FULL TEXT: SB220

Section1.

Chapter 603A of NRS is hereby amended by adding thereto the provisions set forth as sections 1.3 to 2, inclusive, of this act.

Sec.1.3.“Designated request address” means an electronic mail address, toll-free telephone number or Internet website established by an operator through which a consumer may submit to an operator a verified request.

Sec.1.6.1.“Sale” means the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons. –2–80th Session (2019)2. The term does not include:

(a)The disclosure of covered information by an operator to a person who processes the covered information on behalf of the operator; (b)The disclosure of covered information by an operator to a person with whom the consumer has a direct relationship for the purposes of providing a product or service requested by the consumer;(c)The disclosure of covered information by an operator to a person for purposes which are consistent with the reasonable expectations of a consumer considering the context in which the consumer provided the covered information to the operator; (d)The disclosure of covered information to a person who is an affiliate, as defined in NRS 686A.620, of the operator;or (e)The disclosure or transfer of covered information to a person as an asset that is part of a merger, acquisition, bankruptcy or other transaction in which the person assumes control of all or part of the assets of the operator.

Sec.1.8.“Verified request” means a request:1.Submitted by a consumer to an operator for the purposes set forth in section 2 of this act; and 2.For which an operator can reasonably verify the authenticity of the request and the identity of the consumer using commercially reasonable means.

Sec.2.1.Each operator shall establish a designated request address through which a consumer may submit a verified request pursuant to this section. 2.A consumer may, at any time, submit a verified request through a designated request address to an operator directing the operator not to make any sale of any covered information the operator has collected or will collect about the consumer. 3.An operator that has received a verified request submitted by a consumer pursuant to subsection 2 shall not make any sale of any covered information the operator has collected or will collect about that consumer. 4.An operator shall respond to a verified request submitted by a consumer pursuant to subsection 2 within 60 days after receipt thereof. An operator may extend by not more than 30 days the period prescribed by this subsection if the operator determines that such an extension is reasonably necessary. An operator who extends the period prescribed by this subsection shall notify the consumer of such an extension.

Sec.3.(Deleted by amendment.) –3–80th Session (2019)

Sec.4.NRS 603A.100 is hereby amended to read as follows: 603A.1001.The provisions of NRS 603A.010 to 603A.290, inclusive, do not apply to the maintenance or transmittal of information in accordance with NRS 439.581 to 439.595, inclusive, and the regulations adopted pursuant thereto. 2.A data collector who is also an operator, as defined in NRS 603A.330, shall comply with the provisions of NRS 603A.300 to 603A.360, inclusive[.], and sections 1.3 to 2, inclusive, of this act. 3.Any waiver of the provisions of NRS 603A.010 to 603A.290, inclusive, is contrary to public policy, void and unenforceable.

Sec.5.NRS 603A.300 is hereby amended to read as follows: 603A.300As used in NRS 603A.300 to 603A.360, inclusive,and sections 1.3 to 2, inclusive, of this act,unless the context otherwise requires, the words and terms defined in NRS 603A.310, 603A.320 and 603A.330 and sections 1.3, 1.6 and 1.8 of this act have the meanings ascribed to them in those sections.

Sec.6.NRS 603A.330 is hereby amended to read as follows: 603A.3301.“Operator” means a person who:(a)Owns or operates an Internet website or online service for commercial purposes;(b)Collects and maintains covered information from consumers who reside in this State and use or visit the Internet website or online service; and(c)Purposefully directs its activities toward this State, consummates some transaction with this State or a resident thereof, [or]purposefully avails itself of the privilege of conducting activities in this State[.]or otherwise engages in any activity that constitutes sufficient nexus with this State to satisfy the requirements of the United States Constitution. 2.The term does not include[a]: (a)A third party that operates, hosts or manages an Internet website or online service on behalf of its owner or processes information on behalf of the owner of an Internet website or online service[.];(b)A financial institution or an affiliate of a financial institution that is subject to the provisions of the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801 et seq., and the regulations adopted pursuant thereto; (c) An entity that is subject to the provisions of the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended, and the regulations adopted pursuant thereto; or –4–80th Session (2019)(d)A manufacturer of a motor vehicle or a person who repairs or services a motor vehicle who collects, generates, records or stores covered information that is: (1)Retrieved from a motor vehicle in connection with a technology or service related to the motor vehicle; or (2)Provided by a consumer in connection with a subscription or registration for a technology or service related to the motor vehicle.

Sec.7.NRS 603A.360 is hereby amended to read as follows: 603A.3601.The Attorney General shall enforce the provisions of NRS 603A.300 to 603A.360, inclusive[.], and sections 1.3 to 2, inclusive,of this act. 2.If the Attorney General has reason to believe that an operator, either directly or indirectly, has violated or is violating NRS 603A.340[,]or section 2of this act, the Attorney General may institute an appropriate legal proceeding against the operator. The district court, upon a showing that the operator, either directly or indirectly, has violated or is violating NRS 603A.340[,]or section 2of this act, may: (a)Issue a temporary or permanent injunction; or (b)Impose a civil penalty not to exceed $5,000 for each violation.3.The provisions of NRS 603A.300 to 603A.360, inclusive,and sections 1.3 to 2, inclusive, of this act do not establish a private right of action against an operator. 4.The provisions of NRS 603A.300 to 603A.360, inclusive, and sections 1.3 to 2, inclusive, of this act are not exclusive and are in addition to any other remedies provided by law