Bill > SB260

Introduced Session

Legislative Counsel's Digest: Existing law requires an operator of an Internet website which collects certain 1 items of personally identifiable information about consumers in this State to 2 establish a designated address through which a consumer may submit a verified 3 request directing the operator not to make any sale of covered information collected 4 about the consumer. An operator that receives such a request is prohibited from 5 making any sale of any covered information collected about the consumer. (NRS 6 603A.345) Section 3 of this bill imposes similar requirements upon a data broker, 7 which is generally defined in section 2 of this bill to mean a person primarily 8 engaged in the business of purchasing covered information about consumers in this 9 State from operators and other data brokers and making sales of such information. 10 Section 1.5 of this bill exempts certain persons and information from the 11 requirements imposed on operators, data brokers and covered information. Sections 12 4 and 5 of this bill make conforming changes to properly place the new language of 13 sections 1.5, 2 and 3 in the Nevada Revised Statutes. Sections 6 and 7 of this bill 14 revise certain definitions to reflect the requirements imposed on data brokers by 15 section 3. 16 Existing law authorizes the Attorney General to seek an injunction or a civil 17 penalty against an operator who violates the provisions of existing law requiring the 18 establishment of a designated request address and prohibiting the sale of covered 19 information about a consumer who has made a verified request. (NRS 603A.360) 20 Section 12 of this bill similarly authorizes the Attorney General to seek an 21 injunction or a civil penalty against a data broker who violates the provisions of 22 section 3. 23 Existing law defines operator to mean, in general, a person who: (1) owns or 24 operates an Internet website or online service for commercial purposes; (2) collects 25 certain information from consumers who reside in this State and use or visit the 26 Internet website or online service; and (3) has certain minimum contacts with this 27 State. (NRS 603A.330) Section 7.5 of this bill explicitly excludes from the 28 definition of operator a person who does not collect, maintain or sell covered 29 information. 30 Existing law defines sale for the purposes of the provisions of existing law 31 governing the sale of covered information by operators as the exchange of covered 32 information for monetary consideration by the operator to a person for the person to 33 license or sell the covered information to additional persons. (NRS 603A.333) 34 Section 8 of this bill revises that definition to define sale as the exchange of 35 covered information for monetary consideration by an operator or data broker to 36 another person. 37 Existing law requires an operator to make available to consumers a notice 38 containing certain information relating to the collection and sale of covered 39 information collected through its Internet website or online service. An operator 40 who fails to comply with that requirement is authorized to remedy the failure to 41 comply within 30 days after being informed of such a failure. (NRS 603A.340) 42 Sections 10 and 11 of this bill authorize an operator to remedy such a failure only 43 if it is the first failure of the operator to comply with the requirement. 44 SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS: Section 1. Chapter 603A of NRS is hereby amended by 1 adding thereto the provisions set forth as sections 1.5, 2 and 3 of this 2 act. 3 Sec. 1.5. The provisions of this section and NRS 603A.300 to 4 603A.360, inclusive, and sections 2 and 3 of this act do not apply 5 to: 6 1. A consumer reporting agency, as defined in NRS 7 686A.640, or any personally identifiable information collected, 8 maintained or sold by such any agency; 9 2. A person who collects, maintains or makes sales of 10 personally identifiable information for the purposes of fraud 11 prevention; 12 3. Any personally identifiable information that is publicly 13 available; or 14 4. Any personally identifiable information protected from 1 disclosure under the federal Driver s Privacy Protection Act of 2 1994, 18 U.S.C. 2721 et seq., which is collected, maintained or 3 sold in compliance with that Act. 4 Sec. 2. Data broker means a person primarily engaged in 5 the business of purchasing covered information about consumers 6 who reside in this State from operators or other data brokers and 7 making sales of such covered information. 8 Sec. 3. 1. Each data broker shall establish a designated 9 request address through which a consumer may submit a verified 10 request pursuant to this section. 11 2. A consumer may, at any time, submit a verified request 12 through a designated request address to a data broker directing 13 the data broker not to make any sale of any covered information 14 about the consumer that the data broker has purchased or will 15 purchase. 16 3. A data broker that has received a verified request 17 submitted by a consumer pursuant to subsection 2 shall not make 18 any sale of any covered information about that consumer that the 19 data broker has purchased or will purchase. 20 4. A data broker shall respond to a verified request submitted 21 by a consumer pursuant to subsection 2 within 60 days after 22 receipt thereof. A data broker may extend by not more than 30 23 days the period prescribed by this subsection if the data broker 24 determines that such an extension is reasonably necessary. A data 25 broker who extends the period prescribed by this subsection shall 26 notify the consumer of such an extension. 27

AI Summary

Committee Categories

Nicole Cannizzaro (D)*, 

Approved by the Governor. Chapter 292. (on 06/02/2021)

Official Document