Discover the intricacies of the Nebraska Data Privacy Act (NDPA) and how it affects businesses and residents. Learn about its applicability, obligations, consumer rights, and enforcement, ensuring compliance with LB 1074.
The Nebraska Data Privacy Act, also known as LB 1074, is the state's comprehensive consumer data privacy bill. This law makes it the seventeenth state to pass data privacy protection legislation.
Explore more privacy compliance insights and best practices
The Nebraska Data Privacy Act (NDPA) is a comprehensive Nebraska data privacy and security law that provides data protection for Nebraska residents. It allows them to protect their privacy and, at the same time, imposes some obligations on businesses to minimize privacy risks.
The Nebraska legislature passed it, and it will take effect on January 1, 2025.
The applicability thresholds make this law resemble the Texas Data Privacy and Security Act. The NDPA applies to all businesses:
It exempts businesses governed by sector-specific data protection laws like the FRPA, HIPAA, GLBA, and others, just like many other state privacy laws do.
Any information that could, directly or indirectly, identify an individual. That includes obvious information such as names, phone numbers, Social Security numbers, or email addresses.
It also includes data that could identify you indirectly, such as health data, an IP address, or browsing behavior.
This data protection act recognizes sensitive personal information, too. The definition of sensitive data includes:
Sensitive data has a special regime under the law. It triggers a duty to collect consent for processing and conducting data protection assessments.
Covered entities are required to:
The following consumer rights apply to residents of Nebraska:
Consumers can submit requests to exercise their rights to businesses using the designated means. Businesses must respond to the requests within 45 days, or no more than 90 days for complex requests.
Yes, you must present consumers with a privacy policy, also known as a privacy notice, before collecting their personal data.
The NDPA prescribes what each privacy policy must contain:
Keep in mind that your privacy policy must be up-to-date. If you display an inaccurate privacy notice to consumers, you must process their data in accordance with its contents.
Although the NDPA relies on the opt-out principle and, in general, does not require consent, there is one exception: the processing of sensitive data.
To process any category of sensitive personal information, you must obtain explicit consent specific to that piece of information. Without consent, the processing would be unlawful.
You must obtain parental consent before processing the data about a known child.
Consumers have the right to opt out of certain types of personal data processing. This includes:
Businesses must comply with the data subject's requests to opt-out. Moreover, they must comply with the signals sent by universal opt-out mechanisms.
If you conduct business in Nebraska and engage in any of the following activities, you must perform a data protection assessment.
The assessment's purpose is to assess the processing risks and identify mitigation measures.
The Nebraska Attorney General is competent to enforce the NDPA. They will give the business in violation a 30-day cure period. If the business fails to cure the violation, a penalty of up to USD 7,500 per violation will be imposed.
There is no private right of action available to consumers.
