States across the country are floating privacy-related legislation in many forms, and California continues to consider many potential amendments to the landmark California Consumer Privacy Act (Cal. Civ. Code 1798.100 et seq., “CCPA”), which goes into effect on January 1, 2020. On May 30, a law of significance to sellers of consumer personal information was signed into law in Nevada, and it will become effective October 1, 2019, three months prior to the CCPA.
Senate Bill 220 (SB 220) is significant because, similar to CCPA, it requires sellers of consumer personal information to provide consumers with an option to opt-out of the sale of their information. SB 220 is an amendment to existing provisions of Chapter 603A of the Nevada Revised Statutes that will “prohibit[] an operator of an Internet website or online service which collects certain information from consumers in this State from making any sale of certain information about a consumer if so directed by the consumer.”
SB 220 establishes that an operator must provide a “designated request address through which a consumer may submit a verified request” (Sec. 2.1) and requires that upon receiving such a request, the operator “shall not make any sale of any covered information the operator has collected or will collect about that consumer” (Sec. 2.3.). While the CCPA defines selling as exchanging for “monetary or other valuable consideration” (Cal. Civ. Code 1798.140(t)(1)), SB 220 is narrower in restricting the definition to an exchange for “monetary considerations” (Sec. 1.6.). Also, despite the original bill having a private right of action, that option was removed in an amendment prior to the final approved bill. Therefore, enforcement of this provision will be by the Nevada attorney general who can seek fines or injunction for non-compliance.
Businesses that sell consumer information need to take heed to this changing landscape and consider these new deadlines in their implementation strategies. This Nevada law will be in effect in under three months, and for many companies a broad right for consumers to opt-out of the sale of their information is a significant operational and business change that the business has not previously had to contemplate. It is imperative that companies take the steps now to understand what data they collect, how it is used, and with whom it is shared or exchanged for value. As privacy laws continue to evolve, it is likely that legislatures will provide companies with shorter compliance timelines, as companies may be expected to be on notice of this focus on privacy as a core consumer protection. This Nevada law will likely be the first such change, but it is highly likely more will follow even beyond the CCPA.
