plate provisions extend that same risk to anyone who drives. Last session’s bill, S5037, limited sharing of automated license plate recognition data to other New Jersey government entities, or pursuant to a valid judicial order or warrant. The current bill, S3522, adds an exception: that data can now be shared with out of state law enforcement for criminal investigations, as long as the receiving agency signs a certification promising not to use it for immigration enforcement. We already know exactly what that certification is worth. In May 2025, a Texas sheriff’s deputy typed six words into a nationwide surveillance system called Flock Safety: “had an abortion, search for female.” Those six words searched 83,345 cameras across the country, including cameras in Illinois, Washington, and New Mexico, all states where abortion is fully legal. The claim was triggered by her abusive partner, who was later charged with domestic violence. The woman was never charged. No warrant. No notification to the states whose cameras were accessed. None of those states knew their cameras had been searched until reporters and public records requests uncovered it weeks later. No mechanism existed to stop it. There is nothing in the current bill, S3522, to prevent the same search from sweeping New Jersey cameras. If you suspect your data was shared, your only recourse is to file an OPRA request for the sharing agreement, assuming you even know one exists. And if a violation is confirmed? The Attorney General can prohibit future sharing with that agency. No fine. No requirement to delete data already handed over. The data that left New Jersey is gone. And with it, potentially, so is the person it belongs to. That certification is not a protection. It is a liability waiver with no teeth. And it applies to every driver in this state. These were not drafting accidents. They were choices. Why “We’ll Fix It Later” Is Not Good Enough The previous bills were stronger. They passed the legislature. They died on Governor Murphy’s desk. They were reintroduced. And they came back weaker. That is not progress. That is a pattern.