Processes personal data, in Nebraska

Neb. Rev. Stat. § 48-237 · Read the law's page

• If you are an employer, do not publicly post or publicly display in any manner more than the last four digits of an employee's social security number, including by making more than the last four digits available to the general public or to an employee's coworkers (Neb. Rev. Stat. 48-237(2)(a)).
• Do not require an employee to transmit more than the last four digits of the social security number over the Internet unless the connection is secure or the information is encrypted (48-237(2)(b)).
• Do not require an employee to use more than the last four digits of the social security number to access an Internet website unless a password, unique personal identification number or other authentication device is also required (48-237(2)(c)).
• Do not require an employee to use more than the last four digits of the social security number as an employee number for any type of employment-related activity (48-237(2)(d)).
• Use more than the last four digits only for compliance with state or federal law, internal administrative purposes, or a commercial transaction the employee freely and voluntarily enters into with you, and never as an identification number for occupational licensing, drug testing (unless required by law) or company meetings, in files with unrestricted access within the company, in files a temporary employee can reach unless bonded or insured, or for posting company information (48-237(3)).

Neb. Rev. Stat. section 87-808 (added by Laws 2018, LB757, section 7) · Read the law's page

• This binds any individual or commercial entity, including a government, governmental subdivision, agency, or instrumentality, that conducts business in Nebraska and owns, licenses, or maintains computerized data including a Nebraska resident's personal information.
• Implement and maintain reasonable security procedures and practices appropriate to the nature and sensitivity of the personal information held and to the nature, size, and resources of the business and its operations, including safeguards that protect the information when it is disposed of.
• Where personal information is disclosed to a nonaffiliated third-party service provider, require by contract that the provider implement and maintain reasonable security procedures and practices of its own, appropriate to the nature of the information disclosed and reasonably designed to protect it from unauthorized access, acquisition, destruction, use, modification, or disclosure.
• A business already subject to and compliant with the Gramm-Leach-Bliley Act Title V regulations or HIPAA and HITECH regulations, or with a state or federal law providing greater protection, is deemed to comply.
• There is no private right of action; only the Attorney General may enforce this section, as a deemed violation of Neb. Rev. Stat. section 59-1602, seeking a civil penalty of up to $2,000 per violation under section 59-1614.

Neb. Rev. Stat. § 87-1108 · Read the law's page

• Give a Nebraska consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available.

Neb. Rev. Stat. § 87-1115(2)(f)(iii) · Read the law's page

• Include in every contract with a processor a requirement that the processor make available to you, on reasonable request, all information in its possession necessary to demonstrate its compliance with the requirements of the Data Privacy Act (section 87-1115(2)(f)(iii)).

Neb. Rev. Stat. § 87-1116 · Read the law's page

• Conduct and document a data protection assessment of each processing of personal data for targeted advertising, each sale of personal data, each profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to any consumer, each processing of sensitive data, and any other processing activity that presents a heightened risk of harm to any consumer.
• Make each assessment weigh the direct or indirect benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in deidentified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
• Make an assessment requested under section 87-1121 available to the Attorney General pursuant to a civil investigative demand.

Neb. Rev. Stat. § 87-1117 · Read the law's page

• To treat data as deidentified, take reasonable measures to ensure that it cannot be associated with an individual (section 87-1117(1)(a)).
• Publicly commit to maintaining and using the deidentified data without attempting to reidentify it (section 87-1117(1)(b)).
• Contractually obligate any recipient of the deidentified data to comply with the Data Privacy Act (section 87-1117(1)(c)).
• When you disclose pseudonymous data or deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of them (section 87-1117(4)).

Neb. Rev. Stat. §§ 87-1101, 87-1107 to 87-1114 · Read the law's page

• Confirm you conduct business in Nebraska, or produce a product or service used by Nebraska residents, and process or sell personal data before relying on NDPA's scope in compliance planning.

Neb. Rev. Stat. §§ 87-1119, 87-1122, 87-1124, 87-1125 · Read the law's page

• Expect NDPA violations to be enforced exclusively by the Nebraska Attorney General, never by a private plaintiff.
• Cure an identified violation and provide the required written statement within 30 days of Attorney General notice to avoid an enforcement action.

Neb. Rev. Stat. § 71-6804 · Read the law's page

• Do not store genetic sequencing data that is utilized in Nebraska within any foreign adversary country (Neb. Rev. Stat. 71-6804(1)).
• Do not remotely access genetic sequencing data that is stored in Nebraska from a foreign adversary country (71-6804(2)).

Agricultural Data Privacy Act, Neb. Rev. Stat. §§ 87-1404 and 87-1405 (LB525, sections 4 and 5) · Read the law's page

• If you are a controller or processor that collects, stores or uses agricultural data linked or reasonably linked to an identified or reasonably identifiable Nebraska agricultural producer, do not engage in the sale of that agricultural data without the producer's express written consent (Neb. Rev. Stat. 87-1405(1)).
• Obtain the producer's written consent to a sale through a clear and conspicuous disclosure that is separate from your primary terms of service or data use agreement (Neb. Rev. Stat. 87-1405(2)).
• Treat the agricultural producer as the owner and controller of agricultural data that originates from its farm, land, device or equipment; your own right of control is nonexclusive, is limited to providing services, maintaining equipment or performing data processing the producer authorizes, and does not include selling the data (Neb. Rev. Stat. 87-1404(2) to (4)).
• Check the exclusions before treating a transfer as a sale: a disclosure to a processor, a transfer to an affiliate, a disclosure the producer directs in writing, a disclosure the law requires and the other cases in Neb. Rev. Stat. 87-1403(13)(b) are not a sale.

Agricultural Data Privacy Act, Neb. Rev. Stat. §§ 87-1406 and 87-1407 (LB525, sections 6 and 7) · Read the law's page

• From January 1, 2027, put a specific provision in every new contract or agreement involving the collection or processing of agricultural data in Nebraska stating that the controller or processor is prohibited from engaging in the sale of the agricultural data without the agricultural producer's express written consent (Neb. Rev. Stat. 87-1406(1)).
• Do not rely on a contract provision that waives or limits the Agricultural Data Privacy Act; it is contrary to public policy and void and unenforceable (Neb. Rev. Stat. 87-1406(2)).
• If you are a controller or processor in custody or possession of agricultural data, establish, implement and maintain reasonable administrative, technical and physical data security practices that protect the confidentiality, integrity and accessibility of the data, appropriate for its volume and nature, against unauthorized access, use, disclosure, modification or loss (Neb. Rev. Stat. 87-1407).

Agricultural Data Privacy Act, Neb. Rev. Stat. §§ 87-1408 and 87-1409 (LB525, sections 8 and 9) · Read the law's page

• If the Attorney General gives you written notice that you have violated the contract-term or data security provision of the Agricultural Data Privacy Act, cure each alleged violation within forty-five days of receiving the notice and give the Attorney General a written statement that each has been cured and that you will refrain from further violations, to avoid a civil penalty action (Neb. Rev. Stat. 87-1409(1) and (2)).
• Do not expect a notice and cure period for a sale of agricultural data without the producer's express written consent; the cure provision does not apply to a violation of that prohibition (Neb. Rev. Stat. 87-1409(3)).

Genetic Information Privacy Act, Neb. Rev. Stat. §§ 87-901 to 87-904 · Read the law's page

• If you are a direct-to-consumer genetic testing company, make available to a Nebraska consumer a high-level privacy policy overview and a prominent, publicly available privacy notice that covers at least your data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices (Neb. Rev. Stat. 87-903(1)(a)).
• Obtain a consumer's initial express consent that clearly states the uses for which the genetic data collected through the product or service is intended, names the parties who have access to test results, and states the means by which the data may be shared (87-903(1)(b)(i)).
• Obtain separate express consent before transferring or disclosing a consumer's genetic data to any person other than your vendors and service providers, or before using it for purposes not stated in the initial consent and inherent contextual uses (87-903(1)(b)(ii)).
• Obtain separate express consent before retaining any biological sample provided by the consumer after the initial testing service the consumer requested (87-903(1)(b)(iii)).
• Obtain informed consent under the Federal Policy for the Protection of Human Research Subjects, 45 C.F.R. part 46, before transferring or disclosing a consumer's genetic data to third parties for research, or before research under your control for publication or generalizable knowledge (87-903(1)(b)(iv)).
• Obtain express consent before marketing to a consumer based on the consumer's genetic data, or before a third party markets to the consumer based on the consumer's order or purchase of a genetic testing product or service. Customized content on your own websites, applications or services is not marketing (87-903(1)(b)(v)).
• Require a court order before disclosing genetic data to any government agency, including law enforcement, unless the consumer gives express written consent (87-903(1)(c)).
• Develop, implement and maintain a comprehensive security program to protect a consumer's genetic data from unauthorized access, use or disclosure (87-903(1)(d)).
• Provide a process for a consumer to access the consumer's genetic data, to delete the consumer's account and genetic data, and to request and obtain written documentation verifying destruction of the consumer's biological sample (87-903(1)(e)).
• Do not disclose a consumer's genetic data to an entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's written consent (87-903(2)).

Neb. Rev. Stat. § 44-7,100 · Read the law's page

• If you issue, renew or continue a hospital, medical or surgical expense-incurred policy or certificate in Nebraska, or sponsor a self-funded employee benefit plan not preempted by federal law, do not require a covered person, a dependent, or an asymptomatic applicant or asymptomatic dependent to undergo any genetic test before issuing, renewing or continuing the coverage (Neb. Rev. Stat. 44-7,100(1)).

Neb. Rev. Stat. § 87-803 · Read the law's page

• Conduct a reasonable and prompt investigation upon becoming aware of a breach of security involving a Nebraska resident's personal information.
• Notify the Nebraska Attorney General no later than when you notify the affected resident, if notice to the resident is required.

Neb. Rev. Stat. § 87-902(6)(b) · Read the law's page

• To keep genetic data outside the Genetic Information Privacy Act as de-identified data, apply administrative and technical measures to ensure that it cannot be associated with an identifiable consumer (section 87-902(6)(b)(i)).
• Publicly commit to maintain and use the data in de-identified form and not to attempt to reidentify it (section 87-902(6)(b)(ii)).
• Bind every recipient of the data by legally enforceable contractual obligations that prohibit it from attempting to reidentify the data (section 87-902(6)(b)(iii)).