3rd Circuit Review of Daniel’s Law May Force Legislatures to Rethink It, Privacy Lawyers Say

Daniel’s Law, enacted in November 2020, is aimed at protecting personal information of “covered persons,” including judicial and law enforcement officers, child protective investigators and certain family members. The law also lets people request that data brokers delete their information. Such information must be removed within 10 days of a request.

The statute was named after Daniel Anderl, who a disgruntled litigant killed while seeking revenge on Anderl's mother, Judge Esther Salas of the U.S. District Court for New Jersey. Salas’ husband, Mark Anderl, was wounded in the incident. In 2023, the law was amended to allow third parties to act on behalf of a covered person to bring a claim. Since the amendment, the company Atlas Data Privacy has brought many claims against data brokers under Daniel's Law, a combination of which is the focus of the case in front of the 3rd Circuit.

“I don't see a lot of challenges to statutes like this,” said Benjamin Mishkin, technology and data privacy lawyer at Cozen O’Connor. Indeed, Mishkin is unsure there's a precedent case "involving a similar statute that would give you an indication ... whether the First Amendment argument is actually strong or is going to get upheld by the 3rd Circuit.”

David Klein, technology lawyer at Klein Moynihan Turco, said the 2023 amendment is likely what led to the 3rd Circuit review. Since the amendment's passage, third parties such as Atlas Data, which were assigned Daniel’s Law claims, have “weaponized the statute” in an attempt to make money off this otherwise well-meaning law, he said.

“When Atlas started abusing the statute to shake down companies that had no intent of violating the law, that's when things really escalated,” he said. “The sheer volume of these lawsuits, these shakedowns, led to” a consolidated lawsuit challenging the validity of the law being appealed to the circuit court.

Mishkin said the volume of litigation is unlikely to slow while the 3rd Circuit case is underway. The people filing these suits "are looking to get paid, so there's still going to be an incentive for them to continue to hit people ... to try to get paid,” he said.

In terms of the appeals' argument, Mishkin said the challengers in case 24-8046 relied mostly on First Amendment claims. “The plaintiffs’ main point was … the law is a content-based restriction on speech,” he said. “If you are a content-based restriction on speech, you have to survive strict scrutiny.”

One of the arguments the appeal is making is that the law treats "private sector people differently than government entities because the law distinguishes between what private sector companies have to do and what government entities have to do in response to these requests,” which is “restricting free speech because you're ... placing more of a burden on private actors' free speech than government entities,'” he said.

“It's not an argument that I've seen someone make in order to challenge a law like this,” Mishkin said. “But I also don't think there are a lot of laws like this in the country.”

But there are other issues, too, Klein said. “The spirit and intent of the law" are "great,” he said. “It absolutely is something that should be on the books, not only in New Jersey, but in pretty much all states, particularly in today's environment, when people are putting the lives of members of law enforcement in danger ... We have to protect them, their families and their personally identifiable information, such as home addresses and telephone numbers.”

However, “Daniel's Law is not written as well as it should be,” Klein argued. “The 10-day take-down period is too short, given that a lot of these demands are sent via email and end up in the spam filter. If acting on the demand is not effectuated within the allotted 10 days, it's a violation of the statute."

Instead of the 10-day period to delete data, “30 days makes more sense, with an additional provision that allows recipients to extend if they need more time to act.” Some companies “have thousands, even millions of consumer data records, and to comb through that takes a lot of time,” even though “they want to do the right thing.”

Something else that Klein said is an important “add” to Daniel’s Law is a “reasonableness" standard. "One that applies when requesting additional time to implement the deletion requests,” so that companies can have more time to find the applicable data records and act on those requests, if needed.

Depending on how the 3rd Circuit rules, Mishkin said, “other state legislatures that are considering similar laws will consider how to more narrowly draft and tailor their laws to try to not be vulnerable [under] the same argument.”

Vermont, for example, introduced H-342 this session, which has passed the House but still must get through the Senate before reaching the governor's desk (see 2503280028). The bill echoed New Jersey’s law, but its private right of action was controversial (see 2503140065), and a House vote was delayed twice (see 2503200045) before it finally passed (see 2503210009). Some state lawmakers echoed Klein’s fears that the law would be taken advantage of (see 2503120025).

But even if the appeal is upheld, “it's not as though the 3rd Circuit [would be] saying the law actually is violative of the Constitution,” Mishkin said. “The 3rd Circuit [would] just [be] saying you shouldn't have granted a motion to dismiss. You have to proceed to the next phase of the trial at the lower court.”

“Legislators … want to write something that they think is enforceable,” he said. “I think it could very well impact states, even if they're not in the Third Circuit.”

Klein agreed but also called on New Jersey to reevaluate Daniel’s Law regardless. “I'd like the legislature to revisit the law, whether it's on their own or via a 3rd Circuit ruling that the statute is unconstitutional from a First Amendment perspective.”