On January 17, 2024, Legislative Bill 1294 to adopt the Data Privacy Act (the bill) was referred to the Banking, Commerce and Insurance Committee after being introduced on January 16, 2024, in the Nebraska State Legislature. 

What is the scope of the bill?

The bill would apply only to a person who:

• conducts business in Nebraska or produces a product or service consumed by residents of Nebraska;
• processes or engages in the sale of personal data; and
• is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024, except to the extent that Section 18 of the bill applies to a person described by this subdivision.

The bill further exempts certain entities and data from its scope. 

What are the main provisions of the bill?

The bill defines 'biometric data,' 'consent,' 'child,' 'controller,' 'dark patterns,' 'publicly available information,' 'pseudonymous data,' 'targetted advertisement,' 'precise geolocation,' and 'sale of personal data.' The bill outlines consumer rights including the right to deletion and correction, as well as the right to opt out of processing of personal data for the purposes of targeted advertising, sale of personal data, or profiling in furtherance of a decision that produces a legal or similarly significant effect. 

Controller and processor obligations

The controller would be:

• required to respond to consumer rights requests within 45 days;
• establish two or more secure and reliable methods to enable a consumer to submit a request to exercise consumer rights. The methods shall take into account the ways in which consumers normally interact with the controller, the necessity for secure and reliable communications of those requests, and the ability of the controller to authenticate the identity of the consumer making the request;
• prohibited from discriminating against a consumer for exercising any of the consumer rights, including by denying a good or service, charging a different price or rate for a good or service, or providing a different level of quality of a good or service to the consumer;
• required to conduct Data Protection Assessments (DPAs) for processing activities provided in the bill; and
• restricted from processing the sensitive data of a consumer without obtaining consent, or, in the case of processing the sensitive data of a known child, without processing in accordance with the Children's Online Privacy Protection Act of 1998 (COPPA), as such act existed on January 1, 2024.

The bill also provides for the obligations of processors and would require a contract between a controller and a processor to govern the processing activities of the processor. 

The bill would authorize the Attorney General of Nebraska to enforce the bill exclusively but does not provide for a private right of action. 

You can read the bill here and track its progress here.