Nevada Data Privacy Opt-Out Effective October 1
As FTC attorneys continue to ramp up data privacy investigations and enforcement actions. In fact, the Federal Trade Commission, the nation’s primary privacy and data security enforcer, recently released its annual report highlighting FTC lawyers’ privacy and data security work for 2018.
States have also been quite active in terms of passing and bolstering legislation.
Nevada Senate Bill 220 recently amended Nevada’s data privacy law. The legislation provides consumers with the right to opt-out of the sale of their personally identifiable information to specific businesses.
The Nevada opt-out requirements go into effect on October 1, 2019.
Consequently, various measures should be implemented immediately.
Nevada’s online privacy statute went into effect in 2017.
It applies to “operators” of websites and online services that collect certain personal information from Nevada consumers.
“Covered Information” under the law is (i) a first and last name, (ii) a home or other physical address which includes the name of a street and the name of a city or town, (iii) An electronic mail address, (iv) a telephone number, (v) a social security number, (vi) an identifier that allows a specific person to be contacted either physically or online, (vii) any other information concerning a person collected from the person through the Internet website or online service of the operator and maintained by the operator in combination with an identifier in a form that makes the information personally identifiable.
Online disclosure must include: (i) categories of covered information collected; (ii) categories of third-parties that covered information is shared with; (iii) how consumers can review and request changes to their covered information; (iv) how consumer are notified of material changes to notice; and (v) if the operator collects covered information about consumers’ online behavior.
An “operator” is defined as someone that: (i) owns or operates an Internet website or online service for commercial purposes; (ii) collects/maintains covered information from consumers who reside in Nevada and use or visit the Internet website or online service; and (iii) purposely directs its activities/business to develop a relationship with Nevada consumers. There are limited exemptions.
Beginning October 1, 2019, covered businesses shall have to permit consumers to opt-out of the sale of their covered information. A “designated request address” must be implemented where consumers can submit a verified request to take advantage of the opt-out requirement. A designated request address can take the form of an email address, toll-free number or website.
Responses to verified requests must be made within 60 days. However, a 30 day extension may be possible under specified circumstances.
Importantly, a “sale” is defined as “the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons. By contrast, California’s new privacy law includes non-monetary consideration.
A sale does not include disclosing data to a third party where: (i) the information is being processed on behalf of the operator; (ii) there is a direct relationship between the consumer and the operator for the purpose of providing a product or service to the consumer; (iii)) the context of the information provided would give a reasonable expectation that the information would be disclosed; (iv) the information is provided to an affiliate of the operator; or (v) there is a merger, acquisition, bankruptcy or other transaction in which the person assumes the control of all or part of the assets of an operator.
Businesses subject to the new Nevada privacy law should consult with FTC lawyers and, without limitation, assess whether they are selling “covered information,” implement an opt-out process, provide a designated request address and assess privacy notices.
Richard B. Newman is an advertising compliance lawyer at Hinch Newman LLP. Follow him on Facebook at FTC defense lawyers.
Informational purposes only. Not legal advice. Attorney advertising.