On June 2, 2021, Nevada Governor Stephen F. Sisolak signed Senate Bill (SB) 260 which focuses on Internet privacy. SB 260 was introduced in March 2021 and expands on Nevada’s existing privacy legislation, including expanding on consumers’ rights to opt out of the sale of their personal data. The new requirements will take effect on October 1, 2021.
One of the biggest changes is the introduction of the term data broker which, under SB 260, is a person primarily engaged in the business of selling or purchasing covered information about consumers who are residents of Nevada to and from operators or other data brokers. The right to opt out of sale has been expanded in order to take this new term into account. Upon receipt, data brokers will have 60 days to honor verified requests to opt out of sales with the possibility of a 30-day extension. Data brokers must also have a designated request address for consumers to submit requests directly to a data broker to opt out of the sale of any covered information about the consumer that the data broker has purchased or will purchase.
Compare legislative developments at State level: OneTrust DataGuidance USA State Law Tracker
In addition, the Act will also expand on the definition of sale of data, broadening its scope. The new definition reads: ‘the exchange of covered information for monetary consideration by an operator or data broker to another person.’ This amends the previous wording ‘for the person to license or sell the covered information to additional persons.’
SB 260 also includes several new exemptions that include:
- consumer reporting agencies,
- any information subject to the Fair Credit Reporting Act,
- publicly available information,
- someone who maintains or sells information for the purposes of fraud prevention,
- personally identifiable information under the Federal Driver’s Privacy Protection Act, and
- institutions subject to the Gramm–Leach–Bliley Act.
The expansion to Nevada’s existing privacy law means that organizations will need to assess whether they fall under the new definition of a data broker and subsequently what new obligations apply to them, including whether they are required to set up a dedicated intake address for opt out of sale requests. Request a demo to learn more about how OneTrust can help you prepare for SB 260’s effective date of October 1, 2021.
Follow OneTrust on LinkedIn, Twitter, or YouTube for the latest on Nevada privacy bill.
