On April 17, 2024, Governor Jim Pillen signed into law a bill (L.B. 1074) enacting the Nebraska Data Privacy Act (“NEDPA”). The NEDPA will take effect on January 1, 2025. 

Applicability

The NEDPA is similar in structure and scope to the Texas Data Privacy and Security Act. The NEDPA applies solely to persons that: (1) conduct business in Nebraska or produce a product or service consumed by residents of Nebraska; (2) process or engage in the sale of personal data; and (3) are not small businesses as determined under the federal Small Business Act, except to the extent that provisions limiting the sale of sensitive data apply.

The NEDPA applies to Nebraska consumers (i.e., Nebraska residents who act only in an individual or household context and not in a commercial or employment context). The NEDPA also contains a number of exemptions, including for financial institutions, affiliates of a financial institution, or data subject to Title V of the Gramm-Leach-Bliley Act; covered entities or business associates under HIPAA; nonprofit organizations; institutions of higher education; suppliers of electricity; and natural gas public utilities. 

Controller Obligations

Similar to other comprehensive state privacy laws, the NEDPA requires controllers to limit the collection of personal data to what is adequate, relevant and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer. In addition, controllers need a consumer’s consent to process sensitive data or to process personal data for purposes that are neither reasonably necessary to, nor compatible with, the disclosed purposes for which such personal data is processed, as disclosed to the consumer. The NEDPA also requires controllers to establish, implement and maintain reasonable administrative, technical and physical data security practices that are appropriate to the volume and nature of the personal data at issue.

The NEDPA also requires controllers to provide a reasonably accessible and clear privacy notice that includes: (1) the categories of personal data processed by the controller, including, if applicable, any sensitive data processed by the controller; (2) the purpose for processing personal data; (3) how a consumer may exercise a consumer right, including the process by which a consumer may appeal a controller’s decision with regard to the consumer’s request; (4) if applicable, any category of personal data that the controller shares with any third party; (5) if applicable, any category of third party with whom the controller shares personal data; and (6) a description of each method required through which a consumer may submit a request to exercise a consumer right.

The NEDPA also requires a controller to conduct and document a data protection assessment of each of the following processing activities involving personal data:

• the processing of personal data for purposes of targeted advertising;
• the sale of personal data;
• the processing of personal data for purposes of profiling, if the profiling presents a reasonably foreseeable risk of: (1) unfair or deceptive treatment of or unlawful disparate impact on any consumer; (2) financial, physical or reputational injury to any consumer; (3) a physical or other intrusion on the solitude or seclusion, or the private affairs or concerns, of any consumer, if the intrusion would be offensive to a reasonable person; or (4) other substantial injury to any consumer;
• the processing of sensitive data; and
• any processing activity that involves personal data that presents a heightened risk of harm to any consumer.

Consumer Rights

The NEDPA provides consumers with rights to: (1) confirm whether a controller is processing the consumer’s personal data and to access the personal data; (2) correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data; (3) delete personal data provided by or obtained about the consumer; (4) if the data is available in a digital format and the processing is completed by automated means, obtain a copy of the consumer’s personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance; and (5) opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer.

Like many of the other state privacy laws, controllers have 45 days to respond to consumer rights requests, with a potential 45-day extension when reasonably necessary.

Enforcement

The NEDPA does not contain a private right of action and will be enforced exclusively by the Nebraska Attorney General. The NEDPA provides a 30-day cure period that also requires: (1) a written statement that the controller or processor cured the alleged violation and supportive documentation to show how such violation was cured; and (2) an express written statement that the controller or processor shall not commit any such violation after the alleged violation has been cured. The cure provision does not expire.

Effective Date

The NEDPA will take effect on January 1, 2025.