Privacy Bill Essentials: Nevada Seeks to Broaden Online Privacy Laws
On May 25, 2021, the Nevada legislature passed Senate Bill 260, which would amend the state's online privacy notice statutes. Sponsored by Nevada Senator Nicole Cannizzaro, the Bill will broaden Nevada's existing right to opt-out of sales of covered information.
In the Bill, the definition of "sale" is amended to expand the types of activity that could be considered sales, providing greater protection to Nevada residents. Additionally, a new category of covered entities has been created named "data brokers." "Covered Information" is more narrowly defined than "Personal Information" in California's California Consumer Privacy Act. The Bill would also create a number of new exemptions.
To whom would it apply?
In addition to operators, the Bill identifies data brokers as a new category of covered entities. The Bill defines a data broker as "a person whose primary business is purchasing covered information about consumers with whom the person does not have a direct relationship and who reside in this State from operators or other data brokers and making sales of such covered information."
The Bill would not apply to:
- Consumer reporting agencies;
- A person who collects, maintains, or makes sales of personally identifiable information for the purposes of fraud prevention;
- Any personally identifiable information protected from disclosure under the federal Driver's Privacy Protection Act of 1994, 18 U.S.C. §§ 2721 et seq., which is collected, maintained or sold as provided in that Act; and
- A person who does not collect, maintain, or make sales of covered information.
What types of information would it cover?
Covered Information includes any one or more of the following items of personally identifiable information about a consumer, collected by an operator through an Internet website or online service, and maintained by the operator or a data broker in an accessible form:
- First and last name;
- Home or other physical address which includes the name of a street and the name of a city or town;
- Email address;
- Telephone number;
- Social security number;
- An identifier that allows a specific person to be contacted either physically or online; and
- Any other information concerning a person that is collected from the person through the Internet website or online service of the operator and maintained by the operator or data broker in combination with an identifier in a form that makes the information personally identifiable.
What rights would it create?
Under the Bill, sale now means "the exchange of covered information for monetary consideration by an operator or data broker to another person," which expands the types of activity that could be considered sales. Nevada's current law defines a sale narrowly as "the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons."
The Bill would provide Nevada residents with greater rights to opt-out of sales of their personal information by requiring more companies to comply with notice requirements than under the current law.
What obligations would it impose?
Obligations for data brokers under the Bill include the following:
- Each data broker shall establish a designated request address through which a consumer may submit a verified request to a data broker directing the data broker not to make any sale of any covered information about the consumer that the data broker has purchased or will purchase.
- A data broker who has received a verified request submitted by a consumer shall not make any sale of any covered information about that consumer that the data broker has purchased or will purchase.
- A data broker shall respond to a verified request submitted by a consumer within 60 days after receipt thereof.
How would it be enforced?
The Nevada Attorney General is tasked with enforcement of the related online privacy laws by instituting an appropriate legal proceeding against operators and data brokers. If a district court finds that a violation has occurred, the court may issue a temporary or permanent injunction or impose a civil penalty of up to $5,000 for each violation.
Nevada law does not provide for a private right of action against operators. However, it is unclear whether a private right of action against data brokers is available.
Where does it stand?
The Bill was signed by the Governor on June 2, 2021. It will go into effect on October 1, 2021.
With this Bill, Nevada will join other states focusing on bringing transparency to data brokers and the data brokerage industry. Vermont and California, for example, have passed data broker registration laws (9 V.S.A. 2430 and Civil Code §1798.99.80, et. seq.). Vermont's Attorney General brought its first enforcement action alleging that Clearview AI, a data broker that uses facial recognition technology to map the faces of Vermonters, including children, and sells access to this data to private businesses, individuals, and law enforcement, violated the state's data broker law by fraudulently acquiring data through its use of screen scraping.