Consumer Data Privacy Law Updates

Nebraska Introduces Data Privacy Act

The Nebraska Unicameral is currently reviewing a consumer data privacy law that would provide Nebraska residents with certain rights related to their personal data.  Last month, Sen. Eliot Bostar introduced LB1294, known as the Data Privacy Act (the “Act”), which, if passed, would be Nebraska’s first comprehensive consumer data privacy law. 

The Act would apply to any business that:

• conducts business in Nebraska or produces a product or service consumed by Nebraska residents;
• processes or engages in the sale of personal data; and
• is not a small business as determined under the federal Small Business Act.

The scope of the Act is similar to the Texas Data Privacy and Security Act, in that there are no specific thresholds based on annual revenue or volume of personal data processed.  

The bill includes many of the same consumer rights that are present in the other enacted state data privacy laws, including the rights of deletion and correction, the right to opt out of processing of personal data for the purposes of targeted advertising, sale of personal data, or profiling in furtherance of a decision that produces a legal or similarly significant effect.

If passed, the bill would require controllers of personal data to:

• respond to consumer rights requests within 45 days;
• establish two or more secure and reliable methods to enable consumers to submit a request to exercise consumer rights;
• not discriminate against a consumer for exercising any of the consumer rights;
• conduct data protection assessments for certain processing activities;  and
• process the sensitive data of a consumer only after obtaining consent.

The bill would grant the Nebraska Attorney General exclusive enforcement rights and, as currently drafted, does not provide for a private right of action. 

The Data Privacy Act was referred to the Banking, Commerce and Insurance Committee and a hearing was held on January 30th.  As of the date of publication of this article, no action has been taken on the bill since the hearing.

CCPA Enforcement

Earlier this month, the California Court of Appeals overturned a lower court order that postponed enforcement of the California Consumer Privacy Act (“CCPA”) regulations. This ruling restores authority of the California Privacy Protection Agency and the California Attorney General to enforce the latest CCPA regulations.

The last year has seen a considerable amount of enforcement of the CCPA, and with this most recent ruling, businesses subject to the California law will want to review their existing data privacy program to ensure full CCPA compliance as soon as possible.