Law / United States / 
Nebraska
Financial Data Protection and Consumer Notification of Data Security Breach Act, security procedures and practices duty
Neb. Rev. Stat. section 87-808 (added by Laws 2018, LB757, section 7)
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security
What it requires
- This binds any individual or commercial entity, including a government, governmental subdivision, agency, or instrumentality, that conducts business in Nebraska and owns, licenses, or maintains computerized data including a Nebraska resident's personal information.
- Implement and maintain reasonable security procedures and practices appropriate to the nature and sensitivity of the personal information held and to the nature, size, and resources of the business and its operations, including safeguards that protect the information when it is disposed of.NIST CSF 2.0PR.DS-01NIST CSF 2.0ID.AM-08
- Where personal information is disclosed to a nonaffiliated third-party service provider, require by contract that the provider implement and maintain reasonable security procedures and practices of its own, appropriate to the nature of the information disclosed and reasonably designed to protect it from unauthorized access, acquisition, destruction, use, modification, or disclosure.NIST CSF 2.0GV.SC-05
- A business already subject to and compliant with the Gramm-Leach-Bliley Act Title V regulations or Health Insurance Portability and Accountability Act (HIPAA) and HITECH regulations, or with a state or federal law providing greater protection, is deemed to comply.
- There is no private right of action; only the Attorney General may enforce this section, as a deemed violation of Neb. Rev. Stat. section 59-1602, seeking a civil penalty of up to $2,000 per violation under section 59-1614.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
A violation of Neb. Rev. Stat. section 87-808 is deemed a violation of section 59-1602 under section 87-806(2); section 59-1614 sets the civil penalty for a section 59-1602 violation at not more than $2,000 for each violation, recoverable only by the Attorney General. Neither 87-808 nor the chain through 59-1602/59-1614 states an aggregate cap.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 2,000
Who enforces it
Enforcement body
Neb. Rev. Stat. section 87-808 names no dedicated regulator of its own; a violation is deemed a violation of the Consumer Protection Act's unfair-practices section, Neb. Rev. Stat. section 59-1602, and only the Attorney General may bring a civil action to recover the penalty under section 59-1614.
What this law does
An individual or commercial entity that conducts business in Nebraska and owns, licenses, or maintains computerized data including a Nebraska resident's personal information must implement and maintain reasonable security procedures and practices appropriate to the nature and sensitivity of that information and to the nature, size, and resources of the business, including safeguards for disposal of the information.
Where the entity discloses that data to a nonaffiliated third-party service provider, it must require by contract that the provider maintain reasonable security procedures and practices of its own. The Act's own definition of a bound commercial entity reaches a government, governmental subdivision, agency, or instrumentality as well as a private business.
An entity that already complies with a state or federal law giving greater protection, or with the Gramm-Leach-Bliley Act Title V or Health Insurance Portability and Accountability Act (HIPAA) regulations where it is subject to either, is deemed to comply. Only the Attorney General enforces the duty, as a deemed violation of the Consumer Protection Act's unfair-practices section, and the section creates no private right of action.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .