Law / United States / 
Nevada
Security measures for a data collector accepting payment cards, encryption duty, and conditioned liability shield
Area: Cybersecurity law, also in Product and AI liability law.
In force since .
A security baseline statutes rule binding private bodies.
What it requires
- If you accept a payment card in connection with a sale of goods or services to a Nevada resident, comply with the current version of the Payment Card Industry (PCI) Data Security Standard adopted by the PCI Security Standards Council, with respect to those transactions, by the compliance date the standard itself sets.NIST CSF 2.0GV.OC-03
- If you do not accept payment cards, do not transfer a Nevada resident's personal information through an electronic, nonvoice transmission other than a facsimile outside your secure system, and do not move a data storage device containing that personal information beyond your logical or physical controls, unless the data is encrypted using an encryption technology adopted by an established standards-setting body, with appropriate management and safeguards of the cryptographic keys.NIST CSF 2.0PR.DS-02NIST CSF 2.0PR.DS-01
- Compliance with this section, combined with a breach not caused by your own gross negligence or intentional misconduct, is a defense to damages for a breach of the security of the system data; a telecommunication provider acting solely to convey the communications of other persons is outside this section entirely.
- Expect an elderly or disabled Nevada resident harmed by a violation of this section to have an indirect civil action for damages through NRS 603A.260's deceptive-trade-practice deeming and NRS 598.0977, even though a general Nevada resident does not.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Via NRS 603A.260's deeming of a violation of NRS 603A.010 to 603A.290, inclusive (which includes this section), as a deceptive trade practice under NRS 598.0903 to 598.0999, a natural person, firm, or corporate officer or managing agent who knowingly and willfully engages in the deemed practice is guilty of a misdemeanor, or of a category D, C, or B felony where the offense involves a quantifiable loss of property or services, up to a category B felony at $100,000 or more, punishable by 1 to 20 years' imprisonment and a fine of up to $15,000.
Penalty structure
NRS 603A.260 deems a violation of NRS 603A.010 to 603A.290 a deceptive trade practice for the purposes of NRS 598.0903 to 598.0999. The coded $25,000 is the highest tier: NRS 598.0973 lets the court or the Director impose a civil penalty of not more than $25,000 for each violation of a deceptive trade practice directed toward an elderly person, and NRS 598.09735 the same for one directed toward a minor person. The tiers beneath it are not more than $15,000 for each violation for a practice directed toward a person with a disability (NRS 598.0973), not more than $15,000 for each willful violation in an action by the Commissioner, the Director, a district attorney or the Attorney General (NRS 598.0999(2)), and not more than $10,000 for each violation of a court order or injunction (NRS 598.0999(1)). A civil penalty is not imposed where the Department of Motor Vehicles has fined the same act (NRS 598.0974).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 25,000
Who enforces it
Enforcement body
Nevada Attorney General, the Commissioner of the Consumer Affairs Unit, the Director of the Department of Business and Industry, or a county district attorney, via NRS 603A.260's deeming of a violation as a deceptive trade practice under NRS 598.0903 to 598.0999; also, for an elderly or disabled Nevada resident, an indirect private civil action under NRS 598.0977.
Settledness
- As of
- Open questions
- Does 'accepts a payment card in connection with a sale of goods or services' in NRS 603A.215(1) reach a data collector whose card acceptance is handled entirely by a third-party payment processor?
- Does 'shall not be liable for damages for a breach of the security of the system data' in NRS 603A.215(3) bar a civil action under NRS 598.0977 by an elderly person or a person with a disability?
What it reaches
Obligation class
Security
Applicability criteria
NRS 603A.215(4) excepts a telecommunication provider acting solely in the role of conveying the communications of other persons and data transmission over a secure, private communication channel for approval or processing of negotiable instruments, electronic fund transfers or similar payment methods, or for reports of account closures due to fraud. NRS 603A.030 defines data collector.
- As of
- Combinator
- Any of
- Criteria
- a data collector doing business in this State accepts a payment card in connection with a sale of goods or services
- A data collector doing business in this State to whom subsection 1 does not apply
What this law does
A data collector that accepts a payment card in connection with a sale of goods or services must comply with the current Payment Card Industry (PCI) Data Security Standard adopted by the PCI Security Standards Council, with respect to those transactions, not later than the compliance date the standard itself sets.
A data collector to which that duty does not apply must not transfer a Nevada resident's personal information through an electronic, nonvoice transmission other than a facsimile outside its secure system, and must not move a data storage device containing that personal information beyond its logical or physical controls, unless the data collector encrypts the information using a standards-body-adopted encryption technology with appropriate cryptographic key management.
A data collector that complies with this section, and whose breach was not caused by its own gross negligence or intentional misconduct, is not liable for damages for a breach of the security of the system data. The section does not reach a telecommunication provider acting solely to convey the communications of other persons.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .