Nevada Privacy Law (NPL) - Senate Bill 220

Senate  Bill  No.  220

AN ACT relating to Internet privacy; prohibiting an operator of an Internet  website  or  online  service  which  collects  certain information from consumers in this State from making any sale of certain information about a consumer if so directed by the consumer; and providing other matters properly relating thereto. 

THE PEOPLE OF THE STATE OF NEVADA, REPRESENTED IN SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:

Section  1.   

Chapter  603A  of  NRS  is  hereby  amended  by adding thereto the provisions set forth as sections 1.3 to 2, inclusive, of this act. 

Sec.  1.3.

Designated request address” means an electronic mail  address,  toll-free  telephone  number  or  Internet  website established by an operator through which a consumer may submit to an operator a verified request. 

Sec.  1.6.

1.   “Sale”  means  the  exchange  of  covered information  for  monetary  consideration  by  the  operator  to  a person for the person to license or sell the covered information to additional persons. 
2.   The term does not include:
a.) The disclosure of covered information by an operator to a person who processes the covered information on behalf of the operator;
b.) The disclosure of covered information by an operator to a person with whom the consumer has a direct relationship for the purposes  of  providing  a  product  or  service  requested  by  the consumer; 
c.) The disclosure of covered information by an operator to a person  for  purposes  which  are  consistent  with  the  reasonable expectations of a consumer considering the context in which the consumer provided the covered information to the operator; 
d) The disclosure of covered information to a person who is an affiliate, as defined in NRS 686A.620, of the operator; or e) The  disclosure  or  transfer  of  covered  information  to  a person as an asset that is part of a merger, acquisition, bankruptcy or other transaction in which the person assumes control of all or part of the assets of the operator.  

Sec.  1.8.  

“Verified request” means a request: 
1. Submitted by a consumer to an operator for the purposes set forth in section 2 of this act; and  
2. For  which  an  operator  can  reasonably  verify  the authenticity of the request and the identity of the consumer using commercially reasonable means. 

Section 2.  

1.   Each  operator  shall  establish  a  designated request address through which a consumer may submit a verified request pursuant to this section. 
2. A consumer may, at any time, submit a verified request through a designated request address to an operator directing the operator  not  to  make  any  sale  of  any  covered  information  the operator has collected or will collect about the consumer. 
3. An operator that has received a verified request submitted by a consumer pursuant to subsection 2 shall not make any sale of any covered information the operator has collected or will collect about that consumer. 
4. An operator shall respond to a verified request submitted by  a  consumer  pursuant  to  subsection  2  within  60  days  after receipt thereof. An operator may extend by not more than 30 days the period prescribed by this subsection if the operator determines that such an extension is reasonably necessary. An operator who extends the period prescribed by this subsection shall notify the consumer of such an extension. 

Section 3.

(Deleted by amendment.)

Section 4.  

NRS 603A.100 is hereby amended to read as follows: 

603A.100  

1.   The provisions of NRS 603A.010 to 603A.290, inclusive,  do  not  apply  to  the  maintenance  or  transmittal  of information in accordance with NRS 439.581 to 439.595, inclusive, and the regulations adopted pursuant thereto. 
2. A data collector who is also an operator, as defined in NRS 603A.330, shall comply with the provisions of NRS 603A.300 to 603A.360, inclusive ~~[.]~~ , and sections 1.3 to 2, inclusive, of this act.  
3. Any  waiver  of  the  provisions  of  NRS  603A.010  to 603A.290,  inclusive,  is  contrary  to  public  policy,  void  and unenforceable.

Section 5.  

NRS 603A.300 is hereby amended to read as follows:

603A.300

As used in NRS 603A.300 to 603A.360, inclusive, and  sections  1.3  to  2,  inclusive,  of  this  act,  unless  the  context otherwise requires, the words and terms defined in NRS 603A.310, 603A.320 and 603A.330 and sections 1.3, 1.6 and 1.8 of this act have the meanings ascribed to them in those sections.

Section 6.  

NRS 603A.330 is hereby amended to read as follows:

603A.330  

1.   “Operator” means a person who: 
a.) Owns or operates an Internet website or online service for commercial purposes; 
b.) Collects and maintains covered information from consumers who  reside in  this  State  and  use  or  visit  the  Internet  website  or online service; and 
c.) Purposefully  directs  its  activities  toward  this  State, consummates some transaction with this State or a resident thereof, purposefully  avails  itself  of  the  privilege  of  conducting activities in this State or otherwise engages in any activity that constitutes  sufficient  nexus  with  this  State  to  satisfy  the requirements of the United States Constitution. 

2.   The term does not include :  
    a. A  third  party  that  operates,  hosts  or  manages  an  Internet website  or  online  service  on  behalf  of  its  owner  or  processes information on behalf of the owner of an Internet website or online service; 
     b. A  financial  institution  or  an  affiliate  of  a  financial institution that is subject to the provisions of the Gramm-Leach- Bliley Act, 15 U.S.C. §§ 6801 et seq., and the regulations adopted pursuant thereto; 
     c. An  entity that is  subject  to  the  provisions  of the  Health Insurance Portability and Accountability Act of 1996, Public Law 104-191,  as  amended,  and  the  regulations  adopted  pursuant thereto; or 
     d. A manufacturer of a motor vehicle or a person who repairs or  services  a  motor  vehicle  who  collects,  generates,  records  or stores covered information that is:     
     1. Retrieved  from  a  motor  vehicle  in  connection  with  a technology or service related to the motor vehicle; or 
     2. Provided  by  a  consumer  in  connection  with  a subscription or registration for a technology or service related to the motor vehicle.

Section  7. 

NRS 603A.360 is hereby amended to read as follows:

603A.360  

1.   The  Attorney  General  shall  enforce  the provisions  of  NRS  603A.300  to  603A.360,  inclusive    ,  and sections 1.3 to 2, inclusive, of this act.  

2. If  the  Attorney  General  has  reason  to  believe  that  an operator, either directly or indirectly, has violated or is violating NRS 603A.340 or section 2 of this act, the Attorney General may institute an appropriate legal proceeding against the operator. The district court, upon a showing that the operator, either directly or  indirectly,  has  violated  or  is  violating  NRS  603A.340  or section 2 of this act, may: 
    a.) Issue a temporary or permanent injunction; or 
    b.) Impose  a  civil  penalty  not  to  exceed  $5,000  for  each violation. 

3. The provisions of NRS 603A.300 to 603A.360, inclusive, and sections 1.3 to 2, inclusive, of this act do not establish a private right of action against an operator. 
4. The provisions of NRS 603A.300 to 603A.360, inclusive, and sections 1.3 to 2, inclusive, of this act are not exclusive and are in addition to any other remedies provided by law. 

**2019**