Nevada 2021 Regular Session Status: Enacted 1 D cosponsors

SB 260 — Revises provisions relating to Internet privacy. (BDR 52-253)

Last action — Approved by the Governor. Chapter 292.

Track this bill free

No card. One bill, free forever — alerts when it moves.

  1. ✓
    Introduced
  2. ✓
    In Committee
  3. ✓
    Passed Senate
  4. ✓
    Passed Assembly
  5. ✓
    To Executive
  6. 6
    Enacted

This bill has been enacted into law. Introduced March 16, 2021. Enacted.

Prognosis

Advancing 52% · moderate confidence

Where this bill stands today.

Odds of enactment

High

How often bills like it became law.

  • Enacted

    Current position in the legislative process.

  • 1 sponsor

    1 primary, 0 co-sponsors signed on.

  • Single-party support

    Sponsorship is currently within one party (1 D).

Prognosis reads this bill's own signals — stage, sponsorship breadth, committee status, recorded votes and cross-state momentum. Odds come from a model trained on which bills have become law.

Bill Text

What changed in the latest version

272 added · 327 removed

Plain-language change summary

The recent amendments to Bill SB 260 adjust the rules for online operators and data brokers regarding their compliance with consumer information laws. Notably, the bill now allows operators or data brokers a chance to correct their first compliance failure without immediate penalties, which encourages better adherence to the law. Additionally, it clarifies which entities are considered "operators," ensuring that those who do not handle consumer data are not unfairly regulated. These changes are significant because they aim to balance consumer protection with reasonable expectations for businesses operating online.

→
Previous
Latest
(Reprinted with amendments adopted on April 19, 2021) FIRST REPRINT S.B.
Senate Bill No.
260 S ENATE B ILLN O.
260–Senator Cannizzaro CHAPTER..........
260–SENATOR C ANNIZZARO M ARCH 16, 2021 ____________ Referred to Committee on Commerce and Labor SUMMARY—Revises provisions relating to Internet privacy.
(BDR 52-253) FISCAL NOTE:
Effect on Local Government:
May have Fiscal Impact.
Effect on the State:
Yes.
~ EXPLANATION – Matter in bolded italics is new;
matter between brackets [omitted material] is material to be omitted.
revising the circumstances under which operators of certain Internet websites or online services are authorized to remedy a failure to comply with certain requirements relating to the collection and sale of certain information about consumers in this State;
authorizing an operator or data broker to remedy a failure to comply with certain requirements relating to the collection and sale of certain information about consumers in this State if it is the first failure of the operator or data broker to comply with such requirements;
Existing law requires an operator of an Internet website which collects certain items of personally identifiable information about consumers in this State to establish a designated address through which a consumer may submit a verified request directing the operator not to make any sale of covered information collected making any sale of any covered information collected about the consumer.
Existing law requires an operator of an Internet website which collects certain establish a designated address through which a consumer may submit a verified request directing the operator not to make any sale of covered information collected about the consumer.
(NRSom 603A.345) Section 3 of this bill imposes similar requirements upon a data broker, which is generally defined in section 2 of this bill to mean a person primarily engaged in the business of purchasing covered information about consumers in this State from operators and other data brokers and making sales of such information.
An operator that receives such a request is prohibited from making any sale of any covered information collected about the consumer.
(NRS 603A.345) Section 3 of this bill imposes similar requirements upon a data broker, which is generally defined in section 2 of this bill to mean a person primarily engaged in the business of purchasing covered information about consumers in this State from operators and other data brokers and making sales of such information.
Sections 4 and 5 of this bill make conforming changes to properly place the new language of - *SB260_R1* – 2 – sections 1.5, 2 and 3 in the Nevada Revised Statutes.
Sections and 7 of this bill revise certain definitions to reflect the requirements imposed on data brokers by section 3.
Sections 6 and 7 of this bill revise certain definitions to reflect the requirements imposed on data brokers by section 3.
Existing law authorizes the Attorney General to seek an injunction or a civil penalty against an operator who violates the provisions of existing law requiring the establishment of a designated request address and prohibiting the sale of covered information about a consumer who has made a verified request.
Existing law authorizes the Attorney General to seek an injunction or a civil penalty against an operator who violates the provisions of existing law requiring the information about a consumer who has made a verified request.
(NRS 603A.360) Section 12 of this bill similarly authorizes the Attorney General to seek an section 3.
(NRS 603A.360)vered Section 12 of this bill similarly authorizes the Attorney General to seek an injunction or a civil penalty against a data broker who violates the provisions of section 3.
or a civil penalty against a data broker who violates the provisions of Existing law defines “operator” to mean, in general, a person who:
Existing law defines “operator” to mean, in general, a person who:
(2) collects certain information from consumers who reside in this State and use or visit the State.
(2) collects certain information from consumers who reside in this State and use or visit the Internet website or online service;
(NRS 603A.330) Section 7.5 of this bill explicitly excludes from theth this definition of “operator” a person who does not collect, maintain or sell covered information.
and (3) has certain minimum contacts with this State.
Existing law defines “sale” for the purposes of the provisions of existing law governing the sale of covered information by operators as the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons.
(NRS 603A.330) Section 7.5 of this bill explicitly excludes from the definition of “operator” a person who does not collect, maintain or sell covered infoExisting law defines “sale” for the purposes of the provisions of existing law governing the sale of covered information by operators as the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons.
(NRS 603A.333) covered information for monetary consideration by an operator or data broker to of another person.
(NRS 603A.333) Section 8 of this bill revises that definition to define “sale” as the exchange of - 81st Session (2021) – 2 – covered information for monetary consideration by an operator or data broker to another person.
An operator who fails to comply with that requirement is authorized to remedy the failure to Sections 10 and 11 of this bill authorize an operator to remedy such a failure only if it is the first failure of the operator to comply with the requirement.
An operator who fails to comply with that requirement is authorized to remedy the failure to comply within 30 days after being informed of such a failure.
(NRS 603A.340) the first failure of the operator to comply with the requirement.
If such an operator remedies a failure to comply with the requirement within 30 days after being informed of the failure, section 3.6 of this bill provides that the operator does not commit a violation for the purposes of provisions governing the enforcement of the requirement by the Attorney General.
Sections 3.3 and 3.9 of this bill enact similar provisions with respect to the requirements concerning the establishment of a designated request address and the sale of covered information about a consumer who has made a verified request 3.
Section 3.9 authorizes an operator who fails to comply with the requirements set forth under existing law concerning the establishment of a designated request address and the sale of covered information to remedy the failure within 30 days after being informed of the failure if it is the first failure of the operator to comply with such requirements.
Section 3.3 authorizes a data broker who fails to comply with similar requirements imposed by section 3 to remedy the failure within 30 days after being informed of the failure if it is the first failure of the data broker to compSections 4 and 5 of this bill make conforming changes to indicate the proper placement of the new language of sections 1.5-3.9 of this bill in the Nevada Revised Statutes.
EXPLANATION – Matter in bolded italics is new;
matter between brackets [omitted material] is material to be omitted.
Chapter 603A of NRS is hereby amended by adding thereto the provisions set forth as sections 1.5, 2 and 3 of this act.
Chapter 603A of NRS is hereby amended by adding thereto the provisions set forth as sections 1.5 to 3.9, inclusive, of this act.
The provisions of this section and NRS 603A.300 to 603A.360, inclusive, and sections 2 and 3 of this act do not apply to:
The provisions of this section and NRS 603A.300 to 603A.360, inclusive, and sections 2 to 3.9, inclusive, of this act do not apply to:
A consumer reporting agency, as defined in NRS 686A.640, or any personally identifiable information collected, maintained or sold by such any agency;
A consumer reporting agency, as defined in 15 U.S.C.
§ 1681a(f);
Any personally identifiable information regulated by the Fair Credit Reporting Act, 15 U.S.C.
§§ 1681 et seq., and the regulations adopted pursuant thereto, which is collected, maintained or sold as provided in that Act;
- 81st Session (2021) – 3 – 3.
3.
4.
Any personally identifiable information that is publicly available;
Any personally identifiable information that is publicly ava5.abAny personally identifiable information protected from disclosure under the federal Driver’s Privacy Protection Act of 1994, 18 U.S.C.
Show all 97 changed rows (57 more)
Previous
Latest
or - *SB260_R1* – 3 – 4.
§§ 2721 et seq., which is collected, maintained or sold as provided in that Act;
Any personally identifiable information protected from disclosure under the federal Driver’s Privacy Protection Act of 1994, 18 U.S.C.
or 6.
§§ 2721 et seq., which is collected, maintained or sold in compliance with that Act.
A financial institution or an affiliate of a financial institution that is subject to the provisions of the Gramm-Leach- Bliley Act, 15 U.S.C.
§§ 6801 et seq., or any personally identifiable information regulated by that Act which is collected, maintained or sold as provided in that Act.
“Data broker” means a person primarily engaged in the business of purchasing covered information about consumers who reside in this State from operators or other data brokers and making sales of such covered information.
“Data broker” means a person whose primary business is purchasing covered information about consumers with whom the person does not have a direct relationship and who reside in this State from operators or other data brokers and making sales of such covered information.
3.
submitted by a consumer pursuant to subsection 2 shall not make any sale of any covered information about that consumer that the data broker has purchased or will purchase.
A data broker that has received a verified request submitted by a consumer pursuant to subsection 2 shall not make any sale of any covered information about that consumer that the data broker has purchased or will purchase.
3.3.
1.
A data broker who has not previously failed to comply with the provisions of section 3 of this act may remedy any failure to comply with the provisions of section 3 of this act within days after being informed of such a failure.
- 81st Session (2021) – 4 – 2.
A data broker described in subsection 1 who remedies a failure to comply with the provisions of section 3 of this act within days after being informed of such a failure does not violate section 3 of this act for the purposes of NRS 603A.360.
comply with the applicable provisions of subsection 1 of NRS 603A.340 may remedy any failure to comply with the applicable provisions of subsection 1 of NRS 603A.340 within 30 days after being informed of such a failure.
2.
An operator described in subsection 1 who remedies a failure to comply with the applicable provisions of subsection 1 of NRS 603A.340 within 30 days after being informed of such a failure does not violate NRS 603A.340 for the purposes of NRS 603A.360.
Sec.
3.9.
1.
An operator who has not previously failed to comply with the provisions of NRS 603A.345 may remedy any failure to comply with the provisions of NRS 603A.345 within 30 days after being informed of such a failure.
2.
An operator described in subsection 1 who remedies a failure to comply with the provisions of NRS 603A.345 within 30 days after being informed of such a failure does not violate NRS 603A.345 for the purposes of NRS 603A.360.
Sec.
2.
603A.330, shall comply with the provisions of NRS 603A.300 ton NRS 603A.360, inclusive [.] , and sections 1.5 to 3.9, inclusive, of this act.
A data collector who is also an operator, as defined in NRS 603A.330, shall comply with the provisions of NRS 603A.300 to 603A.360, inclusive [.] , and sections 1.5, 2 and 3 of this act.
603A.300 As used in NRS 603A.300 to 603A.360, inclusive, and sections 1.5, 2 and 3 of this act, unless the context otherwise requires, the words and terms defined in NRS 603A.310 to 603A.337, inclusive, and section 2 of this act have the meanings ascribed to them in those sections.
603A.300 As used in NRS 603A.300 to 603A.360, inclusive, and sections 1.5 to 3.9, inclusive, of this act, unless the context otherwise requires, the words and terms defined in NRS 603A.310 to 603A.337, inclusive, and section 2 of this act have the meanings ascribed to them in those sections.
- *SB260_R1* – 4 – Sec.
Sec.
603A.320 “Covered information” means any one or more of the following items of personally identifiable information about a consumer collected by an operator through an Internet website or online service and maintained by the operator or a data broker in an accessible form:
603A.320 “Covered information” means any one or more of the following items of personally identifiable information about a - 81st Session (2021) – 5 – consumer collected by an operator through an Internet website or online service and maintained by the operator or a data broker in an accessible form:
2.
of a street and the name of a city or town.ich includes the name 3.
A home or other physical address which includes the name of a street and the name of a city or town.
3.
(b) Collects and maintains covered information from consumers who reside in this State and use or visit the Internet website or online service;
(b) Collects and maintains covered information from consumers online service;
and (c) Purposefully directs its activities toward this State, consummates some transaction with this State or a resident thereof, purposefully avails itself of the privilege of conducting activities in this State or otherwise engages in any activity that constitutes sufficient nexus with this State to satisfy the requirements of the United States Constitution.
andState and use or visit the Internet website or (c) Purposefully directs its activities toward this State, consummates some transaction with this State or a resident thereof, purposefully avails itself of the privilege of conducting activities in this State or otherwise engages in any activity that constitutes sufficient nexus with this State to satisfy the requirements of the United States Constitution.
- *SB260_R1* – 5 – (b) A financial institution or an affiliate of a financial institution that is subject to the provisions of the Gramm-Leach-Bliley Act, 15 U.S.C.
(b) [A financial institution or an affiliate of a financial institution that is subject to the provisions of the Gramm-Leach- - 81st Session (2021) – 6 – Bliley Act, 15 U.S.C.
(c) An entity that is subject to the provisions of the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended, and the regulations adopted pursuant thereto;
(c)] An entity that is subject to the provisions of the Health Insurance Portability and Accountability Act of 1996, Public Law [or-191, as amended, and the regulations adopted pursuant thereto;
[or] (d) A manufacturer of a motor vehicle or a person who repairs or services a motor vehicle who collects, generates, records or stores covered information that is:
(d)] (c) A manufacturer of a motor vehicle or a person who repairs or services a motor vehicle who collects, generates, records or stores covered information that is:
or (e) A person who does not collect, maintain or make sales of covered information.
or (d) A person who does not collect, maintain or make sales of covered information.
(b) The disclosure of covered information by an operator to a person with whom the consumer has a direct relationship for the purposes of providing a product or service requested by the consumer;
(b) The disclosure of covered information by an operator to a person with whom the consumer has a direct relationship for the consumer;of providing a product or service requested by the (c) The disclosure of covered information by an operator to a person for purposes which are consistent with the reasonable expectations of a consumer considering the context in which the consumer provided the covered information to the operator;
(c) The disclosure of covered information by an operator to a person for purposes which are consistent with the reasonable expectations of a consumer considering the context in which the consumer provided the covered information to the operator;
- *SB260_R1* – 6 – 1.
- 81st Session (2021) – 7 – the purposes set forth in NRS 603A.345 [;] or section 3 of this act, as applicable;
Submitted by a consumer to an operator or data broker for the purposes set forth in NRS 603A.345 [;] or section 3 of this act, as applicable;
Except as otherwise provided in subsection 3, an operator shall make available, in a manner reasonably calculated to be accessible by consumers whose covered information the operator collects through its Internet website or online service, a notice that:
Except as otherwise provided in subsection [3,] 2, an operator shall make available, in a manner reasonably calculated to be accessible by consumers whose covered information the operator collects through its Internet website or online service, a notice that:
(b) Provides a description of the process, if any such process exists, for an individual consumer who uses or visits the Internet website or online service to review and request changes to any of his or her covered information that is collected through the Internet website or online service;
exists, for an individual consumer who uses or visits the Internet website or online service to review and request changes to any of his or her covered information that is collected through the Internet website or online service;
An operator who has not previously failed to comply with the provisions of subsection 1 may remedy any failure to comply with the provisions of subsection 1 within 30 days after being informed of such a failure.
[An operator may remedy any failure to comply with the such a failure.ubsection 1 within 30 days after being informed of 3.] The provisions of subsection 1 do not apply to an operator:
3.
The provisions of subsection 1 do not apply to an operator:
Sec.
- 81st Session (2021) – 8 – Sec.
- *SB260_R1* – 7 – 1.
1.
[Knowingly and willfully] Has not previously failed to comply with the provisions of subsection 1 of that section and knowingly fails to remedy a failure to comply with [the] such provisions [of subsection 1 of that section] within 30 days after being informed of such a failure;
[Knowingly and willfully] Has not previously failed to comply with the applicable provisions of subsection 1 of that such provisions [of subsection 1 of that section] within 30 days after being informed of such a failure;
Knowingly fails to comply with the provisions of subsection 1 of that section after having previously failed to comply with such provisions;
Knowingly fails to comply with the applicable provisions of subsection 1 of that section after having previously failed to comply with such provisions;
The Attorney General shall enforce the provisions of NRS 603A.300 to 603A.360, inclusive [.] , and sections 1.5, 2 and 3 of this act.
The Attorney General shall enforce the provisions of NRS 603A.300 to 603A.360, inclusive [.] , and sections 1.5 to 3.9, inclusive, of this act.
or (b) Impose a civil penalty not to exceed $5,000 for each violation.
or (b) Impose a civil penalty not to exceed $5,000 for each vio3.tioIf the Attorney General has reason to believe that a data broker, either directly or indirectly, has violated or is violating section 3 of this act, the Attorney General may institute an appropriate legal proceeding against the data broker.
3.
If the Attorney General has reason to believe that a data broker, either directly or indirectly, has violated or is violating section 3 of this act, the Attorney General may institute an appropriate legal proceeding against the data broker.
The provisions of NRS 603A.300 to 603A.360, inclusive, and sections 1.5, 2 and 3 of this act do not establish a private right of action against an operator.
The provisions of NRS 603A.300 to 603A.360, inclusive, and sections 1.5 to 3.9, inclusive, of this act do not establish a private right of action against an operator.
[4.] 5.
- 81st Session (2021) – 9 – [4.] 5.
The provisions of NRS 603A.300 to 603A.360, inclusive, and sections 1.5, 2 and 3 of this act are not exclusive and are in addition to any other remedies provided by law.
The provisions of NRS 603A.300 to 603A.360, inclusive, and sections 1.5 to 3.9, inclusive, of this act are not exclusive and are in addition to any other remedies provided by law.
H - *SB260_R1*
~~~~~ 21 - 81st Session (2021)
⬇ Download PDF
View plain text versions (4)

Amendments

2 amendments

Click Show changes on an amendment above to see how it modifies the bill.

Action History

  1. Approved by the Governor. Chapter 292.

  2. Enrolled and delivered to Governor.

  3. Assembly Amendment No. 514 concurred in. To enrollment.

  4. In Senate.

  5. From printer. To reengrossment. Reengrossed. Second reprint. Read third time. Passed, as amended. Title approved, as amended. (Yeas: 41, Nays: None, Absent: 1.) To Senate.

  6. From committee: Amend, and do pass as amended. Declared an emergency measure under the Constitution. Read third time. Amended. (Amend. No. 514.) To printer.

  7. In Assembly. Read first time. Referred to Committee on Commerce and Labor. To committee.

  8. From printer. To engrossment. Engrossed. First reprint. Read third time. Passed, as amended. Title approved, as amended. (Yeas: 21, Nays: None.) To Assembly.

  9. From committee: Amend, and do pass as amended. Placed on Second Reading File. Read second time. Amended. (Amend. No. 414.) To printer.

  10. From printer. To committee.

  11. Read first time. Referred to Committee on Commerce and Labor. To printer.

Sponsors

Sponsorship breakdown

Export CSV (upgrade) →

1 sponsors · 0 co-sponsors · 66 not signed on

Sponsors (1)

Co-sponsors (0)

None.

Not signed on (66)

66 members have not signed on to this bill.

Show all 66 →

"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.

Whip count is in markup. Polling the chamber and every recorded vote this session. Only the first open is slow. It’s instant for you after this. Calling the roll · Tallying · Engrossing

Subjects

technology
Cross-referencing the record. Reading this bill against every other bill in the corpus by meaning, not keywords. Only the first open is slow. It’s instant for you after this. Matching · Ranking · Engrossing

Frequently asked questions

Who sponsors SB 260?
SB 260 is sponsored by Cannizzaro, Nicole J. (Democratic).
What is the current status of SB 260?
This bill has been enacted into law. Introduced March 16, 2021. Enacted.
Where can I track SB 260?
Track SB 260 free on One Click Politics — get push/email alerts when it moves.

Make your voice heard on SB 260

Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.

Find my representatives → Run a campaign

Stay ahead of SB 260

Last checked for changes 2 months ago · updated continuously

One Click Politics tracks every bill in Congress and all 50 states.

Track this bill →