LB746 LB746
2020 2020
LEGISLATURE OF NEBRASKA
ONE HUNDRED SIXTH LEGISLATURE
SECOND SESSION
LEGISLATIVE BILL 746
Introduced by Blood, 3.
Read first time January 08, 2020
Committee: Transportation and Telecommunications
1 A BILL FOR AN ACT relating to consumer protection; to adopt the Nebraska
2 Consumer Data Privacy Act.
3 Be it enacted by the people of the State of Nebraska,
-1-
LB746 LB746
2020 2020
1 Section 1. Sections 1 to 17 of this act shall be known and may be
2 cited as the Nebraska Consumer Data Privacy Act.
3 Sec. 2. The purpose of the Nebraska Consumer Data Privacy Act is to
4 enhance the protection of private online data.
5 Sec. 3. The Legislature hereby finds:
6 (1) That it is an important and substantial state interest to
7 protect private, personal data in Nebraska;
8 (2) That with the expanding use of technology and information in
9 everyday life, there is an increasing amount of personal information
10 being shared by consumers with businesses as a part of everyday
11 transactions and online and other activities;
12 (3) That the increasing collection, storage, use, and sale of
13 personal information creates increased risks of identity theft, financial
14 loss, and other misuse of personal information; and
15 (4) That many consumers do not know, understand, or have appropriate
16 authority over the distribution, use, sale, or disclosure of their
17 personal information.
18 Sec. 4. For purposes of the Nebraska Consumer Data Privacy Act:
19 (1) Business means:
20 (a) A sole proprietorship, partnership, limited liability company,
21 corporation, association, or other legal entity that:
22 (i) Is organized or operated for the profit or financial benefit of
23 its shareholders or other owners;
24 (ii) Collects consumers' personal information, or on the behalf of
25 which such information is collected and that alone, or jointly with
26 others, determines the purposes and means of the processing of consumers'
27 personal information;
28 (iii) Does business in Nebraska; and
29 (iv) Satisfies one or more of the following thresholds:
30 (A) Has annual gross revenue in excess of ten million dollars;
31 (B) Alone or in combination, annually buys, receives for the
-2-
LB746 LB746
2020 2020
1 business's commercial purposes, sells, or shares for commercial purposes,
2 the personal information of fifty thousand or more consumers, households,
3 or devices; or
4 (C) Derives fifty percent or more of its annual revenue from selling
5 consumers' personal information; or
6 (b) Any entity that controls or is controlled by a business as
7 defined in subdivision (1)(a) of this section and that shares common
8 branding with such business. For purposes of this subdivision, control or
9 controlled means (i) ownership of, or the power to vote, more than fifty
10 percent of the outstanding shares of any class of voting security of an
11 entity; (ii) control in any manner over the election of a majority of the
12 directors or of individuals exercising similar functions; or (iii) the
13 power to exercise a controlling influence over the management of an
14 entity;
15 (2) Common branding means a shared name, servicemark, or trademark;
16 (3) Consumer means an identified person who is a resident of this
17 state and acting only in an individual or household context. Consumer
18 does not mean a person acting in a commercial or employment context; and
19 (4)(a) Personal information means information that identifies,
20 relates to, describes, is capable of being associated with, or could
21 reasonably be linked, directly or indirectly, with a particular consumer
22 or household, including, but not limited to:
23 (i) Identifiers such as a real name, alias, postal address, unique
24 personal identifier, online identifier, Internet protocol address, email
25 address, account name, social security number, driver's license number,
26 passport number, or other similar identifiers;
27 (ii) Characteristics of protected classifications under state or
28 federal law;
29 (iii) Commercial information, including records of personal
30 property, products or services purchased, obtained, or considered, or
31 other purchasing or consuming histories or tendencies;
-3-
LB746 LB746
2020 2020
1 (iv) Biometric information such as fingerprints or facial
2 recognition information;
3 (v) Internet or other electronic network activity information,
4 including, but not limited to, browsing history, search history, and
5 information regarding a consumer's interaction with an Internet web site,
6 application, or advertisement;
7 (vi) Geolocation data;
8 (vii) Audio, electronic, visual, thermal, olfactory, or similar
9 information;
10 (viii) Professional or employment-related information;
11 (ix) Education information, defined as information that is not
12 publicly available personally identifiable information as defined in the
13 federal Family Educational Rights and Privacy Act of 1974, 20 U.S.C.
14 1232g, and 34 C.F.R. part 99, as such law and regulations existed on
15 January 1, 2020; or
16 (x) Inferences drawn from any of the information identified in
17 subdivision (4)(a) of this section to create a profile about a consumer
18 reflecting the consumer's preferences, characteristics, psychological
19 trends, predispositions, behavior, attitudes, intelligence, abilities,
20 and aptitudes.
21 (b) Personal information does not include publicly available
22 information. For purposes of this definition, publicly available means
23 information that is lawfully made available from federal, state, or local
24 government records, as restricted by any conditions associated with such
25 information. Publicly available does not mean biometric information
26 collected by a business about a consumer without the consumer's
27 knowledge. Personal information does not include consumer information
28 that is deidentified or aggregate consumer information.
29 Sec. 5. Consumers shall have the right to:
30 (1) Know what personal information is being collected about them;
31 (2) Know whether their personal information is sold or disclosed and
-4-
LB746 LB746
2020 2020
1 to whom;
2 (3) Decline or opt out of the sale of their personal information;
3 (4) Access their personal information that has been collected; and
4 (5) Equal services and prices, even if they exercise the rights
5 listed in this section.
6 Sec. 6. A consumer shall have the right to request that a business
7 that collects personal information about the consumer disclose to the
8 consumer the following:
9 (1) The categories of personal information it has collected about
10 that consumer;
11 (2) The categories of sources from which the personal information is
12 collected;
13 (3) The business or commercial purpose for collecting or selling
14 personal information;
15 (4) The categories of third parties with whom the business shares
16 personal information; and
17 (5) The specific pieces of personal information it has collected
18 about that consumer.
19 Sec. 7. A business that collects personal information about a
20 consumer shall disclose to the consumer the information specified in
21 section 6 of this act upon receipt of a verifiable request from the
22 consumer. A business shall not be required to (1) retain any personal
23 information about a consumer collected for a single one-time transaction
24 if, in the ordinary course of business, that information about the
25 consumer is not retained, or (2) reidentify or otherwise link any data
26 that, in the ordinary course of business, is not maintained in a manner
27 that would be considered personal information.
28 Sec. 8. (1) A consumer shall have the right to request that a
29 business that sells the consumer's personal information, or that
30 discloses it for a business purpose, disclose to that consumer:
31 (a) The categories of personal information that the business
-5-
LB746 LB746
2020 2020
1 collected about the consumer;
2 (b) The categories of personal information that the business sold
3 about the consumer and the categories of third parties to whom the
4 personal information was sold, by category or categories of personal
5 information for each third party to whom the personal information was
6 sold; and
7 (c) The categories of personal information that the business
8 disclosed about the consumer for a business purpose.
9 (2) A business that sells personal information about a consumer, or
10 that discloses a consumer's personal information for a business purpose,
11 shall disclose the information specified in subsection (1) of this
12 section to the consumer upon receipt of a verifiable request from the
13 consumer.
14 (3) A third party shall not sell personal information about a
15 consumer that has been sold to the third party by a business unless the
16 consumer has received explicit notice and is provided an opportunity to
17 exercise the right to opt out.
18 (4) A consumer shall have the right, at any time, to direct a
19 business that sells personal information about the consumer to third
20 parties not to sell the consumer's personal information. This right may
21 be referred to as the right to opt out.
22 (5) A business that sells consumers' personal information to third
23 parties shall provide notice to consumers that this information may be
24 sold and that consumers have the right to opt out of the sale of their
25 personal information.
26 (6) A business that has received direction from a consumer not to
27 sell the consumer's personal information or, in the case of a minor
28 consumer's personal information under subsection (7) of this section has
29 not received consent to sell the minor consumer's personal information,
30 shall be prohibited from selling the consumer's personal information
31 after its receipt of the consumer's direction, unless the consumer
-6-
LB746 LB746
2020 2020
1 subsequently provides express authorization for the sale of the
2 consumer's personal information.
3 (7) Notwithstanding subsections (4) and (6) of this section, a
4 business shall not sell the personal information of consumers if the
5 business has actual knowledge that the consumer is less than sixteen
6 years of age, unless the consumer, in the case of consumers between
7 thirteen and sixteen years of age, or the consumer's parent or guardian,
8 in the case of consumers who are less than thirteen years of age, has
9 affirmatively authorized the sale of the consumer's personal information.
10 A business that willfully disregards the consumer's age shall be deemed
11 to have had actual knowledge of the consumer's age. This right may be
12 referred to as the right to opt in.
13 Sec. 9. (1) A consumer shall have the right to request that a
14 business delete any personal information about the consumer which the
15 business has collected from the consumer.
16 (2) A business that collects personal information about consumers
17 shall disclose the consumer's rights to request the deletion of the
18 consumer's personal information.
19 (3) A business that receives a verifiable request from a consumer to
20 delete the consumer's personal information shall delete the consumer's
21 personal information from its records and direct any service providers to
22 delete the consumer's personal information from their records.
23 (4) A business or a service provider shall not be required to comply
24 with a consumer's request to delete the consumer's personal information
25 if it is necessary for the business or service provider to maintain the
26 consumer's personal information in order to:
27 (a)(i) Complete the transaction for which the personal information
28 was collected, (ii) provide a good or service requested by the consumer,
29 or reasonably anticipated within the context of a business's ongoing
30 business relationship with the consumer, or (iii) otherwise perform a
31 contract between the business and the consumer;
-7-
LB746 LB746
2020 2020
1 (b)(i) Detect security incidents, (ii) protect against malicious,
2 deceptive, fraudulent, or illegal activity, or (iii) prosecute those
3 responsible for that activity;
4 (c) Debug to identify and repair errors that impair existing
5 intended functionality;
6 (d) Exercise free speech, ensure the right of another consumer to
7 exercise his or her right of free speech, or exercise another right
8 provided for by law;
9 (e) Engage in public or peer-reviewed scientific, historical, or
10 statistical research in the public interest that adheres to all other
11 applicable ethics and privacy laws, when the business's deletion of the
12 information is likely to render impossible or seriously impair the
13 achievement of such research, if the consumer has provided informed
14 consent;
15 (f) To enable solely internal uses that are reasonably aligned with
16 the expectations of the consumer based on the consumer's relationship
17 with the business; or
18 (g) Comply with state or federal law.
19 Sec. 10. (1) A business shall not discriminate against a consumer
20 because the consumer exercised any of the consumer's rights under the
21 Nebraska Consumer Data Privacy Act, including, but not limited to, by:
22 (a) Denying goods or services to the consumer;
23 (b) Charging different prices or rates for goods or services,
24 including through the use of discounts or other benefits or imposing
25 penalties;
26 (c) Providing a different level or quality of goods or services to
27 the consumer; or
28 (d) Suggesting that the consumer will receive a different price or
29 rate for goods or services or a different level or quality of goods or
30 services.
31 (2) Nothing in this section prohibits a business from charging a
-8-
LB746 LB746
2020 2020
1 consumer a different price or rate, or from providing a different level
2 or quality of goods or services to the consumer, if that difference is
3 reasonably related to the value provided to the consumer by the
4 consumer's personal information.
5 Sec. 11. (1) In order to comply with disclosure and notice
6 requirements of the Nebraska Consumer Data Privacy Act, a business shall:
7 (a) In a form that is reasonably accessible to consumers, make
8 available to consumers two or more designated methods for submitting
9 requests for information required to be disclosed including, at a
10 minimum, a toll-free telephone number and, if the business maintains an
11 Internet