Keypoint: If passed, the bill would, among other changes, broaden Nevada’s existing right to opt out of sales of covered information.
In late March, we first reported that the Nevada legislature is considering a bill that would amend Nevada’s online privacy notice statutes, NRS 603A.300-360, to provide for a broader right to opt out of sales. On April 20, the Nevada Senate unanimously passed an amended version of SB260. The bill is now with the Assembly Committee on Commerce and Labor.
By way of background, after California passed the CCPA, the Nevada legislature passed an amendment to its existing online privacy notice statutes to provide state residents with a limited right to opt out of “sales” of covered information. However, the law currently defines “sale” narrowly to mean “the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons.”
As currently drafted, SB260 would amend the definition of “sale” to mean “the exchange of covered information for monetary consideration by an operator or data broker to another person.” By deleting the phrase “for the person to license or sell the covered information to additional persons” the bill would expand the types of activities that could be considered sales.
That said, the law defines “covered information” more narrowly than the CCPA defines “personal information.” Specifically, covered information is defined as:
- A first and last name.
- A home or other physical address which includes the name of a street and the name of a city or town.
- An email address.
- A telephone number.
- A social security number.
- An identifier that allows a specific person to be contacted either physically or online.
- Any other information concerning a person collected from the person through the Internet website or online service of the operator and maintained by the operator or data broker in combination with an identifier in a form that makes the information personally identifiable.
Further, although the bill would broaden the definition of sale, it would keep intact the broad exemptions to that definition, which are disclosures of covered information (1) to processors; (2) to persons with whom the consumer has a direct relationship for the purposes of providing a product or service requested by the consumer; (3) that are “consistent with the reasonable expectations of the consumer”; (4) to affiliates; and (5) as part of a merger, acquisition or similar transaction.
In addition, the bill would create a new category of covered entities named “data brokers” which it defines as “a person primarily engaged in the business of purchasing covered information about consumers who reside in this State from operators or other data brokers and making sales of such covered information.” Data brokers would be required to honor requests to opt out of sales within 60 days of receipt, among other requirements.
Finally, the bill would create a number of new exemptions, including exemptions for consumer reporting agencies; a person who collects, maintains or makes sales of personally identifiable information for purposes of fraud prevention; publicly available information (which term is not defined); personally identifiable information subject to the federal Driver’s Privacy Protection Act of 1994; and a person “who does not collect, maintain or makes sales of covered information.” These exemptions are in addition to existing exemptions for GLBA financial institutions and HIPAA covered entities.
The Nevada legislature adjourns on June 1.