LexLint.ioBeta

Know the law your code answers to.

Law / United States / Nebraska

Nebraska Data Privacy Act (NDPA), deidentified data

Neb. Rev. Stat. § 87-1117

In force since .

A de-identification rule binding private bodies.

Obligation class
Contract terms, Disclosure, Governance
Audit expectation
none

What it requires

  • To treat data as deidentified, take reasonable measures to ensure that it cannot be associated with an individual (section 87-1117(1)(a)).
  • Publicly commit to maintaining and using the deidentified data without attempting to reidentify it (section 87-1117(1)(b)).
  • Contractually obligate any recipient of the deidentified data to comply with the Data Privacy Act (section 87-1117(1)(c)).
  • When you disclose pseudonymous data or deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of them (section 87-1117(4)).

These lines are LexLint's reading of the law's text.

What it makes you log

Logging duty

Section 87-1117 states the duties of a controller in possession of deidentified data. It states no log or record duty.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

NDPA requires a controller in possession of deidentified data to take reasonable measures to ensure that the data cannot be associated with an individual. NDPA requires a controller in possession of deidentified data to publicly commit to maintaining and using the data without attempting to reidentify it. NDPA requires a controller in possession of deidentified data to contractually obligate any recipient of the data to comply with the Data Privacy Act.

A controller that discloses pseudonymous data or deidentified data must exercise reasonable oversight to monitor compliance with any contractual commitments to which the data is subject and must take appropriate steps to address any breach of those commitments. NDPA defines deidentified data as data that cannot reasonably be linked to an identified or identifiable individual, or a device linked to that individual.

The Nebraska Legislature's statute page gives Laws 2024, LB1074, section 17, as the source of section 87-1117. Sections 1 to 30 of Legislative Bill 1074 became operative on .

When LexLint raises it

When your app profile says your app processes personal data or processes de-identified data.

Back to the example  ·  Lint your app

Page updated .