Nevada Senate Bill 220 Becomes Law – Allows Consumer Opt-Out of PI Sales

The Nevada governor signed a limited privacy bill (SB-220) last week to allow consumers to opt-out of the resale of their personal information. The bill is modeled after the portion of the California Consumer Privacy Act (CCPA) that allows consumers to opt-out of the sale of their personal information, with a few key changes. It does not include any other sections of the CCPA, such as the data subject access rights.

The privacy bill was approved by the Nevada Senate at the end of April and was approved by the Nevada Assembly just before Memorial Day. The Nevada Governor signed the bill on May 29, 2019. It is the first privacy bill to follow the passage of California’s law. Nevada considered a copy of the CCPA as well in the legislature this year but it did not gain support.

The new Nevada privacy law applies to the owner and operator of an Internet website or online service for commercial purposes who collects and maintains covered information from consumers in Nevada and has a sufficient nexus with the state. It does not apply to a third party that manages a website or service on behalf of the owner, a financial institution covered by the GLB Act, entities covered by HIPAA, and certain information maintained by auto manufacturers and repair services.

The definition of sale is more limited than the CCPA. It applies only to the exchange of covered information for resale/lease and monetary consideration. It does not cover the disclosure of information for the purpose of providing a product or service requested by the consumer, to an affiliate of the operator, or disclosures consistent with the reasonable expectations of a consumer.

The information covered by the law is any of the following PII collected through an Internet website or online service and maintained in an accessible form: 1) first and last name; (2) physical address which includes the name of a street and the name of a city or town; (3) email address; (4) telephone number; (5) social security number; (6) in-person or online contact information; (7) any other information concerning a person collected from the person through the Internet website or online service of the operator and maintained by the operator in combination with an identifier in a form that makes the information personally identifiable.

The opt-out may be collected by means of an email address, toll-free telephone number or internet website.

The law gives the operator 60 days to respond to a consumer request. If the operator can reasonably verify the authenticity of the request and the identity of the consumer using commercially reasonable means, then they shall not make any sale of covered information that has been collected or they will collect. It also allows an extension of not more than 30 days if an extension is reasonably necessary. Notice of the extension must be provided to the consumer.

The law will become effective on October 1, 2019 as it does not specifically mention an effective date. If a company is noncompliant, the Nevada Attorney General is authorized to seek an injunction or impose a civil penalty up to $5,000 for each violation.

The bill originally contained a section creating a private right of action for consumers but this section was eliminated during the legislative process. The version that passed now explicitly says that it does not create a private right of action.