Duty LXD-1435
Processes biometric data, in Nebraska
Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices dutysince 5 lines
Neb. Rev. Stat. section 87-808 (added by Laws 2018, LB757, section 7) · Read the law's page
- This binds any individual or commercial entity, including a government, governmental subdivision, agency, or instrumentality, that conducts business in Nebraska and owns, licenses, or maintains computerized data including a Nebraska resident's personal information.
- Implement and maintain reasonable security procedures and practices appropriate to the nature and sensitivity of the personal information held and to the nature, size, and resources of the business and its operations, including safeguards that protect the information when it is disposed of.
- Where personal information is disclosed to a nonaffiliated third-party service provider, require by contract that the provider implement and maintain reasonable security procedures and practices of its own, appropriate to the nature of the information disclosed and reasonably designed to protect it from unauthorized access, acquisition, destruction, use, modification, or disclosure.
- A business already subject to and compliant with the Gramm-Leach-Bliley Act Title V regulations or HIPAA and HITECH regulations, or with a state or federal law providing greater protection, is deemed to comply.
- There is no private right of action; only the Attorney General may enforce this section, as a deemed violation of Neb. Rev. Stat. section 59-1602, seeking a civil penalty of up to $2,000 per violation under section 59-1614.
Nebraska Data Privacy Act, sensitive data and biometric data definitionssince 2 lines
Neb. Rev. Stat. § 87-1102(3), (30) · Read the law's page
- Treat genetic or biometric data processed to uniquely identify a Nebraska consumer as sensitive data requiring heightened handling under NDPA.
- Treat a voice print or other biometric identifier generated from a recording, for the purpose of identifying a specific individual, as covered biometric data. Nebraska's exclusion does not reach data generated for that purpose.
Nebraska Data Privacy Act (NDPA), Small Business Act applicability and nonprofit exemptionsince 3 lines
Neb. Rev. Stat. §§ 87-1101 to 87-1130 (Laws 2024, LB1074) · Read the law's page
- Do not assume the NDPA applies to you based on a consumer count or revenue threshold the way other states' comprehensive privacy acts do; check whether you qualify as a small business under the federal Small Business Act as it existed on .
- The NDPA does not reach a nonprofit organization or a higher-education institution at all.
- Personal data a Nebraska consumer has not restricted to a specific audience, and that is otherwise lawfully public, falls outside the NDPA's definition of personal data.
Genetic sequencers produced by a foreign adversary: ban on use in medical facilities and research facilitiessince 2 lines
Neb. Rev. Stat. §§ 71-6802, 71-6803 · Read the law's page
- If you are a medical facility or research facility, do not use any genetic sequencer or operational and research software for genetic sequencing that is produced in or by a foreign adversary, a state-owned enterprise of a foreign adversary, a business domiciled in a foreign adversary, or a subsidiary or affiliate of such a business (Neb. Rev. Stat. 71-6802).
- If you possess such a genetic sequencer or software, permanently disable it or remove it from any facility associated with your medical facility or research facility (71-6803).