On April 17, 2024, the State of Nebraska enacted the Nebraska Data Privacy Act ("NDPA"). With the passage of the NDPA, Nebraska joins the ranks of the nineteen other states that have adopted comprehensive consumer data privacy laws. With numerous state laws already on the books, it is imperative that businesses make consumer data privacy compliance a priority.
Who Is Subject to Nebraska's Consumer Data Privacy Law?
The Nebraska Data Privacy Act applies to any business entity or other organization that: (1) conducts business in Nebraska or produces a product or service consumed by Nebraska residents; (2) processes or engages in the sale of personal data; and (3) is not a "small business" within the meaning of the federal Small Business Act ("SBA"). Unlike most other state consumer data privacy laws, the NDPA does not contain a revenue threshold or a minimum number of state residents whose personal data must be processed in order for the law to apply. Instead, similar to the approach taken by the Texas Data Privacy and Security Act, the NDPA focuses on the size of the business entity in question.
What Are Some of the Key Provisions of the NDPA?
Many of the key NDPA provisions mirror those of the various other state laws now in effect. Consistent with those laws, the NDPA grants consumers the right to:
· Know whether a business is processing their personal data;
· Obtain a copy (in a portable and readily usable format) of the personal data that a business has obtained from them;
· Correct inaccuracies in the personal data held by a business;
· Delete the personal data provided by, or otherwise obtained about, them; and
· Opt-out from: (a) the sale of their personal data; (b) the processing of their personal data for targeted advertising; and/or (c) the use of their personal data for the purpose of profiling.
In addition to the foregoing, businesses that are subject to the NDPA are prohibited from processing "sensitive data" without obtaining prior consent. Of note, even if a business is considered a small business under the SBA (and would thus be considered exempt from the NDPA), any business that sells the sensitive personal information of a Nebraska resident without receiving prior consent to do so has violated the NDPA.
In What Ways Does Nebraska's Consumer Data Privacy Law Matter to Your Business?
Please note, this blog provides only a brief overview of some of the key provisions of the NDPA. There are several other aspects of the law, which may or may not apply to your business. Given that the NDPA has an effective date of January 1, 2025, it is essential that business owners begin taking steps to prepare today. In order to achieve the foregoing, business owners should retain experienced privacy law attorneys who are well-versed in the nuances of state data privacy laws.
Similar blog posts:
Connecticut's Data Privacy Law Will Take Effect Soon!
The CPPA and Federal Preemption of State Data Privacy Laws?
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.