Nebraska Introduces CCPA Copycat Legislation

During the opening day of the Nebraska legislative session, State Sen. Carol Blood (LD 3) introduced the Nebraska Consumer Data Privacy Act (LB 746), which borrows most of its provisions, almost word for word, from the California Consumer Privacy Act (“CCPA”).  In short, the Nebraska Consumer Data Privacy Act, if passed, would place limitations on the collection and sale of a Nebraska resident’s personal information and provide consumers certain individual rights with respect to their personal information. 

The Nebraska Consumer Data Privacy Act would apply to any for-profit business that:

1. Does business in Nebraska;
2. Collects a consumer’s personal information (or directs another to collect such information on its behalf);
3. Determines (alone or jointly with others) the purposes or means of processing of that data; and
4. Satisfies one or more of the following:

(i)    has an annual gross revenue in excess of $10 million;
(ii)   alone or in combination, annually buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices; or
(iii)  derives 50% or more of its annual revenues from selling consumers’ personal information.

Similar to the CCPA, the Nebraska Consumer Data Privacy Act requires covered businesses to provide consumers with notice of their privacy practices at or before the time of data collection, protect collected personal information, and forbid discrimination against individuals who exercise their rights under the law. In addition, both laws provide individuals with the right to opt out of a business selling their personal information.

Also similar to the CCPA, our initial review of the Nebraska Consumer Data Privacy Act shows some inconsistencies.  For example, the definition of “consumer” expressly excludes “a person acting in a commercial or employment context.” However, the definition of “personal information” expressly includes “professional or employment-related information.”  So in what appears to be an attempt to exclude employment and job applicant information (which has been initially excluded from CCPA compliance), the bill’s authors have instead created ambiguity as to whether employment-related information would be subject to the rights and obligations set out in the act.

On January 14, 2020, LB 746 was referred to the Transportation and Telecommunications Committee (chaired by Sen. Curt Friesen (LD 34)).  And while it is likely that the bill may change during the legislative process, for-profit entities doing business in Nebraska should keep an eye on the progress of this bill.  As discussed in earlier articles, Nebraska continues the national trend of introducing copycat CCPA legislation.  We will continue to review the legislation, including any proposed revisions, and provide updates in future issues of our Technology and Intellectual Property Update.

Grayson J. Derrick
Chair, Technology and Intellectual Property Section