{"id":294,"date":"2019-10-09T09:46:56","date_gmt":"2019-10-09T13:46:56","guid":{"rendered":"https:\/\/pbacyber.com\/?p=294"},"modified":"2019-10-09T09:51:54","modified_gmt":"2019-10-09T13:51:54","slug":"new-nevada-privacy-law-requires-attention-of-businesses-and-websites-nationwide","status":"publish","type":"post","link":"https:\/\/pbacyber.com\/index.php\/2019\/10\/09\/new-nevada-privacy-law-requires-attention-of-businesses-and-websites-nationwide\/","title":{"rendered":"New Nevada Privacy Law Requires Attention of Businesses and Websites Nationwide"},"content":{"rendered":"<p>By <span style=\"display: inline !important; float: none; background-color: transparent; color: #333333; cursor: text; font-family: Georgia,'Times New Roman','Bitstream Charter',Times,serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;\"><a href=\"https:\/\/www.mcneeslaw.com\/people\/devin-j-chwastyk\/\" target=\"_blank\" rel=\"noopener noreferrer\">Devin Chwastyk<\/a>, McNees Wallace &amp; Nurick LLC<\/span><\/p>\n<p>&nbsp;<\/p>\n<p>While the California Consumer Privacy Act (effective Jan. 1, 2020) has been getting the lion\u2019s share of attention, Nevada\u2019s Senate Bill No. 220 (SB 220) already went into effect on Oct. 1, 2019.\u00a0 SB 220 gives Nevada citizens the right to opt out of the sale of their personal information by online businesses.<\/p>\n<p>&nbsp;<\/p>\n<p><strong><u>Overview of the Law<\/u><\/strong><\/p>\n<p>SB 220 requires \u201cwebsite operators\u201d to provide to consumers an email address through which consumers can demand to opt-out of any sale of their personal information.\u00a0 More specific details of SB 220, as well as general considerations for compliance are provided below.<\/p>\n<p>&nbsp;<\/p>\n<p><strong><u>Who does the law apply to?<\/u><\/strong><\/p>\n<p>SB 220 applies to any entity that has an online presence, including most businesses and retailers and all other website \u201coperators.\u201d\u00a0 The law defines an \u201coperator\u201d as a person or business entity that:<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>owns or operates an Internet website or online service for commercial purposes;<\/li>\n<li>collects and maintains covered information from consumers who reside in Nevada and use or visit the Internet website or online service; and,\n<ul>\n<li>purposefully directs its activities towards Nevada;<\/li>\n<li>consummates some transaction with Nevada, or a resident thereof;<\/li>\n<li>purposefully avails itself of the privilege of conducting activities in Nevada; or,<\/li>\n<li>otherwise engages in any activity that constitutes sufficient nexus with Nevada to satisfy the requirements of the United States Constitution.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>SB 220 is intended to have as broad a jurisdictional reach as possible.<\/p>\n<p>&nbsp;<\/p>\n<p>More concisely, an operator is anyone with a commercial website that serves customers or viewers in Nevada and collects personal information from those customers or viewers.\u00a0 The few very specific exceptions to the definition of an operator are (a) third party digital service providers and data processors operating on behalf of the website owner; (b) financial entities subject to the Gramm-Leach-Bliley Act; (c) entities subject to HIPAA; and (d) certain motor vehicle manufacturers or persons who repair or service motor vehicles.<\/p>\n<p>&nbsp;<\/p>\n<p>Businesses that must be especially attentive to the new law include: e-commerce websites marketing or selling to Nevada residents; any business with employees, locations, or a physical presence in Nevada; and any business that <em>could<\/em> fit under either of those two umbrellas <em>in the future<\/em> (because the law also applies to information that may be collected in the future).<\/p>\n<p>&nbsp;<\/p>\n<p>SB 220 will have the most significant impact on websites whose business model is based around gathering user data, monetization and sale of that data, and advertising.\u00a0 The \u201csale\u201d of data is defined as \u201cthe exchange of covered information for <em>monetary consideration<\/em> by the operator to a person for the person to license or sell the covered information to additional persons.\u201d<\/p>\n<p>&nbsp;<\/p>\n<p>The fact that SB 220 only refers to the exchange of covered information for monetary consideration \u2013 <em>i.e.<\/em> data in exchange for money \u2013 is notable.\u00a0 It also specifies several types of transactions which are <em>not<\/em> included in the definition of sale:<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>\u201cThe disclosure of covered information (discussed in the next section below) by an operator to a person who processes the covered information on behalf of the operator;<\/li>\n<li>The disclosure of covered information by an operator to a person with whom the consumer has a direct relationship for the purposes of providing a product or service requested by the consumer;<\/li>\n<li>The disclosure of covered information by an operator to a person for purposes which are consistent with the reasonable expectations of a consumer considering the context in which the consumer provided the covered information to the operator;<\/li>\n<li>The disclosure of covered information to a person who is an affiliate, as defined in NRS 686A.620, of the operator; or<\/li>\n<li>The disclosure or transfer of covered information to a person as an asset that is part of a merger, acquisition, bankruptcy or other transaction in which the person assumes control of all or part of the assets of the operator.\u201d<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Nothing in the law prohibits businesses and websites from using the data they collect for their own advertising purposes.<\/p>\n<p>&nbsp;<\/p>\n<p><strong><u>The Data<\/u><\/strong><\/p>\n<p>The \u201ccovered information\u201d to which SB 220 applies includes first and last name, physical address, email address, telephone number, and social security number.\u00a0 However, it also includes \u201can identifier that allows a specific person to be contacted either physically or online,\u201d as well as \u201cany other information concerning a person collected from the person through the Internet website or online service of the operator and maintained by the operator in combination with an identifier in a form that makes the information personally identifiable.\u201d<\/p>\n<p>&nbsp;<\/p>\n<p>That last item in the definition of \u201ccovered information\u201d is the most expansive and open to interpretation.\u00a0 Arguably, data such as location history, device identifiers like IP and MAC addresses, and usernames all fall within that umbrella.\u00a0 As new technologies and new forms of data continue to emerge, operators should err on the side of caution and assume that those new data types will fall within this broad definition of \u201ccovered information.\u201d<\/p>\n<p>&nbsp;<\/p>\n<p><strong><u>The Designated Request Address \u2013 Steps Operators Must Take to Comply<\/u><\/strong><\/p>\n<p>Operators will be required to implement a \u201cdesignated request address\u201d which allows a consumer to \u201cdirect the operator not to make any sale of any covered information the operator has collected or will collect about the consumer.\u201d\u00a0 The Nevada legislature specified that the designated request address must take the form of either an electronic mail address, a toll-free number, or an internet website.<\/p>\n<p>&nbsp;<\/p>\n<p>Establishing either an email address or a toll-free number is the quickest and cheapest way to begin receiving requests by consumers.\u00a0 An email inbox would allow consumers to send their request, verified by their email address, and have it automatically received and stored by the website operator.\u00a0 The website operator could then send an automated reply to the consumer, acknowledging that his request has been received.\u00a0 Note:\u00a0 SB 220 requires that the operator be able to \u201creasonably verify the authenticity of the request and the identity of the consumer using commercially reasonable means,\u201d and also requires the operator to respond to the request within 60 days.\u00a0 A toll-free number system could work similarly to an automated email inbox.\u00a0 Consumers could call the number, be verified by their Caller ID, and leave a voice message requesting to not have their data be sold by the operator.\u00a0 The challenge with both the email address and toll-free number approach is that it would require additional integration or human action to mark those consumers\u2019 records as not eligible for resale.<\/p>\n<p>&nbsp;<\/p>\n<p>The better option for long-term compliance is an electronic form on the operator\u2019s website.\u00a0 Such a form would allow the consumer to input the information necessary to verify his identity, such as email address or username, and submit the request by simply clicking a button.\u00a0 The website could automatically update the operator\u2019s database to exclude the consumer\u2019s data from any future sales, and generate a response email to the consumer at the same time.\u00a0 The initial implementation costs of the web-based request form will likely be higher than that of an email address or toll-free number, but the long-term cost savings resulting from automation will outweigh the upfront investment.<\/p>\n<p>&nbsp;<\/p>\n<p><strong><u>Enforcement of the Law<\/u><\/strong><\/p>\n<p>SB 220 gives consumers the right to opt out of having their personal information sold, but it does not give consumers a way to enforce that right.\u00a0 The language explicitly does not grant a private cause of action against operators.\u00a0 Instead, the ability to enforce the law is uniquely vested with Nevada\u2019s attorney general.\u00a0 The attorney general will have the power to \u201cinstitute an appropriate legal proceeding\u201d against the operator if the attorney general has reason to believe that an operator, either directly or indirectly, has violated the statute.<\/p>\n<p>&nbsp;<\/p>\n<p>A violation would occur when an operator purposely or knowingly ignores a consumer\u2019s request to opt out of having his data sold, and sells that data anyway.\u00a0 Additionally, an operator would commit a violation by intentionally or unintentionally failing to process the consumer\u2019s request, or by failing to respond to the request.<\/p>\n<p>&nbsp;<\/p>\n<p>The legal action which the attorney general may take against an operator is within the attorney general\u2019s discretion.\u00a0 For example, it could be a lawsuit in court, or it could take the form of an assurance of voluntary compliance.\u00a0 Should the attorney general file a lawsuit, the court is empowered to issue a temporary or permanent injunction against the operator, impose fines of up to $5,000 per violation, or invoke any other remedy provided by law.<\/p>\n<p>&nbsp;<\/p>\n<p><strong><u>Conclusion<\/u><\/strong><\/p>\n<p>It is important to note that SB 220 does not prohibit operators from selling user data, rather it provides consumers with a way to affirmatively opt out of having their information sold by a particular operator.\u00a0 Additionally, it does not prohibit operators from gathering data from visitors to their websites and using that data for their own individual advertising purposes.\u00a0 SB 220 will require operators to make an initial capital investment to comply, but operators will be better off making that investment sooner rather than later.\u00a0 Finally, consumers have no way to enforce the terms of SB 220 on their own; the best they can do is file a complaint with the Nevada attorney general and wait for the government to act.\u00a0 With the lack of cohesive federal legislation, website operators and businesses in general should expect the states to enact more laws like SB 220 in the near future.<\/p>\n<p>&nbsp;<\/p>\n<hr \/>\n<p><em>Devin Chwastyk is the chair of the Privacy &amp; Data Security Group at McNees Wallace &amp; Nurick LLC. Christian Wolgemuth, a 2019 fall clerk at the firm, assisted substantially in the research and writing of this article.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>By Devin Chwastyk, McNees Wallace &amp; Nurick LLC &nbsp; While the California Consumer Privacy Act (effective Jan. 1, 2020) has been getting the lion\u2019s share of attention, Nevada\u2019s Senate Bill No. 220 (SB 220) already went into effect on Oct. 1, 2019.\u00a0 SB 220 gives Nevada citizens the right to opt out of the sale <br \/><a class=\"read-more-button\" href=\"https:\/\/pbacyber.com\/index.php\/2019\/10\/09\/new-nevada-privacy-law-requires-attention-of-businesses-and-websites-nationwide\/\">Read More &raquo;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[23,11],"tags":[],"_links":{"self":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/294"}],"collection":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/comments?post=294"}],"version-history":[{"count":5,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/294\/revisions"}],"predecessor-version":[{"id":300,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/294\/revisions\/300"}],"wp:attachment":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/media?parent=294"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/categories?post=294"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/tags?post=294"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}