Duty LXD-0478
Trains models, in Nebraska
Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices dutysince 5 lines
Neb. Rev. Stat. section 87-808 (added by Laws 2018, LB757, section 7) · Read the law's page
- This binds any individual or commercial entity, including a government, governmental subdivision, agency, or instrumentality, that conducts business in Nebraska and owns, licenses, or maintains computerized data including a Nebraska resident's personal information.
- Implement and maintain reasonable security procedures and practices appropriate to the nature and sensitivity of the personal information held and to the nature, size, and resources of the business and its operations, including safeguards that protect the information when it is disposed of.
- Where personal information is disclosed to a nonaffiliated third-party service provider, require by contract that the provider implement and maintain reasonable security procedures and practices of its own, appropriate to the nature of the information disclosed and reasonably designed to protect it from unauthorized access, acquisition, destruction, use, modification, or disclosure.
- A business already subject to and compliant with the Gramm-Leach-Bliley Act Title V regulations or HIPAA and HITECH regulations, or with a state or federal law providing greater protection, is deemed to comply.
- There is no private right of action; only the Attorney General may enforce this section, as a deemed violation of Neb. Rev. Stat. section 59-1602, seeking a civil penalty of up to $2,000 per violation under section 59-1614.
Nebraska Data Privacy Act (NDPA), Small Business Act applicability and nonprofit exemptionsince 3 lines
Neb. Rev. Stat. ยงยง 87-1101 to 87-1130 (Laws 2024, LB1074) · Read the law's page
- Do not assume the NDPA applies to you based on a consumer count or revenue threshold the way other states' comprehensive privacy acts do; check whether you qualify as a small business under the federal Small Business Act as it existed on .
- The NDPA does not reach a nonprofit organization or a higher-education institution at all.
- Personal data a Nebraska consumer has not restricted to a specific audience, and that is otherwise lawfully public, falls outside the NDPA's definition of personal data.