Nebraska Data Privacy Act: Key Components and Implications for Businesses

Nebraska Governor Jim Pillen signed into law the Nebraska Data Privacy Act as part of omnibus Legislative Bill 1074 on 17 April, 2024, making Nebraska the seventeenth state to adopt comprehensive data privacy legislation. This landmark legislation will take effect on 1 January, 2025, and marks Nebraska as the fourth state to enact a data privacy law in 2024 alone.

The Nebraska Data Privacy Act applies to businesses operating in Nebraska or providing products or services to Nebraska residents that process or sell personal data. The law does not have a revenue threshold or minimum number of consumers for its application, making it more inclusive of a wide range of businesses. However, certain entities such as government agencies, financial institutions regulated by federal laws, and nonprofit organizations are exempt from the law.

Consumers in Nebraska will have rights to access, correct, delete, and obtain a copy of their personal data under the Nebraska Data Privacy Act. They also have the right to opt out of targeted advertising, the sale of their data, or profiling that could impact them significantly. Controllers must respond to consumer requests within 45 days and provide a clear process for consumers to appeal decisions to the Nebraska Attorney General.

Controllers and processors are required to limit data collection, implement data security practices, and obtain consent before processing sensitive data under the act. Processors must assist controllers in complying with the law and adhere to data processing instructions outlined in contracts between the parties.

Enforcement of the Nebraska Data Privacy Act falls under the exclusive authority of the Nebraska Office of the Attorney General, with penalties of up to $7,500 per violation. The law does not provide for a private right of action, emphasizing the role of the Attorney General in enforcing compliance.

Overall, the Nebraska Data Privacy Act sets a new standard for data protection in the state and aligns with other US State Data Privacy Laws in providing comprehensive rights and obligations for businesses and consumers. Stay tuned for updates on this law and related regulations from White & Case’s Data, Privacy, and Cybersecurity team.