Nevada’s Internet Privacy Law imposes New Requirements on Websites

Nevada’s Internet Privacy Law imposes New Requirements on Websites

The Governor of Nevada signed the Senate Bill 220 into law on May 29, 2019 by amending the state’s existing online privacy law described under Nevada Revised Statute 603A.300, et. seq. The bill to be effective on October 1, 2019, adds new prohibitions to the definition of “operators”. The bill amends sub section (c) to NRS 603A.330 (1) defining an operator to be a person, who willingly engages in the activities towards the state, completes transaction with the State or a resident thereof, gains privileges by the conduction of some activities or otherwise engages in any activity that constitutes sufficient nexus with this State to satisfy the requirements of the United States Constitution. The definition does not apply to any third party who operates under the owner of website; any entity or financial institutions subject to the federal Gramm-Leach Bliley Act or the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”); any motor vehicle producer or person working under the company as repairer or providing services on behalf of the company and collecting, generating, recording, or storing covered information from a motor vehicle (1) correspondence with a technology or service related to the motor vehicle or (2) provided by a consumer in connection with a subscription or registration for a technology or service related to the motor vehicle.  [Amendment to NRS 603A.330 (2) (b), (c) and (d)].

Further, the Senate Bill 220 amends Chapter 603A of NRS by adding definitions such as designated request address, sale and verified request. Operators will now have to maintain record of each consumer by establishing an email address, toll-free telephone number, or an internet website. operator to Consumers shall ask the not leak their personal data. They can also submit a request to the operator to not make any sale of the covered information they have collected [NRS 603 A (1.3)]. With the infliction of this condition, Nevada has made a consumer’s right to opt-out of the sale of their covered information with operators.

The definitions like “covered information” and “sale” are narrowly defined under the Nevada law. The definition of “sale” also contains several exclusions, including disclosures of covered information by an operator to a person processing information on the operator’s behalf. [NRS 603A (1.6) (1)] The operator will provide a receipt to consumer for verification of request about the identification and authenticity of the consumer within 60 days. The operator is required to respond to the request and honor the consumer’s directive according to the time tables prescribed in the statute. Consumer stands for a person who seeks or acquires by purchase or lease, any good, service, money, or credit for personal, family, or household purposes from the internet website or online service of an operator [NRS 603A (2) (4)].

There are no changes made for the requirement of notice by operator to consumers of Nevada’s Revised Code § 603A.340. It should be available in a manner reasonably calculated to be accessible by consumers whose covered information the operator collects through its website or online service.