Sends automated texts, in Nebraska

Neb. Rev. Stat. section 87-808 (added by Laws 2018, LB757, section 7) · Read the law's page

• This binds any individual or commercial entity, including a government, governmental subdivision, agency, or instrumentality, that conducts business in Nebraska and owns, licenses, or maintains computerized data including a Nebraska resident's personal information.
• Implement and maintain reasonable security procedures and practices appropriate to the nature and sensitivity of the personal information held and to the nature, size, and resources of the business and its operations, including safeguards that protect the information when it is disposed of.
• Where personal information is disclosed to a nonaffiliated third-party service provider, require by contract that the provider implement and maintain reasonable security procedures and practices of its own, appropriate to the nature of the information disclosed and reasonably designed to protect it from unauthorized access, acquisition, destruction, use, modification, or disclosure.
• A business already subject to and compliant with the Gramm-Leach-Bliley Act Title V regulations or HIPAA and HITECH regulations, or with a state or federal law providing greater protection, is deemed to comply.
• There is no private right of action; only the Attorney General may enforce this section, as a deemed violation of Neb. Rev. Stat. section 59-1602, seeking a civil penalty of up to $2,000 per violation under section 59-1614.

Genetic Information Privacy Act, Neb. Rev. Stat. §§ 87-901 to 87-904 · Read the law's page

• If you are a direct-to-consumer genetic testing company, make available to a Nebraska consumer a high-level privacy policy overview and a prominent, publicly available privacy notice that covers at least your data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices (Neb. Rev. Stat. 87-903(1)(a)).
• Obtain a consumer's initial express consent that clearly states the uses for which the genetic data collected through the product or service is intended, names the parties who have access to test results, and states the means by which the data may be shared (87-903(1)(b)(i)).
• Obtain separate express consent before transferring or disclosing a consumer's genetic data to any person other than your vendors and service providers, or before using it for purposes not stated in the initial consent and inherent contextual uses (87-903(1)(b)(ii)).
• Obtain separate express consent before retaining any biological sample provided by the consumer after the initial testing service the consumer requested (87-903(1)(b)(iii)).
• Obtain informed consent under the Federal Policy for the Protection of Human Research Subjects, 45 C.F.R. part 46, before transferring or disclosing a consumer's genetic data to third parties for research, or before research under your control for publication or generalizable knowledge (87-903(1)(b)(iv)).
• Obtain express consent before marketing to a consumer based on the consumer's genetic data, or before a third party markets to the consumer based on the consumer's order or purchase of a genetic testing product or service. Customized content on your own websites, applications or services is not marketing (87-903(1)(b)(v)).
• Require a court order before disclosing genetic data to any government agency, including law enforcement, unless the consumer gives express written consent (87-903(1)(c)).
• Develop, implement and maintain a comprehensive security program to protect a consumer's genetic data from unauthorized access, use or disclosure (87-903(1)(d)).
• Provide a process for a consumer to access the consumer's genetic data, to delete the consumer's account and genetic data, and to request and obtain written documentation verifying destruction of the consumer's biological sample (87-903(1)(e)).
• Do not disclose a consumer's genetic data to an entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's written consent (87-903(2)).