Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Nevada recentl<img class="alignright wp-image-3935 size-medium" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2015/05/Data-Breach_GettyImages_515745835-300x214.jpg" alt="" width="300" height="214" />y became the latest state to pass a law requiring operators of websites and online services to post a public notice regarding their privacy practices. <a href="https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=8.&amp;chapter=22.&amp;lawCode=BPC">California</a> was the first state to pass such a law in 2004, and <a href="http://delcode.delaware.gov/title6/c012c/index.shtml">Delaware</a> enacted a similar law effective January 1, 2016.  Similar to its predecessors, the new <a href="https://www.leg.state.nv.us/Session/79th2017/Bills/SB/SB538_EN.pdf">Nevada legislation</a> specifies that the posted notice must:
<ul>
 	<li>Identify the categories of personally identifiable information (PII) collected through the site;</li>
 	<li>Identify the categories of third parties with whom such PII may be shared;</li>
 	<li>Disclose whether third parties may collect information about a consumer’s online activities over time and across different websites when the consumer uses the site;</li>
 	<li>Provide information about the process for reviewing and requesting changes to PII collected through the site; and</li>
 	<li>List an effective date.</li>
</ul>
The Nevada law also does not include a private right of action, but operators who fail to comply within 30 days following notification of noncompliance may face civil enforcement by the Nevada attorney general.

Although the laws are substantially similar in many respects, the new Nevada law contains some noteworthy differences.
<ul>
 	<li>Nevada’s law does not require an operator to disclose how it responds to web browser “do not track” signals.</li>
 	<li>The Nevada statute includes an explicit jurisdictional element in its definition of “operator.” The statute does not apply to entities unless they purposefully direct activities toward Nevada, consummate some transaction with the state or a resident, or purposefully avail themselves of the privilege of conducting activities in Nevada.</li>
 	<li>Nevada’s law excludes operators located in the state whose revenue is primarily derived from sources other than online services and whose website receives fewer than 20,000 unique visitors per year.</li>
 	<li>Nevada’s law specifically provides for injunctive relief and a civil penalty “not to exceed $5,000 for each violation.”</li>
</ul>
Nevada’s law does not include disclosure obligations like those found in California’s “<a href="https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.83.&amp;lawCode=CIV">Shine the Light</a>” law, which requires operators to either respond to customer requests for information about how they share personal information with third parties for those parties’ own marketing purposes, or to provide an opt-out with respect to such sharing. Nor does Nevada’s law contain specific prohibitions on online marketing to children, as in the Delaware law and in California’s “<a href="https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201320140SB568">Privacy Rights for California Minors in the Digital World</a>”, which further requires operators to remove content posted by a minor on the site, upon the minor’s request.

According to the <a href="https://www.leg.state.nv.us/Session/79th2017/Reports/history.cfm?BillName=SB538">Nevada Legislature's website</a> the law comes into effect October 1, 2017.

<u>Illinois ‘Right to Know’ Bill Carried Over</u>

Illinois’ proposed “<a href="http://www.ilga.gov/legislation/BillStatus.asp?DocNum=1502&amp;GAID=14&amp;DocTypeID=SB&amp;LegId=104068&amp;SessionID=91">Right to Know</a>” law passed the state Senate but failed to be approved by the House before the legislative session ended on May 31, 2017. The Illinois bill would have required website operators to post a notice listing the types of consumer information collected and would have provided a “Shine the Light”-style mechanism to allow consumers to find out what personal information of theirs has been shared with third-party marketers. The bill may be called again during the 2018 legislative session.

<u>Conclusion</u>

Companies that collect personal information via websites, mobile applications, connected devices and other online services should revisit their privacy notices and policies to ensure compliance with the ever-growing patchwork of state regulations governing what they must disclose about their practices. As an increasing number of states move to enact legislation imposing notice and opt-out requirements, consent obligations, and restrictions on data sharing, businesses are likely to face a complicated compliance landscape. We will continue to report on developments in this space as they occur.

&nbsp;

Nevada Enacts Online Privacy Policy Law; Illinois ‘Right to Know’ Bill Carried Over