Nebraska’s governor has recently approved a new privacy law for the state. This is the fourth privacy law to be signed this year, and the 17th one overall. The change will happen on January 1, 2025, which is also the same day as Delaware, Iowa, and New Hampshire. (To find out about all the latest state privacy laws, check out our new online resource.)
The provisions of the Nebraska law are similar to those found in other states. Unlike California, the term “consumer” in this context does not include individuals in an employment setting. Important parts of the agreement include:
Applicability
The law applies to a wide range of situations, more so than most other laws (except for Texas). This law will affect all businesses that operate in Nebraska or create products or services used by Nebraska residents. It applies to businesses that handle or sell personal data and do not qualify as a small business according to the Small Business Act as of January 1, 2024. However, there are exceptions. This does not apply to non-profit organizations, higher education institutions, and entities and data that are covered by GLBA and HIPAA. The law also does not require natural gas and electric utilities to follow the same data processing rules.
Sensitive Information
Nebraska requires businesses that handle sensitive information to get permission first, even if they are small businesses that would normally be exempt. The list of information considered “sensitive” is similar to other state laws and includes religion, exact location, and health diagnoses.
Consumer Rights
Nebraska will give consumers the same rights as other states. You have the right to access, correct, delete, and transfer your personal information. Consumers should have at least two different ways to use their rights. The processing time for rights requests is 45 days. In Nebraska, the law does not say whether consumers can choose someone to submit a request for them, except for parents with minor children. Businesses do not have to follow universal online opt-out systems.
Also Read: Legislators Target State Agencies Hostile to Weight-loss Drug Funding
Opt-outs Mechanism
Businesses that use targeted advertising, sell personal data, or create profiles will have to inform Nebraska residents about these activities and give them the option to opt out.
Data Protection Impact Assessments
Most states, except Iowa and Utah, require businesses to perform data protection impact assessments when processing data that poses a higher risk to consumers. This means using consumer data to show specific advertisements, creating profiles that may involve risks, selling consumer data, or handling sensitive information.
Just like in other states, consumers will not be able to take legal action on their own. Instead, the Nebraska Attorney General will take legal action. The law allows for a 30-day cure period that does not expire. There are no rules for making additional rules.
Leave a Reply