Nebraska Adopts Consumer Data Privacy Law – A Look at Consumer Rights

As reported in a prior edition of the Technology & Intellectual Property Update, on April 17, 2024, Nebraska Governor Jim Pillen signed into law the Nebraska Data Privacy Act (the “Act”), which goes into effect on January 1, 2025.  In this edition, we look at the broad range of rights provided to Nebraska residents under the Act.

Recall that the Act adopts the approach taken by Texas in its data privacy law and does not use volume and revenue-based thresholds to determine applicability.  Instead, a business is subject to the Act if it meets the following requirements:

• Conducts business in Nebraska or produces a product or service consumed by residents of Nebraska;
• Processes (including the collection, use, storage, disclosure, analysis, or modification) or engages in the sale of personal data; and
• Is not classified as a small business as determined under the federal Small Business Act (SBA), regardless of whether it processes or sells consumer data. 

The rights provided to Nebraska consumers under the Act are largely consistent with those found in other state consumer data privacy laws, including:

• The right to verify whether a controller is processing a consumer’s personal data and to access the personal data
• The right to correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data
• The right to delete the consumer’s personal data
• The right to obtain a copy of the consumer’s personal data in a portable and readily usable format (to the extent technically feasible) that allows the consumer to transmit the data to another controller (known generally as the right of portability)
• The right to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer

The Act requires controllers that receive a request from a consumer seeking to exercise these rights to respond within 45 days of receipt of the request, unless it is reasonably necessary to extend that time for an additional 45 days and the controller notifies the consumer of the extension and the reason within the initial 45 days.  Controllers must inform the consumer within the initial 45 day timeframe of the reason for declining to comply with the request and provide instructions on how to appeal the decision to the Nebraska Attorney General.

In next month’s edition, we will look at the obligations the Act imposes on controllers and processors.