Just as businesses are grabbling with the requirements of California’s new privacy law (CCPA), now Nevada has amended its own privacy law also granting consumers the right to opt out the sale of their personal information. The new law goes into effect on October 1, 2019 – 3 months before CCPA.
Although this right to opt of the sale of personal information sounds similar to the opt-out provisions in the CCPA there are significant differences that are more limiting due to the Nevada law’s definitions of “operator”, “consumer”, “covered information” and “sale.”
The law establishes that an operator of an online service or website selling to Nevada consumers (B2C) must provide a “designated request address through which a consumer may submit a verified request” and requires that upon receiving such a request, the operator “shall not make any sale of any covered information the operator has collected or will collect about that consumer.” However, the definition of a sale is narrower than CCPA as it is limited to an exchange for “monetary considerations.”
The right to opt out of a sale of information is also limited to a smaller database of information than CCPA and includes a first and last name, home or other physical address which includes the name of a street and the name of a city or town, email address, phone number, social security number, individual identifiers, and any other information that when combined with an identifier makes the information personally identifiable.
Unlike CCPA, Nevada’s new privacy law does not require businesses to provide a conspicuous notice of this new opt-out right (such as the “Do Not Sell My Personal Information” home page link required by CCPA) and does not require two designated methods (including a toll free number) for consumers to submit an opt-out request. Presumably, this opt-out process can simply be described in a privacy notice. This opt-out requirement, however, applies whether a business currently sells information or not. Therefore, a business would need to record these requests and honor those opt-outs with respect to any future sale of covered information.
Takeaway:
Businesses who sell to Nevada consumers online should analyze whether they need to revise online privacy notices and implement opt-out procedures to comply with the new amendments.
