Recently, Nevada became the latest state to enact heightened privacy protections for its residents when it announced an amendment to an existing law relating to Internet privacy. [NRS 603A.100]. In essence, the amendment, which is to take effect on October 1, 2019, prohibits an operator of an Internet website or online service to sell the covered information (i.e. personal information) of a Nevada resident upon request.
The amendment has three obvious shortcomings.
Shortcoming No. 1: “Opt-Out” Requirement
First, under the amended law, the default setting allows an operator to sell the personal information of a consumer. The prohibition only applies if the consumer submits a verified request directing the operator not to make any sale of his or her personal information. [NRS 603A.100, §2]
This presumes that Nevada consumers are aware that they have this right and that they will exercise it. This is a big presumption.
Shortcoming No. 2: “Compensation” Requirement
Second, the amended law defines “sale” narrowly. The term “sale” means …“the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons.” [NRS 603A.100, §1.6].
An operator can circumvent the sale prohibition by simply exchanging information to another person or entity for non-monetary consideration.
Shortcoming No. 3: “No Private Right of Action”
Third, the amended law does not establish a private right of action against an operator, under any circumstance. [NRS 603A.100, §7]. Instead, the Attorney General may initiate an appropriate legal proceeding and the district court may issue an injunction or civil penalties not to exceed $5000 per violation.
The lack of private right of action means that Nevada consumers must rely on the Attorney General to hold operators accountable under the newly amended statute; the consumers cannot enforce their rights on their own.