US State Nebraska Passes Consumer Data Privacy Bill

The Nebraska Legislature unanimously passed the Nebraska Data Privacy Act (NEDPA), which is now awaiting Governor Jim Pillen's signature. If signed into law, NEDPA will come into effect on January 1, 2025, positioning Nebraska as either the sixteenth or seventeenth U.S. state to enact comprehensive data privacy legislation. Nebraska is located in the Midwestern region of the United States.

NEDPA grants consumers various rights concerning their personal data, including the right to access, correct, and delete their data. Consumers also have the right to opt-out of targeted advertising and the sale of their personal data.

NEDPA applies to companies conducting business in Nebraska or providing products or services to Nebraska residents. It specifically targets entities engaged in processing or selling personal data. Small businesses, as defined by the federal Small Business Act, are exempted from certain provisions.

Consumer

A "consumer" is defined as a resident of Nebraska who is acting in an individual or household context. It expressly excludes individuals acting in a commercial or employment context.

Controller

"Controller" is an entity or individual that determines the purposes and means of processing personal data. Essentially, the controller has primary responsibility for determining how and why personal data is processed. This can include deciding what types of data to collect, how it will be used, and who will have access to it.

Consumer Rights

1. Right to Confirmation and Access: Consumers have the right to confirm whether a controller is processing their personal data and to access that data if it is being processed.

2. Right to Correction: Consumers can correct inaccuracies in their personal data, taking into consideration the nature of the data and the purposes for which it is processed.

3. Right to Deletion: Consumers have the right to require the controller to delete personal data provided by or obtained about them.

4. Right to Data Portability: When data processing is conducted through automated means and the data is available in a digital format, consumers have the right to obtain a copy of their personal data.

5. Opt-Out Rights: Consumers have the right to opt-out of certain activities, including targeted advertising, the sale of their personal data, and profiling that produces a legal or similarly significant effect concerning them.

6. Right to Appeal: If a consumer's rights request is denied, they have the right to appeal the decision. The controller must provide instructions on how to appeal, and the appeal decision must be made within a specified timeframe.

Exemption

Under the act, certain entities are exempt from certain provisions of the law.

1. State Agencies or Political Subdivisions of Nebraska: Government agencies at the state or local level are exempt from certain requirements of NEDPA.

2. Financial Institutions or Affiliates Subject to the Gramm-Leach-Bliley Act (GLBA): Entities regulated under the GLBA, which includes many financial institutions, are exempt from certain provisions of NEDPA.

3. Covered Entities or Business Associates Regulated under the Health Insurance Portability and Accountability Act (HIPAA): Entities subject to HIPAA regulations, such as healthcare providers and health insurance companies, are exempt from certain requirements of NEDPA.

4. Nonprofit Organizations

5. Colleges or Universities

6. Electricity and Natural Gas Public Utilities