Nebraska Becomes 16th State To Enact Comprehensive Consumer Data Privacy Law

Nebraska Becomes 16th State to Enact Comprehensive Consumer Data Privacy Law

Nebraska Data Privacy ActNebraska Gov. Jim Pillen on April 17 signed into law LB 1074, the Nebraska Data Privacy Act, making Nebraska the 16th state to enact a comprehensive consumer data privacy law following California, Virginia, Colorado, Utah, Connecticut, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, Delaware, New Jersey, New Hampshire, and Kentucky. The law will go into effect Jan. 1, 2025.

APPLICABILITY
The Act applies to a person that:

Conducts business in Nebraska or produces a product or service consumed by residents of Nebraska;
Processes or engages in the sale of personal data; and
Is not a small business as determined under the federal Small Business Act, except to the extent that section 18 of the Act applies, requiring consent prior to the sale of sensitive data.
EXEMPTIONS
Exemptions include, but are not limited to:

Financial institutions, their affiliates, or data subject to Title V of the Gramm-Leach-Bliley Act;
Covered entities or business associates governed by the privacy, security, and breach notification rules issued by the U.S. Department of Health and Human Services;
Protected health information under the Health Insurance Portability and Accountability Act;
The collection, maintenance, disclosure, sale, communication, or use of any personal information to the extent that such activity is regulated by and authorized under the Fair Credit Reporting Act;
Data processed or maintained in the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, or third party.
CONSUMER RIGHTS
Consumers have the right to:

Confirm whether a controller is processing their personal data;
Correct inaccuracies in their personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data;
Delete personal data provided by or obtained about the consumer;
Obtain a portable copy of their personal data if the data is available in a digital format and the processing is completed by automated means;
Opt-out of the processing of the personal data for purposes of:
Targeted advertising;
The sale of personal data; or
Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer.
SENSITIVE DATA
A controller may not process sensitive data of a consumer without obtaining the consumer’s consent, or, in the case of processing the sensitive data collected from a known child, process the data [except] in accordance with the federal Children’s Online Privacy Protection Act.

“Sensitive data” means a category of personal data that includes:

Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status;
Genetic or biometric data that is processed for the purpose of uniquely identifying an individual;
Personal data collected from a known child; or
Precise geolocation data.
CONTRACT REQUIREMENTS
A contract between a controller and a processor must include:

Clear instructions for processing data;
The nature and purpose of processing;
The type of data subject to processing;
The duration of processing;
The rights and obligations of both parties; and
A requirement that the processor shall:
Ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data;
At the controller’s direction, delete or return all personal data to the controller as requested after the provision of the service is completed, unless retention of the personal data is required by law;
Make available to the controller, on reasonable request, all information in the processor’s possession necessary to demonstrate the processor’s compliance with the requirements of the Data Privacy Act;
Allow, and cooperate with, reasonable assessments by the controller or the controller’s designated assessor; and
Engage any subcontractor pursuant to a written contract that requires the subcontractor to meet the requirements of the processor with respect to the personal data.
DATA PROTECTION ASSESSMENTS
A controller must conduct and document a data protection assessment of each of the following processing activities involving personal data:

The processing of personal data for purposes of targeted advertising;
The sale of personal data;
The processing of personal data for purposes of certain profiling;
The processing of sensitive data; and
Any processing activity that involves personal data that presents a heightened risk of harm to any consumer.
ENFORCEMENT
The Attorney General has exclusive authority to enforce violations. For any violation that is not cured within 30 days of notice, the Attorney General may seek civil penalties not to exceed $7,500 for each violation.

IMPRESSION
The Nebraska Data Privacy Act is another example of sensible legislation that balances the rights of consumers with the impact on businesses. Though the applicability threshold incorporating a small business exemption is modeled after the Texas Data Privacy and Security Act, in many other respects the Act follows the pattern of most post-California comprehensive data privacy laws. For a chart comparing the state comprehensive data privacy acts, and more information and insight from Maurice Wutscher on data privacy and security laws and legislation, click here.

Print Friendly, PDF & Email
Eric Rosenkoetter

Eric Rosenkoetter is a principal at Maurice Wutscher LLP, where he provides counsel to businesses and consumer financial services firms nationwide. For many years, he has focused his practice on various aspects of financial services law. As a litigation attorney, he has conducted every aspect of the litigation process, including countless depositions, motion proceedings, bench and jury trials, and appeals in various courts. In addition, he has significant experience as a compliance and transactional attorney, providing strategic, business growth, legislative, compliance and regulatory advice to national corporations and trade associations. For example, he has drafted consumer contracts and disclosures designed to state-specific statutory requirements, and developed “Best Practices” guides and state-by-state compliance grids, for national financial services companies. He also conducted research and crafted a metrics report for a national trade association with analysis designed to counter the claims of advocacy groups. Eric’s experience also includes working for a national corporation as Executive Counsel, Chief Compliance and Ethics Officer, and Director of Legislative Affairs, and as a federal lobbyist and Director of Government and Public Affairs for a national financial services trade association. In the government sector, Eric presided over approximately 6,000 state administrative hearings, served as a staff attorney for the Missouri Senate, and handled litigation in 33 counties as a regional managing attorney. Eric frequently speaks to audiences on topics relevant to the financial services industry including regulatory compliance, data privacy law and related advocacy initiatives. For more information, see https://mauricewutscher.com/attorneys/eric-rosenkoetter/