New Nevada Internet Privacy Requirements Now in Effect

The State of Nevada recently enacted legislation that requires Internet operators to provide consumers with privacy notices about personal information they collect about consumers who live within the state.  The measure was passed in early May 2017, but it has since been non-materially amended by the state legislature.  The law went into effect on October 1, 2017.

The legislation requires Internet operators to provide a notice to consumers concerning any “covered information” about consumers who visit their websites or online services that they may store for internal use or share with third parties.  The legislation broadly defines “Internet operators” to include any entity which: (1) owns or operates an Internet website or online service for commercial purposes; (2) collects covered information from consumers who reside in Nevada and use or visit the website or service; and (3) has minimum contacts with the State.  “Covered information” is defined to include personal data that might be used to identify a particular consumer—such as name, email, address, phone number, social security number, or other physical and digital identifiers.

In its notice to consumers, an Internet operator must: (1) identify the types of covered information that it collects about consumers, as well as the categories of third parties with whom the operator shares the information; (2) describe the process by which an individual consumer may review and request changes to his or her covered information, if such a process exists; (3) explain how the operator will notify consumers of material changes to this notice; (4) disclose whether a third party may collect covered information about a consumer’s online activity over time and across various websites or online services when the consumer uses the operator’s site or service; and (5) state the effective date of the notice. Excluded from the notice requirements are small businesses located in Nevada whose revenue is derived primarily from the non-Internet sale of goods, services, or credit.

The Nevada Attorney General may institute a legal proceeding against operators that he or she has reason to believe have either directly or indirectly violated the notice requirement.  A violation is punishable by a temporary or permanent injunction or a civil penalty, not to exceed $5,000 for each violation.

The legislation is Nevada Senate Bill No. 538, and it can be accessed here.