Nebraska Legislature Passes Consumer Data Privacy Bill – An Overview
On April 11, 2024, the Nebraska Legislature unanimously passed the Nebraska Data Privacy Act (LB 1074). LB 1074 is an omnibus bill that establishes a range of new state laws, including a proposed comprehensive privacy statute.
This proposed privacy statute within LB 1074 is similar to Texas’s Data Privacy and Security Act, which includes specific coverage thresholds, explicit language for universal opt-out mechanisms and dark patterns, and a 30-day cure period. However, there are certain nuances in the Nebraska bill that differ from Texas’s law.
Applicability
The Nebraska bill uses the same applicability standards as Texas. If enacted, Nebraska’s proposed privacy law will apply to any entity that: (a) conducts business in Nebraska or produces a product or service consumed by Nebraska residents, (b) processes or engages in the sale of personal data and (c) is not a small business as determined under the federal Small Business Act. It should be noted that “processes” is a very broad term under the Nebraska bill, and most functions that can be performed on data are considered to be a type of “processing”.
In addition to small businesses, the bill provides other exemptions at the entity level, including exemptions for entities subject to the Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA) covered entities and business associates, nonprofits, and higher education institutions. Additionally, the bill contains other exemptions at the data level such as HIPAA protected health information, Family Educational Rights and Privacy Act (FERPA) data, and data subject to the GLBA.
Sensitive Data
Sensitive data is subject to more protections than general personal data. Nebraska and Texas effectively use the same definition for sensitive data, which includes, among other categories of information, genetic, biometric data, and precise geolocation data.
Universal Opt-out Mechanisms
The Nebraska bill follows Texas law in recognizing universal opt-out mechanisms. However, the proposed Nebraska statute would only require entities to recognize these mechanisms if the relevant entity is already obligated to recognize them to comply with another state’s law.
Privacy Policy
The Nebraska bill differs from Texas’s law in its disclosure requirements. The Nebraska bill does not set forth requirements that would obligate entities to make additional disclosures if they sell sensitive personal data or biometric data. This is unlike the Texas statute, which requires entities to include these kinds of disclosure in their privacy policy.
Enforcement
This bill is exclusively enforceable by the Nebraska Attorney General, with no private right to action available. The bill also contains a 30-day right-to-cure period.
The Nebraska bill has been passed by the state legislature and has been sent to Governor Jim Pillen’s desk for approval. If signed by the governor, the Nebraska bill will be enacted into law, and the privacy statute will take effect on January 1, 2025.
If LB 1074 is enacted, Nebraska will become the latest of many states that have enacted a comprehensive privacy law. As more states continue to enact data protection laws, more businesses may become subject to additional compliance requirements. Contact one of McGrath North’s privacy and compliance experts for all your questions relating to Nebraska’s Data Privacy Act and its latest status.
Related Attorneys
