Client Alert: Privacy law update: Nevada and Maine Pass Laws Restricting the Sale of Personal Information
Nevada’s SB 220
Last week Nevada amended its law that governs online privacy policy disclosures to now give Nevada residents the right to opt out of the sale of certain personal information. While the Nevada law provides a similar opt out right to that of the California Consumer Privacy Act (CCPA), the Nevada law is much narrower in scope. The Nevada law becomes effective on October 1, 2019, three months before the CCPA’s effective date of January 1, 2020.
Under Nevada’s new law, consumers will have the right to opt out of the sale of certain personal information. Unlike the CCPA, the Nevada law only applies to “consumer” information which is collected through a website or online service in connection with a consumer’s effort to purchase goods or services for personal, family, or household purposes. Personal information subject to the new opt out right, which the law refers to as “covered information,” is defined to only include certain enumerated categories of information (e.g., name, email, SSN, contact identifier).
As to what constitutes a “sale” of personal information, the Nevada law again is less broad than the CCPA. Under the Nevada law, a “sale” of personal information only occurs where there is an “exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons.” There are, however, several exceptions to the opt out right including when information is subject to HIPAA or GLBA.
To the extent a company is selling personal information, the Nevada law requires that it provide an email address, toll-free telephone number, or webpage to accept opt-out requests. Within 60 days of receiving a request, the company then must use “commercially reasonable means” to verify the authenticity of the request and the identity of the customer. Once the request is verified, the company is prohibited from selling the customer’s information.
Maine’s L.D. 946
On Thursday, Maine passed a strict, yet very narrow, law which prohibits internet service providers from selling personal information of customers physically located in Maine. Importantly, the law only applies to companies which provide broadband internet access. Unlike the CCPA and Nevada’s privacy law, which allow customers to “opt out” of the sale of their personal information, the Maine law requires customers to “opt-in” to the sale of their personal information. With the law’s passage, Maine becomes the only state to require customers to “opt-in” to the sale of their personal information, albeit in a limited context. The law becomes effective on July 1, 2020.
For questions on these laws, other privacy laws, data breach notification laws, or cybersecurity and incident response programs, please contact John Landolfi, Chris Ingram, Chris LaRocco, or your Vorys attorney.
