Nevada’s New Consumer Privacy Law Departs Significantly From The California CCPA (Inside Privacy)
Read the full article by Alexandra Scott and Lindsey Tonsager at InsidePrivacy.com
On May 29, 2019, the Governor of Nevada signed into law Senate Bill 220 (“SB 220”), an act relating to Internet privacy and amending Nevada’s existing law requiring websites and online services to post a privacy notice. In short, Nevada’s law will require operators of Internet websites and online services to follow a consumer’s direction not to sell his or her personal data. The Nevada law differs from the California Consumer Privacy Act (“CCPA”) enacted last year in notable ways, and could signal the coming of a patchwork of fifty-plus different data privacy standards across the country, much like the state data breach notification laws.
Unlike the CCPA (which applies to both online and offline business operations), SB 220 applies only to operators of Internet websites and online services, and defines “operators” as people who (1) own or operate an Internet website or online service for commercial purposes; (2) collect and maintain covered information from consumers who reside in Nevada and use or visit the Internet website or online service; and (3) engage in any activity that constitutes a sufficient nexus with Nevada to satisfy the requirements of the United States Constitution. Such activity includes purposefully directing activities toward Nevada, consummating a transaction with Nevada or a Nevada resident, or purposefully taking advantage of the privilege of conducting activity in Nevada. SB 220 does not apply to the following entities: an entity that is regulated by the Gramm-Leach-Bliley Act or the Health Insurance Portability and Accountability Act; a service provider to an operator; or a manufacturer of a motor vehicle or a person who services a motor vehicle who processes covered information that is either (1) retrieved from a motor vehicle in connection with a technology or service related to the motor vehicle, or (2) provided by a consumer in connection with a subscription or registration for a technology or service related to the motor vehicle.
The act does not amend existing Nevada law defining a “consumer” to be a person who seeks or acquires, by purchase or lease, any good, service, money or credit for personal, family or household purposes from an operator’s Internet website or online service. Notably, this definition tracks the California Online Privacy Protection Act (which requires online companies to post a privacy policy) and the California “Shine the Light” Law (which requires disclosures related to the sharing of personal information for others’ direct marketing purposes). The CCPA, in contrast, adopted a much more expansive definition of “consumer” that includes any California resident.