Privacy Bill Essentials: Nevada Seeks to Broaden Online Privacy Laws

June 9, 2021
Hinshaw Privacy & Cyber Bytes

On May 25, 2021, the Nevada legislature passed Senate Bill 260, which would amend the state's online privacy notice statutes. Sponsored by Nevada Senator Nicole Cannizzaro, the Bill will broaden Nevada's existing right to opt-out of sales of covered information. 

In the Bill, the definition of "sale" is amended to expand the types of activity that could be considered sales, providing greater protection to Nevada residents. Additionally, a new category of covered entities has been created named "data brokers." "Covered Information" is more narrowly defined than "Personal Information" in California's California Consumer Privacy Act. The Bill would also create a number of new exemptions.

To whom would it apply?

In addition to operators, the Bill identifies data brokers as a new category of covered entities. The Bill defines a data broker as "a person whose primary business is purchasing covered information about consumers with whom the person does not have a direct relationship and who reside in this State from operators or other data brokers and making sales of such covered information." 

The Bill would not apply to:

What types of information would it cover?

Covered Information includes any one or more of the following items of personally identifiable information about a consumer, collected by an operator through an Internet website or online service, and maintained by the operator or a data broker in an accessible form:

What rights would it create?

Under the Bill, sale now means "the exchange of covered information for monetary consideration by an operator or data broker to another person," which expands the types of activity that could be considered sales. Nevada's current law defines a sale narrowly as "the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons." 

The Bill would provide Nevada residents with greater rights to opt-out of sales of their personal information by requiring more companies to comply with notice requirements than under the current law.

What obligations would it impose?

Obligations for data brokers under the Bill include the following:

How would it be enforced?

The Nevada Attorney General is tasked with enforcement of the related online privacy laws by instituting an appropriate legal proceeding against operators and data brokers. If a district court finds that a violation has occurred, the court may issue a temporary or permanent injunction or impose a civil penalty of up to $5,000 for each violation. 

Nevada law does not provide for a private right of action against operators. However, it is unclear whether a private right of action against data brokers is available.

Where does it stand? 

The Bill was signed by the Governor on June 2, 2021. It will go into effect on October 1, 2021. 

With this Bill, Nevada will join other states focusing on bringing transparency to data brokers and the data brokerage industry. Vermont and California, for example, have passed data broker registration laws (9 V.S.A. 2430 and Civil Code §1798.99.80, et. seq.). Vermont's Attorney General brought its first enforcement action alleging that Clearview AI, a data broker that uses facial recognition technology to map the faces of Vermonters, including children, and sells access to this data to private businesses, individuals, and law enforcement, violated the state's data broker law by fraudulently acquiring data through its use of screen scraping.