Nevada Passes New Privacy Notice Law
Melissa Krasnow | April 6, 2018
Nevada joins California and Delaware in enacting a law addressing privacy notice requirements. The Nevada law, SB538, became effective on October 1, 2017. Companies should revisit their privacy notices and practices in light of the Nevada law.
The Nevada law requires an operator to make a privacy notice available in a manner reasonably calculated to be accessible by consumers whose covered information the operator collects through its Internet website or online service. Section 6(1). The foregoing requirement does not apply to an operator (i) located in Nevada, (ii) whose Internet website or online service has fewer than 20,000 unique visitors per year, and (iii) whose revenue is derived primarily from a source other than the sale or lease of goods, services, or credit on Internet websites or online services. Section 6(3).
Nevada Privacy Notice Law Definitions
"Operator" means a person that (i) owns or operates an Internet website or online service for commercial purposes, (ii) collects and maintains covered information from consumers that reside in Nevada and use or visit the Internet website or online service, and (iii) purposefully directs its activities toward Nevada, consummates some transaction with Nevada or a Nevada resident or purposefully avails itself of the privilege of conducting activities in Nevada. Section 5(1). Excluded from the definition of operation is a third party that operates, hosts, or manages an Internet website or online service on behalf of its owner or processes information on behalf of the owner of an Internet website or online service. Section 5(2).
"Consumer" means a person who seeks or acquires, by purchase or lease, any good, service, money, or credit for personal, family, or household purposes from the Internet website or online service of an operator. Section 3.
"Covered information" means any of the following items of personally identifiable information about a consumer collected by an operator through an Internet website or online service and maintained by the operator in an accessible form: (i) first and last name, (ii) home or other physical address that includes the name of a street and the name of a city or town, (iii) electronic mail address, (iv) telephone number, (v) Social Security number, (vi) identifier that allows a specific person to be contacted either physically or online, and (vii) any other information concerning a person collected from the person through the Internet website or online service of the operator and maintained by the operator together with an identifier in a form that makes the information personally identifiable. Section 4.
Privacy Notice Disclosure Items
The Nevada law requires that the privacy notice (i) identify the categories of covered information that the operator collects through its Internet website or online service about consumers who use or visit the Internet website or online service and the categories of third parties with which the operator may share such covered information, (ii) provide a description of the process, if any, for an individual consumer who uses or visits the Internet website or online service to review and request changes to any of their covered information that is collected through the Internet website or online service, (iii) describe the process by which the operator notifies consumers who use or visit the Internet website or online service of material changes to the notice required to be made available by the Nevada law, (iv) disclose whether a third party may collect covered information about an individual consumer's online activities over time and across different Internet websites or online services when the consumer uses the Internet website or online service of the operator, and (v) state the effective date of the notice. Section 6(1).
Failure to Comply, Violation, and Attorney General Enforcement
An operator may remedy any failure to comply with the privacy notice requirement and the privacy notice disclosure items obligation within 30 days after being informed of such a failure. Section 6(2). An operator violates the privacy notice requirement and the privacy notice disclosure items obligation if the operator (i) knowingly and willfully fails to remedy a failure to comply with such requirement and obligation within 30 days after being informed of such a failure or (ii) makes available a notice pursuant thereto which contains information which constitutes a knowing and material misrepresentation or omission that is likely to mislead a consumer acting reasonably under the circumstances, to the detriment of the consumer. Section 7.
The Nevada attorney general enforces the Nevada law and may seek an injunction or a civil penalty up to $5,000 for each violation. Section 8(1). The Nevada law provisions do not establish a private right of action against an operator. Section 8(3). The Nevada law provisions are not exclusive and are in addition to any other remedies provided by law. Section 8(4).
Read Nevada law SB538. Also see "California Minors under Age 18: Privacy Requirements for Deleting Content/Information and Advertising/Marketing."
Opinions expressed in Expert Commentary articles are those of the author and are not necessarily held by the author's employer or IRMI. Expert Commentary articles and other IRMI Online content do not purport to provide legal, accounting, or other professional advice or opinion. If such advice is needed, consult with your attorney, accountant, or other qualified adviser.
