Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-4363 size-medium" src="https://www.dataprivacymonitor.com/wp-content/uploads/sites/5/2015/12/data-privacy-iStock_000019536561_XXXLarge-300x225.jpg" alt="data privacy iStock_000019536561_XXXLarge" width="300" height="225" />

Since the beginning of 2015, <a href="https://www.dataprivacymonitor.com/data-breach-notification-laws/state-law-roundup-legislatures-across-the-u-s-revamp-data-breach-notification-laws/">numerous states</a> have amended their data breach notification statutes to include <a href="https://www.dataprivacymonitor.com/data-breach-notification-laws/wyoming-broadens-data-breach-notification-law/">expanded definitions</a> of personal information, clarifications on <a href="https://www.dataprivacymonitor.com/data-breach-notification-laws/tennessee-revamps-its-state-data-breach-notification-statute/">encryption</a> standards, and new notice <a href="https://www.dataprivacymonitor.com/data-breach-notification-laws/california-amends-its-breach-notification-statute/">content</a> and <a href="https://www.dataprivacymonitor.com/data-breach-notification-laws/tennessee-revamps-its-state-data-breach-notification-statute/">timing</a> requirements. On April 13, 2016, Nebraska joined this roster when Governor Pete Ricketts signed <a href="http://nebraskalegislature.gov/FloorDocs/Current/PDF/Intro/LB835.pdf">LB 835</a> into law, amending Nebraska’s Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006. The amendment becomes effective on July 20, 2016, and contains three key updates.

First, the new law states that personal information is not considered to be encrypted if the encryption key or process is reasonably believed to have been acquired during the breach. This change emphasizes the importance of effective encryption key management to ensure that encrypted data is protected in the event of a breach.

Next, and following a growing trend set by other recent state data breach law amendments, the amendment expands the statute’s definition of “personal information” to include an individual’s user name or email address, in combination with a password or security question and answer that would permit access to an online account.

Finally, the new law adds the requirement for a breached entity to notify the Nebraska Attorney General’s office no later than the time that notice is provided to affected Nebraska residents. Although many recent state amendments have set a certain threshold number of affected state residents before notification to a regulator is required, Nebraska’s update requires notification whenever an entity notifies any Nebraska resident or residents of a breach. Additionally, notification to the Nebraska Attorney General is required even if the entity maintains its own notice procedures or follows those established by its primary or functional state or federal regulator.

For assistance with tracking the continuing developments in state breach notification laws, please refer to BakerHostetler’s regularly updated <a href="http://www.bakerlaw.com/files/Uploads/Documents/Data%20Breach%20documents/State_Data_Breach_Statute_Form.pdf">state-by-state survey</a>.

Nebraska Amends Its Data Breach Notification Statute