Data Privacy Interactive Map - Nebraska

Highlights

Covered Entities:

An individual or a commercial entity that conducts business in Nebraska and that owns or licenses computerized data that includes personal information about a resident of Nebraska.

Consumer Notification:

A covered entity shall, when it becomes aware of a breach of the security of the system, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be used for an unauthorized purpose. If the investigation determines that the use of information about a Nebraska resident for an unauthorized purpose has occurred or is reasonably likely to occur, the individual or commercial entity shall give notice to the affected Nebraska resident.

Regulatory Notification:

If notice of a breach of security of the system is required, the covered entity shall also, not later than the time when notice is provided to the Nebraska resident, provide notice of the breach of security of the system to the Attorney General.

Notification Timeline:

Notice shall be made as soon as possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system.

Data Format:

Electronic.

Citations:

Neb. Rev. Stat. §§87-801 through 808.

More Details

Definitions:

• Breach: The unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a covered entity.
• Personal Information (PI):
  • A Nebraska resident's first name or first initial and last name in combination with any one or more of the following data elements that relate to the resident if either the name or the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable:
    • Social security number;
    • Motor vehicle operator's license number or state identification card number;
    • Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a resident's financial account;
    • Unique electronic identification number or routing code, in combination with any required security code, access code, or password; or
    • Unique biometric data, such as a fingerprint, voice print, or retina or iris image, or other unique physical representation; or
    • A username or email address, in combination with a password or security question and answer, that would permit access to an online account.
• Medical Information: N/A
• Health Insurance Information: N/A

Safe Harbors:

• Encryption: There is no breach if the acquired computerized data was encrypted. Encrypted means converted by use of an algorithmic process to transform data into a form in which the data is rendered unreadable or unusable without use of a confidential process or key. Data shall not be considered encrypted if the confidential process or key was or is reasonably believed to have been acquired as a result of the breach of the security of the system.
• Good Faith: Good faith acquisition of personal information by an employee or agent of a covered entity for the purposes of the covered entity is not a breach of the security of the system if the personal information is not used or subject to further unauthorized disclosure.
• Risk of Harm: Notification is not required if, after a good faith, reasonable, and prompt investigation to determine the likelihood that personal information has been or will be used for an unauthorized purpose, determines that the use of information about a Nebraska resident for an unauthorized purpose has not occurred or is not reasonably likely to occur.
• Law Enforcement Delay: Notice required by this section may be delayed if a law enforcement agency determines that the notice will impede a criminal investigation. Notice shall be made in good faith, without unreasonable delay, and as soon as possible after the law enforcement agency determines that notification will no longer impede the investigation.
• Public Record: N/A

Direct Notice:

• Timing: Notice must be given to affected persons as soon as possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the computerized data system.
• Format: N/A
• Content: N/A
• Method: Notice may be provided through:
  • Written notice;
  • Telephonic notice; or
  • Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. 7001, as such section existed on January 1, 2006.
• Substitute Notice: Substitute may be provided under two circumstances:
  • If the covered entity required to provide notice demonstrates that the cost of providing notice will exceed $75,000, that the affected class of Nebraska residents to be notified exceeds 100,000 residents, or that the covered entity does not have sufficient contact information to provide notice. Substitute notice under this subdivision requires all of the following:
    • Electronic mail notice if the covered entity has electronic mail addresses for the members of the affected class of Nebraska residents;
    • Conspicuous posting of the notice on the website of the covered entity if the covered entity maintains a website; and
    • Notice to major statewide media outlets; or
  • If the covered entity required to provide notice has 10 employees or fewer and demonstrates that the of providing notice will exceed $10,000. Substitute notice under this subdivision requires all of the following:
    • Electronic mail notice if the covered entity has electronic mail addresses for the members of the affected class of Nebraska residents;
    • Notification by a paid advertisement in a local newspaper that is distributed in the geographic area in which the covered entity is located, which advertisement shall be of sufficient size that it covers at least one-quarter of a page in the newspaper and shall be published in the newspaper at least once a week for three consecutive weeks;
    • Conspicuous posting of the notice on the website of the covered entity if the covered entity maintains a website; and
    • Notification to major media outlets in the geographic area in which the covered entity is located.

Remediation Services:

N/A

Regulatory Notice:

If notice of a breach of security of the system is required, the covered entity shall also, not later than the time when notice is provided to the Nebraska resident, provide notice of the breach of security of the system to the Attorney General.

Credit Reporting Agencies Notice:

N/A

Third-Party Notice:

An individual or a commercial entity that maintains computerized data that includes personal information that the individual or commercial entity does not own or license shall give notice to and cooperate with the owner or licensee of the information of any breach of the security of the system when it becomes aware of a breach if use of personal information about a Nebraska resident for an unauthorized purpose occurred or is reasonably likely to occur. Cooperation includes, but is not limited to, sharing with the owner or licensee information relevant to the breach, not including information proprietary to the individual or commercial entity.

HIPAA:

N/A

Private Action:

N/A

Associated Regulations:

• Information Security Standard (Neb. Rev. Stat. § 87-808).

Highlights

Covered Entities: An individual or commercial entity that conducts business in Nebraska and owns, licenses, or maintains computerized data that includes personal information about a resident of Nebraska.

First Party Security Standard: To protect personal information from unauthorized access, acquisition, destruction, use, modification, or disclosure, an individual or a commercial entity that conducts business in Nebraska and owns, licenses, or maintains computerized data that includes personal information about a resident of Nebraska shall implement and maintain reasonable security procedures and practices that are appropriate to the nature and sensitivity of the personal information owned, licensed, or maintained and the nature and size of, and the resources available to, the business and its operations, including safeguards that protect the personal information when the individual or commercial entity disposes of the personal information.

Third Party Security Standard: An individual or commercial entity that discloses computerized data that includes personal information about a Nebraska residents to a nonaffiliated, third-party service provider shall require by contract that the service provider implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal information disclosed to the service provider and are reasonably designed to help protect the personal information from unauthorized access, acquisition, destruction, use, modification, or disclosure.

Disposal/Destruction Standard: An individual or commercial entity must safeguard personal information when disposing of records containing personal information.

Data Format: Electronic.

Citations: Neb. Rev. Stat. §§ 87-802, 87-806, 87-808

More Details

Definitions:

• Commercial Entity: A corporation, business trust, estate, trust, partnership, limited partnership, limited liability partnership, limited liability company, association, organization, joint venture, government, governmental subdivision, agency, or instrumentality, or any other legal entity, whether for profit or not for profit.

• Personal Information (PI):
  • A Nebraska resident’s first name or first initial and last name in combination with any one or more of the following data elements that relate to the individual if either the name or the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable:
    
    • Social Security number;
    • Motor vehicle operator’s license number or state identification card number;
    • Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a resident’s financial account;
    • Unique electronic identification number or routing code, in combination with any required security code, access code, or password; or
    • Unique biometric data, such as a fingerprint, voice print, or retina or iris image, or other unique physical representation; or
  • A user name or email address, in combination with a password or security questions and answer, that would permit access to an online account.

PI does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

Methods of Compliance:

The statute does not define how to safeguard data containing personal information. The statute requires measures to be appropriate to the nature and sensitivity of the personal information owned, licensed, or maintained and the nature and size of, and the resources available to, the business and its operations.

The statute requires third-party service providers by contract to implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information disclosed and reasonably designed to help protect the personal information from unauthorized access, acquisition, destruction, use, modification, or disclosure.

A subject entity may comply with requirements if it complies with state or federal law that provides greater protection to personal information than the protections to personal information required in this section.

Exclusions:

• Health Care: A subject entity is in compliance with the statute if it complies with the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. 1320d to 1320d-9.
• Financial: A subject entity is in compliance with the statute if it complies with the regulations of Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq.
• Other: These requirements do not apply to any contract entered into before July 19, 2018.

Enforcement/Penalties:

A violation of the information security requirements set forth in § 87-808 is considered a violation of the state Consumer Protection Act. The Attorney General may bring an action for violation of the statute.

A violation may result in civil penalties and other remedies. The statute does not create a private right of action.

Associated Regulations:

N/A

Neb. Rev. St. §§ 87-1101 to 87-1130

Highlights

Applicability:

The Nebraska Data Privacy Act (“NEDPA”) applies to Controllers that meet all of the following conditions:

• Conduct business in Nebraska or produce products or services that Nebraska residents consume;
• Process Personal Data or engage in Personal Data sales; and
• Do not qualify as a small business, as defined by the federal Small Business Act, except if such entity engages in the sale of Sensitive Data without receiving prior consent from the consumer.

The NEDPA excludes from its scope certain entities, such as state agencies and political subdivisions, nonprofit organizations, institutions of higher education, financial institutions and affiliates subject to Title V of the Gramm-Leach-Bliley Act, covered entities and business associates governed by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and public utilities that supply electricity or natural gas. The NEDPA also excludes from its scope certain types of information, such as information protected by HIPAA, health records, patient identifying information, personal information processed for purposes of certain types of research, information regulated by Health Care Quality Improvement Act of 1986, by Patient Safety and Quality Improvement Act, by the Fair Credit Reporting Act, by the Drivers Privacy Protection Act, by the Family Educational Rights and Privacy Act, by the Farm Credit Act, as well as employment-related data and business-to-business data.

The NEDPA also excludes air carriers regulated under the Airline Deregulation Act, electric suppliers and power suppliers, and data processed by a person in the course of a purely personal or household activity.

A Controller or Processor that complies with COPPA’s verifiable parental consent requirements is considered compliant with any NEDPA obligation to obtain parental consent.

Covered Entity Obligations:

• Limit the collection of Personal Data to that which is adequate, relevant, and reasonably necessary to the purpose for which the information is processed, as disclosed to consumer.
• Refrain from processing Personal Data for purposes that are neither reasonably necessary to nor compatible with the purposes disclosed to the consumer unless the consumer’s consent has been obtained.
• Establish, implement, and maintain reasonable administrative, technical, and physical data security procedures and practices appropriate to the volume and nature of the Personal Data so as to protect the confidentiality, integrity, and accessibility of Personal Data.
• Comply with data consumer requests in a timely and efficient manner.
• Not process Personal Data in violation of state and federal laws that prohibit discrimination against consumers and not discriminate against consumers who exercise such rights.
• Obtain consent for processing Sensitive Data from consumers and comply with applicable regulations when processing Personal Data of a known child. A small business, as defined by the federal Small Business Act, may not engage in the Sale of Sensitive Data without receiving prior consent from the Consumer.
• Provide consumers with a reasonably accessible and clear privacy notice that includes the categories of Personal Data processed by the Controller; the purpose for processing the Personal Data; how consumers may exercise their individual rights, including how a consumer may appeal a Controller’s decision regarding a consumer’s request; the categories of Personal Data shared with any third party; and the categories of third parties with whom the Controller shares Personal Data. The privacy notice must also include a description of the methods required under the NEDPA through which Consumers may submit requests to exercise Consumer rights.
• If a Controller sells Personal Data to any third party or processes Personal Data for targeted advertising, clearly and conspicuously disclose that process and the manner in which a consumer may exercise the right to opt out of that process.
• Conduct and document a data protection impact assessment of certain types of processing activities involving Personal Data that present a heightened risk of harm to consumers, such as for:
• • Targeted advertising.
  • Selling Personal Data.
  • Profiling that presents a reasonably foreseeable risk of: unfair or deceptive treatment of or unlawful disparate impact on consumers; financial, physical, or reputational injury to consumers; a physical or other intrusion on consumers' solitude, seclusion, private affairs, or private concerns, if it would offend a reasonable person; or another substantial consumer injury.
  • Processing Sensitive Data.
• A data protection assessment must identify and weigh the direct and indirect benefits of the Processing to the Controller, Consumer, other stakeholders, and the public against the potential risks to the Consumer’s rights, as mitigated by safeguards that may reduce those risks. The Controller must factor into the assessment the use of deidentified data, the reasonable expectations of Consumers, the Processing context, and the relationship between the Controller and Consumers.
• The Attorney General may request disclosure of a data protection assessment relevant to an investigative demand. Data protection assessments are confidential and exempt from public inspection and copying, and disclosure to the Attorney General does not waive attorney-client privilege or work-product protection.
• Establish two or more secure and reliable methods for Consumers to submit requests to exercise their Consumer rights, taking into account the ways Consumers normally interact with the Controller, the need for secure and reliable communication, and the Controller’s ability to authenticate the Consumer making the request.
• Not require a Consumer to create a new account to exercise Consumer rights, but a Controller may require the Consumer to use an existing account.
• Establish a process for Consumers to appeal the Controller’s refusal to take action on a Consumer rights request. The appeal process must be conspicuously available and similar to the process for submitting Consumer rights requests.

Consumer Rights:

A Controller must respond without undue delay and within forty-five (45) days to consumer requests regarding the processing of Personal Data and Sensitive Data, including consumers’:

• Right to know and access Personal Data;
• Right to correct inaccurate Personal Data, taking into account the nature of the Personal Data and the purposes of Processing;
• Right to request deletion of Personal Data;
• Right to obtain Personal Data previously provided by the Consumer to the Controller in a format that is generally portable, readily usable, and transmittable to another Controller without impediment, if the data is available in a digital format;
• Right to opt out of Personal Data sales, targeted advertising, and profiling for decisions producing legal or other similarly significant effects concerning the consumer.
• Right to non-discrimination for exercising their consumer rights.
• A parent or legal guardian may exercise Consumer rights on behalf of a known child.

Additionally, a Controller shall establish a process for the consumer to appeal the Controller’s refusal to take action on a request.  The appeal process must be made conspicuously available and similar to the process for submitting requests to initiate action.  The Controller is required to take action within sixty (60) days of receipt of an appeal and inform the consumer in writing of action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions, as well as provide an online mechanism for them to contact the Attorney General to submit a complaint if the appeal is denied.

More Details

Definitions:

• Biometric Data: Data generated by automatic measurements of an individual’s biological characteristics, including fingerprints, voiceprints, eye retinas, irises, or other unique biological patterns or characteristics used to identify a specific individual. Biometric Data does not include a digital or physical photograph, audio or video recording, or data generated from such materials unless generated to identify a specific individual.]
  Cite: Neb. Rev. Stat. § 87-1102(3).
• Consumer: An individual who is a Nebraska resident acting only in an individual or household context; this definition does not include individuals acting in an employment or commercial context.
• Consent: A clear affirmative act signifying a Consumer’s freely given, specific, informed, and unambiguous agreement to process Personal Data relating to the Consumer. Consent may include a written statement, including by electronic means, or another unambiguous affirmative action. Consent does not include acceptance of general or broad terms of use, hovering over, muting, pausing, or closing content, or agreement obtained through a dark pattern.]
  Cite: Neb. Rev. Stat. § 87-1102(7).
• Controller: An individual or other person that, alone or jointly with others, determines the purpose and means of processing Personal Data.
• Decision that Produces a Legal or Similarly Significant Effect Concerning a Consumer: A decision made by the Controller that results in the provision or denial by the Controller of financial and lending services; housing, insurance, or health care services; education enrollment; employment opportunities; criminal justice; or access to basic necessities, such as food and water.]
  Cite: Neb. Rev. Stat. § 87-1102(11).
• Known Child: A child under circumstances where a Controller has actual knowledge of, or willfully disregards, the child’s age.]
  Cite: Neb. Rev. Stat. § 87-1102(18).
• Personal Data: Any information, including Sensitive Data, that is linked or reasonably linkable to an identified or identifiable individual, and includes pseudonymous data when the data is used by a Controller or Processor in conjunction with additional information that reasonably links the data to an identified or identifiable individual. Personal Data excludes:  de-identified and publicly available information (defined as information that is lawfully made available through government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by a consumer, or by a person to whom a consumer has disclosed the information, unless the consumer has restricted the information to a specific audience).
• Precise Geolocation Data: Information derived from technology, including GPS-level latitude and longitude coordinates or other mechanisms, that identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet. Precise Geolocation Data does not include the content of communications or data generated by or connected to an advanced utility metering infrastructure system or equipment for use by a utility.]
  Cite: Neb. Rev. Stat. § 87-1102(22).
• Processor: A person that processes Personal Data on behalf of a Controller.
  Cite: Neb. Rev. Stat. § 87-1102(24).
• Profiling: Any form of solely automated processing performed on Personal Data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
• Sale of Personal Data: The exchange of Personal Data for monetary or other valuable consideration by the Controller to a third party. The sale excludes the following disclosures: (i) disclosure to a processor for processing on behalf of the Controller; (ii) disclosures to a third party to provide a product or service requested by the Consumer; (iii) disclosures to an affiliate of the Controller; (iv) disclosures made by a Consumer to the general public via mass media that the Consumer did not restrict to a specific audience (v) disclosure or transfer when the Consumer directs the Controller to disclose Personal Data or intentionally uses the Controller to interact with a third party; (vi) a disclosure or transfer as an asset in a merger or other transaction in which the third party assumes control of all or part of the Controller’s assets.
• Sensitive Data: Personal Data revealing: racial or ethnic origin, religious beliefs, mental/physical health diagnosis, sexual orientation, or citizenship/immigration status; genetic and biometric data processed for the purpose of uniquely identifying an individual; Personal Data collected from a known child or precise geolocation data.
• Targeted Advertising: Displaying to a consumer advertisement based on Personal Data obtained from that consumer’s activities over time and across nonaffiliated websites or applications to predict their interests or preferences.  Excludes: (i) advertisement based on activities within the Controller’s websites or online applications; (ii) advertisement based on the context of consumer’s current search query or visit to a website/application; (iii) advertisement directed to the consumer in response to their request; or (iv) Personal Data processed solely for measuring or reporting advertisement performance, reach, or frequency.
• Third Party: A person, other than the Consumer, Controller, Processor, or an affiliate of the Controller or Processor.

Penalties:

Violations of the NEDPA may be enforced by the Attorney General with a thirty (30) day cure period. The maximum civil penalty for violations is $7,500 per violation plus reasonable attorney’s fees and expenses.

Private Action:

No

Enforcement Action:

There have been no specific enforcement actions under the Nebraska Data Privacy Act (NEDPA).

Associated Regulations & Rulemaking:

They have established associated regulations for standards of uniforn sharing of student data, records and information among school districts, educational service units, and the Department of Education. There are other sector-specific rules regarding the privacy and data protection in the dissemination of criminal history information as well as customer information in the insurance sector. 

Notes on AI Related Regulations:

AI-related regulations have been sector-specific, focusing on the healthcare, education, consumer privacy and automated decision-making

Effective Date:

January 1, 2025