On May 29, 2019, Nevada’s SB 220 became law, amending Nevada’s Privacy Law (2017). The existing Nevada Privacy Law, which is similar to California’s Online Privacy Protection Act (2004), requires a conspicuously posted privacy policy. The new SB 220 resembles the new California Consumer Privacy Act ("CCPA") but is more narrow in application and scope.
Nevada’s new privacy law applies to covered information of Nevada residents, but the definition of "covered information" ("CI") is more limited than CCPA’s broad definition of “personal information.”
Under the new law, a consumer has the right to opt-out of data sales, at any time, and can request that an operator stop selling CI it has collected or will collect about the consumer. A “sale” for this purpose is an exchange of CI for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons. (This is also much more focused than the CCPA, which defines sale to include sharing for non-monetary consideration, as well.)
There is also no private right of action under the new law, and Nevada’s Attorney General is the sole enforcer of SB 220.
See our Focus on the Data blog for a more detailed description.
Compliance obligations overlap with the CCPA’s “Do Not Sell” requirements but are narrower in scope, with more lenient deadlines.
unknownx500
