Law / United States / 
Nevada
Consumer health data sale authorization
In force since .
A sensitive categories rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Consent, Prohibition, Retention
- Audit expectation
- none
As of .
What it requires
- This binds a person, which in the Nevada Revised Statutes means a natural person, any form of business or social organization or any other nongovernmental legal entity, unless a particular statute provides otherwise (NRS 0.039 and 603A.540(1)).
- Do not sell or offer to sell consumer health data without the written authorization of the consumer to whom the data pertains, or in a manner that is outside the scope of or inconsistent with that authorization (NRS 603A.535(1)).
- Do not condition the provision of goods or services on a consumer authorizing the sale of consumer health data (NRS 603A.535(2)).
- If you sell consumer health data, establish a means by which a consumer may revoke the written authorization, and provide a copy of the authorization to the consumer who signed it and to the purchaser (NRS 603A.535(4) and (7)).
- As a seller or purchaser of consumer health data, retain a copy of the written authorization for at least 6 years after the date on which it expired (NRS 603A.535(8)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Through the deceptive-trade-practice deeming of NRS 603A.550(1), a natural person, firm, or officer or managing agent of a corporation or association who knowingly and willfully engages in a deceptive trade practice is guilty of a misdemeanor, or of a felony where the offense involves a loss of property or services above a stated value (NRS 598.0999(3)).
Penalty structure
NRS 603A.550(1) deems a violation of NRS 603A.400 to 603A.550 a deceptive trade practice under NRS 598.0903 to 598.0999. NRS 598.0999(2) then lets the Commissioner, the Director, a district attorney or the Attorney General recover a civil penalty of not more than $15,000 for each violation the court finds willful.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 15,000
Who enforces it
Enforcement body
The Commissioner, the Director, a district attorney of any county in Nevada or the Attorney General, through NRS 603A.550's deeming of a violation as a deceptive trade practice under NRS 598.0903 to 598.0999.
What it makes you log
What the log must hold
Consent or opt-out state
Log retention
Six years is a minimum, running from the date on which the written authorization expired, which is 1 year after it was given; the section states no end date.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 6
Logging duty
A seller and a purchaser of consumer health data must each retain a copy of the written authorization the consumer gave for the sale. The copy is the consent record: it carries the consumer's signature and the date on which the authorization expires. The section names no other log or record. The seller must give a copy to the consumer who signed it and to the purchaser (NRS 603A.535(7)), which is delivery of the consumer's own document and sets no right to read the retained copies. The section has no territorial clause of its own, and it does not say that an enforcement body may demand the retained copies.
- Kind
- Explicit
- As of
- Provision
- NRS 603A.535(8)
- Trigger
- consent_or_optout
What this law does
A person must not sell or offer to sell consumer health data without the written authorization of the consumer to whom the data pertains, or in a manner that is outside the scope of or inconsistent with that authorization. A person must not condition the provision of goods or services on a consumer authorizing the sale of consumer health data. A written authorization must be in plain language and include the consumer's signature and the date on which the authorization expires.
A written authorization expires 1 year after the date on which the authorization is given. A seller and purchaser of consumer health data must each retain a copy of the written authorization for at least 6 years after the date on which it expired. A violation of NRS 603A.400 to 603A.550, inclusive, constitutes a deceptive trade practice for the purposes of NRS 598.0903 to 598.0999, inclusive. NRS 603A.400 to 603A.550, inclusive, do not create a private right of action.
In the Nevada Revised Statutes, unless a particular statute expressly provides otherwise or the context requires otherwise, a person is a natural person, any form of business or social organization, or any other nongovernmental legal entity, including a corporation, partnership, association, trust or unincorporated organization. The act that added the section became effective on .
When LexLint raises it
When your app profile says your app processes personal data.