alerts & publications
Consumer Data and Privacy: Nevada Gets a Jump on Opt-Out RightsJune 18, 2019
Following California’s lead, Nevada recently passed Senate Bill 220 (SB 220) and became the second state to give consumers the right to opt out of the “sale” of their personal information collected online (Opt-Out Right). Nevada’s Opt-Out Right, however, is generally much narrower than the California Consumer Privacy Act (CCPA) and goes into effect sooner (October 1, 2019) than the CCPA (January 1, 2020).
SB 220 updates Nevada’s pre-existing online privacy law that currently requires “operators” of websites or online services to provide a privacy notice to consumers. Nev. Rev. Stat. § 603A.340(1). SB 220 bolsters consumer protection by also giving consumers the right at any time to direct “operators” not to “sell” any “covered information” the operator collected or will collect about “consumer.” Unlike the CCPA, the Nevada law does not give consumers the rights to access or delete their personal information held by operators.
The law applies to any person that owns or operates an Internet website or online service for commercial purposes, collects and maintains covered information from consumers who reside in Nevada and use or visit the Internet website or online service, and purposefully directs its activities, avails itself, or engages in activity with sufficient nexus with the State of Nevada.
Not all online services or websites are covered. The Opt-Out Right does not apply to third parties that operate, host, manage, or process information on an Internet website or online service on behalf of its owner. It also does not apply to financial institutions subject to the Gramm-Leach-Bliley Act (GLBA), medical providers subject to the Health Insurance Portability and Accountability Act (HIPAA), and car manufacturers and car repair servicers. See Nev. Rev. Stat. § 603A.330, as modified by SB 220.
Unlike the CCPA, which defines a consumer to be any natural person that is a resident of California, the Nevada Opt-Out Right only applies to a person who seeks or acquires, by purchase or lease, any good, service, money, or credit for personal, family, or household purposes from the Internet website or online service of an operator. While the definition of a consumer is not expressly limited to residents of Nevada, the definition of operator suggests that the Opt-Out Right can only be exercised by Nevada residents. In addition, any attempt by Nevada to enforce this right with respect to residents of other states would face a challenge under the Commerce Clause of the United States Constitution.
Nevada defines “sale” more narrowly than the CCPA in limiting it to a purchase of covered information from an operator for “monetary consideration” in order to later license or re-sell the information to other third parties. Under the CCPA, a “sale” includes a broad set of activities, including “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating….a consumer’s personal information.” It is also not limited to payment of monetary consideration, but includes any transaction where the other party has provided “valuable consideration.” Cal. Civ. Code § 1798.140(t)(1). Under the Nevada law, a “sale” does not include disclosures to service providers, disclosures at the consumer’s request, disclosures that are consistent with a consumer’s reasonable expectations in providing their personal information to the operator, disclosure to affiliates of the operator, or as an asset in a merger or bankruptcy of the operator. Nev. Rev. Stat. § 603A. Section 2. For example, if a consumer went on a travel website to book a hotel, the transfer of personal information to the hotel would likely not be considered a sale under this definition.
The Nevada law applies to covered information, “which is defined as personally identifiable information such as a consumer’s name, address, email, social security number, telephone number, and other identifiers that allow a person to be contacted in person or online (such as a social media handle), and any other information concerning a person collected from the person through the Internet website or online service of the operator and maintained by the operator in combination with an identifier in a form that makes the information personally identifiable.” See Nev. Rev. Stat. § 603A.320. This is not as expansive as the definition in the CCPA, which includes a wide variety of data within the definition of personal data, including such diverse items as IP addresses, biometric information, online identifiers, olfactory data, and browsing history.
This memorandum is a summary for general information and discussion only and may be considered an advertisement for certain purposes. It is not a full analysis of the matters presented, may not be relied upon as legal advice, and does not purport to represent the views of our clients or the Firm. Scott Pink, an O’Melveny special counsel licensed to practice law in California, and Deepa Kollipara, an O’Melveny summer associate, contributed to the content of this newsletter. The views expressed in this newsletter are the views of the authors except as otherwise noted.
© 2019 O’Melveny & Myers LLP. All Rights Reserved. Portions of this communication may contain attorney advertising. Prior results do not guarantee a similar outcome. Please direct all inquiries regarding New York’s Rules of Professional Conduct to O’Melveny & Myers LLP, Times Square Tower, 7 Times Square, New York, NY, 10036, T: +1 212 326 2000.
Thank you for your interest. Before you communicate with one of our attorneys, please note: Any comments our attorneys share with you are general information and not legal advice. No attorney-client relationship will exist between you or your business and O’Melveny or any of its attorneys unless conflicts have been cleared, our management has given its approval, and an engagement letter has been signed. Meanwhile, you agree: we have no duty to advise you or provide you with legal assistance; you will not divulge any confidences or send any confidential or sensitive information to our attorneys (we are not in a position to keep it confidential and might be required to convey it to our clients); and, you may not use this contact to attempt to disqualify O’Melveny from representing other clients adverse to you or your business. By clicking "accept" you acknowledge receipt and agree to all of the terms of this paragraph and our Disclaimer.