Nevada 2023 Regular Session Status: Enacted 8 D cosponsors

SB 370 — Revises provisions relating to the protection of consumer information. (BDR 52-42)

Last action — Chapter 525.

Track this bill free

No card. One bill, free forever — alerts when it moves.

  1. ✓
    Introduced
  2. ✓
    In Committee
  3. ✓
    Passed Senate
  4. ✓
    Passed Assembly
  5. ✓
    To Executive
  6. 6
    Enacted

This bill has been enacted into law. Introduced March 23, 2023. Enacted.

Signed by Governor Joe Lombardo (Republican) on June 15, 2023.

Prognosis

Likely to advance 62% · moderate confidence

Where this bill stands today.

Odds of enactment

High

How often bills like it became law.

  • Enacted

    Current position in the legislative process.

  • 9 sponsors

    3 primary, 6 co-sponsors signed on.

  • Single-party support

    Sponsorship is currently within one party (8 D).

Prognosis reads this bill's own signals — stage, sponsorship breadth, committee status, recorded votes and cross-state momentum. Odds come from a model trained on which bills have become law.

Bill Text

What changed in the latest version

666 added · 831 removed

666 line(s) added, 831 removed.

→
Previous
Latest
(Reprinted with amendments adopted on April 24, 2023) FIRST REPRINT S.B.
Senate Bill No.
370 SENATE B ILLN O.
370–Senators Cannizzaro, Nguyen, Donate;
370–S ENATORS C ANNIZZARO , NGUYEN , D ONATE ;
Daly, D.
DALY , D.
Harris, Lange, Neal, Pazina and Scheible CHAPTER..........
ARRIS , LANGE , NEAL , AZINA AND SCHEIBLE M ARCH 23, 2023 ____________ Referred to Committee on Commerce and Labor SUMMARY—Revises provisions relating to the protection of consumer information.
(BDR 52-42) FISCAL NOTE:
Effect on Local Government:
No.
Effect on the State:
Yes.
~ EXPLANATION – Matter in bolded italics is new;
matter between brackets [omitted material] is material to be omitted.
requiring certain persons to develop, maintain and make publicly available a policy concerning the storage and retention of biometric identifiers;
establishing requirements governing storing, transmitting, protecting, collecting and sharing biometric identifiers;
prohibiting the sale of a biometric identifier;
- *SB370_R1* – 2 – LegExisting federal law and regulations contain various protections for health information maintained or used:
Legislative Counsel’s Digest:
(1) by a person or entity that provides health care, an insurer or a business associate of a person or entity that provides health care or an insurer;
Existing federal law and regulations contain various protections for health an insurer or a business associate of a person or entity that provides health care or an insurer;
Parts 160 and 164) Sections 2-34 of this bill prescribe various protections for consumer health data that is maintained and used by other persons and nongovernmental entities and for other purposes.
Parts 160 and 164) Sections 2-34 of this bill prescribe various protections for consumer health data that is maintained and used by other persons and term “consumer” to mean a natural person who has requested a product or service the from a regulated entity and who resides in this State or whose consumer health data is collected in this State, except for a natural person acting in an employment context or as an agent of a governmental entity.
Section 7 of this bill defines the from a regulated entity and who resides in this State or whose consumer health data is collected in this State, except for a natural person acting in an employment context or as an agent of a governmental entity.
Section 8 of this bill defines the term “consumer health data” to mean personally identifiable information that is regulated entity to identify the health status of the consumer.
Section 8 of this bill defines the term “consumer health data” to mean personally identifiable information that is linked or reasonably capable of being linked to a consumer and is used by a regulated entity to identify the health status of the consumer.
and (2) determines the purpose and means of processing, this bill define certain other terms.
and (2) determines the purpose and means of processing, sharing or selling consumer health data.
Section 20 of this bill provides that thef provisions of sections 2-34 do not apply to certain persons and entities whose collection and disclosure of data is specifically regulated by federal law and certain data that is collected or disclosed under certain provisions of federal law or regulations or state law.
Sections 3-6, 9-14 and 16-19 of this bill define certain other terms.
Section 20 of this bill provides that the provisions of certain persons and entities whose collection and disclosure of data is specifically - 82nd Session (2023) – 2 – regulated by federal law;
and (2) certain data that is collected or disclosed under certain provisions of federal law or regulations or state law.
Section 22 of this bill generally prohibits a regulated entity from collecting or sharing consumer health data without the affirmative,voluntary consent of the consumer to whom the data relates, except to the extent necessary to provide a product or service that the consumer has requested from the regulated entity.
Section 22 of this bill generally prohibits a regulated entity from collecting or sharing consumer health data without the affirmative, voluntary consent of the consumer to whom the data relates, except to the extent necessary to provide a product or service that the consumer has requested from the regulated entity.
(2) provide the consumer the regulated entity has sold consumer health data relating to the consumer;
(2) provide the consumer with a list of all third parties with whom the regulated entity has shared or to whom the regulated entity has sold consumer health data relating to the consumer;
(3) whom cease collecting or sharing consumer health data relating to the consumer;
(3) cease collecting or sharing consumer health data relating to the consumer;
Section 25 of this bill prescribes requirements governing the response to such a request, including a requirement that a regulated entity provide information in response to such a request free of charge in most circumstances.
Section 25 of this bill prescribes requirements governing the response to such a request, including a requirement that a regulated entity provide information in consumer submits more than two requests in a year and those requests are, if a manifestly unfounded, excessive or repetitive, section 25 authorizes the regulated entity to charge a reasonable fee to provide such information.
However, if a consumer submits more than two requests in a year and those requests are manifestly unfounded, excessive or repetitive, section 25 authorizes the regulated prescribes requirements governing the time within which a regulated entity or ans bill affiliate, processor or other third party with which a regulated entity has shared data must delete consumer health data in response to a request for such deletion.
Section 26 of this bill prescribes requirements governing the time within which a regulated entity or an affiliate, processor or other third party with which a regulated entity has shared data must delete consumer health data in response to a request for such deletion.
Section 27 of this bill requires a regulated entity to establish a process to appeal the refusal of the regulated entity to act on a request made pursuant to section 24.
Section of this bill requires a regulated entity to establish a process to appeal the refusal of the regulated entity to act on a request made pursuant to section 24.
- *SB370_R1* – 3 – establish, implement and maintain policies and procedures to protect the security of consumer health data.
Section 28 of this bill requires a regulated entity to limit access to and establish, implement and maintain policies and procedures to protect the security of consumer health data.
1,750 feet of any person or entity that provides in-person health care services or products for certain purposes.
Section 31 of this bill prohibits a person from implementing a geofence within 1,750 feet of any person or entity that provides in-person health care services or - 82nd Session (2023) – 3 – from discriminating against a consumer for taking any action authorized byed entity sections 2-34 or to enforce those provisions.
Section 33 of this bill prohibits a regulated entity from discriminating against a consumer for taking any action authorized by sections 2-34 or to enforce those provisions.
Sections 34.1-34.9 of this bill establish provisions for the protection of biometric identifiers.
Section 34.1 of this bill sets forth certain legislative findings concerning biometric identifiers.
Section 34.3 of this bill defines “biometric identifier” to mean biometric data relating to the face, fingerprint or iris of a person.
Sections 34.35-34.45 of this bill define certain other terms.
Section 34.5 of this bill entities whose collection and sharing of data is specifically regulated by federal law;
(2) photographs collected, possessed or shared for purposes other than verifying the identity of a person;
(3) information collected, possessed or shared for certain medical or scientific purposes;
Show all 253 changed rows (213 more)
Previous
Latest
(4) governmental or tribal entities;
or (5) a person who is in the business of manufacturing or selling automobiles.
Section 34.6 of this bill authorizes the provision of information or consent under sections 34.1- 34.9 electronically.
Section 34.7 of this bill requires a person who possesses a biometric identifier of another to develop, maintain and comply with a publicly available written policy setting forth a schedule for the retention and destruction of storage, transmittal and protection of biometric identifiers.
Section 34.8 of this bill prescribes requirements governing collecting and sharing biometric identifiers.
Section 34.8 also prohibits the sale of biometric identifiers.
(NRS 598.0993) In addition to these enforcement mechanisms, existing law provides that when the Commissioner of Consumer Affairs or the Director of the Department of Business and Industry has cause to believe that a person has engaged or is engaging in any - *SB370_R1* – 4 – deceptive trade practice, the Commissioner or Director may request that the Attorney General represent him or her in instituting an appropriate legal proceeding, including an application for an injunction or temporary restraining order.
(NRS 598.0993) In addition to these enforcement mechanisms, existing law provides that when the Commissioner of Consumer Affairs or the Director of the Department of Business and Industry has cause to believe that a person has engaged or is engaging in any deceptive trade practice, the Commissioner or Director may request that the Attorney General represent him or her in instituting an appropriate legal proceeding, including an application for an injunction or temporary restraining order.
and (2) is guilty of a felony or misdemeanor, depending on the value of the With certain exceptions, sections 34 and 34.9 of this bill provide that a person who) violates any provision of sections 2-34.9 of this bill is guilty of a deceptive trade practice.
and (2) is guilty of a felony or misdemeanor, depending on the value of the property or services lost as a result of the deceptive trade practice.
Sections 1, 34 and 34.9 of this bill provide that a person injured by such a violation does not have a private right of action.
(NRS 598.0999) With certain exceptions, section 34 of this bill provides that a person who violates any provision of sections 2-34 is guilty of a deceptive trade practice.
Sections 34 and 34.9 additionally provide that the provisions of sections 2-34.9 must not be construed to affect any other provision of law.
Sections 1 private right of action.
from provisions of existing law governing information collected on the Internetrs from consumers because those provisions are less stringent than the provisions of sections 2-34.9.
Section 34 additionally provides that the provisions ofave a sections 2-34 must not be construed to affect any other provision of law.
Section 35 of this bill exempts consumer health data from provisions of existing law governing information collected on the Internet from consumers because those provisions are less stringent than the provisions of sections 2-34.
EXPLANATION – Matter in bolded italics is new;
matter between brackets [omitted material] is material to be omitted.
598.0977 [If] Except as otherwise provided in sections 34 and 34.9 of this act, an elderly person or a person with a disability suffers damage or injury as a result of a deceptive trade practice, he or she or his or her legal representative, if any, may commence a civil action against any person who engaged in the practice to recover the actual damages suffered by the elderly person or person with a disability, punitive damages, if appropriate, and reasonable attorney’s fees.
598.0977 [If] Except as otherwise provided in section 34 of this act, an elderly person or a person with a disability suffers damage or injury as a result of a deceptive trade practice, he or she or his or her legal representative, if any, may commence a civil action against any person who engaged in the practice to recover the actual damages suffered by the elderly person or person with a - 82nd Session (2023) – 4 – disability, punitive damages, if appropriate, and reasonable attorney’s fees.
thereto the provisions set forth as sections 2 to 34.9, inclusive, of this act.
1.5.
Chapter 603A of NRS is hereby amended by adding thereto the provisions set forth as sections 2 to 34.9, inclusive, of this act.
Sec.
For the purposes of - *SB370_R1* – 5 – this section, an entity shall be deemed to control another entity if the entity:
For the purposes of this section, an entity shall be deemed to control another entity if the entity:
Sec.
the measurement or technical processing of the physiological,m biological or behavioral characteristics of a person and, alone or in combination with other data, is capable of being used to identify the person.
5.
“Biometric data” means data which is generated from the measurement or technical processing of the physiological, biological or behavioral characteristics of a person and, alone or in combination with other data, is capable of being used to identify the person.
“Consumer” means a natural person who has requested a product or service from a regulated entity and who resides in this State or whose consumer health data is collected in this State.
“Consumer” means a natural person who has requested a product or service from a regulated entity and who resides in this State or whose consumer health data is collected in - 82nd Session (2023) – 5 – this State.
“Consumer health data” means personally identifiable information that is linked or reasonably capable of being linked to a consumer and that a regulated entity uses to identify the past, present or future health status of the consumer.
“Consumer health data” means personally identifiable information that is linked or reasonably capable of identify the past, present or future health status of the consumer.
and - *SB370_R1* – 6 – (7) Gender-affirming care;
and (7) Gender-affirming care;
(c) Information related to the precise location of a consumer within a radius of 1,750 feet that a regulated entity uses to indicate an attempt by a consumer to receive health care services or products;
(c) Information related to the precise geolocation information of a consumer that a regulated entity uses to indicate an attempt by a consumer to receive health care services or products;
2.
(a) Provide access to or enable gameplay by a person on a video game platform;
Does not include information that is used to provide access to or enable gameplay by a person on a video game platform.
or (b) Identify the shopping habits or interests of a consumer, if that information is not used to identify the specific past, present or future health status of the consumer.
1.
- 82nd Session (2023) – 6 – 1.
and 3.
and connection with the information described in subsection 1.lyzed in Sec.
Data concerning the health of a person that is analyzed in connection with the information described in subsection 1.
Sec.
12.5.
“Precise geolocation information” means information derived from technology, including, without limitation, latitude and longitude coordinates at the level of detail typically provided by a global positioning system, that directly identifies the specific location of a natural person with precision and accuracy within a radius of 1,750 feet.
The term does not include:
1.
The content of any communication;
or infrastructure for utilities or other equipment used by a utility.
Sec.
- *SB370_R1* – 7 – Sec.
Sec.
The term includes, without limitation, abortion, the provision of medication to induce an abortion and any medical or nonmedical services associated with an abortion.
The term includes, without limitation, abortion, the provision of medication to induce - 82nd Session (2023) – 7 – an abortion and any medical or nonmedical services associated with an abortion.
The term does not include the exchange of consumer health data for money or other valuable consideration:
The term does not include consideration:f consumer health data for money or other valuable 1.
1.
divulge, make available, provide access to, license or otherwise communicate consumer health data orally, in writing or by electronic or other means.
18.
“Share” means to release, disclose, disseminate, divulge, make available, provide access to, license or otherwise communicate consumer health data orally, in writing or by electronic or other means.
- *SB370_R1* – 8 – Sec.
(b) A financial institution or an affiliate of a financial institution that is subject to the provisions of the Gramm-Leach- Bliley Act, 15 U.S.C.
(b) A financial institution or an affiliate of a financial institution that is subject to the provisions of the Gramm-Leach-Bliley Act, 15 U.S.C.
§§ 6801 et seq., or any personally identifiable information regulated by that Act which is collected, maintained or sold as provided in that Act.
§§ 6801 et seq., or any - 82nd Session (2023) – 8 – personally identifiable information regulated by that Act which is collected, maintained or sold as provided in that Act.
§ 2.11, that is collected, used or disclosed in accordance with 42 C.F.R.
§ 2.11, that is collected, used or disclosed in accordance with 42 C.F(d) Patient safety work product, as defined in 42 C.F.R.
Part 2.
(d) Patient safety work product, as defined in 42 C.F.R.
Parts 50 and 56.
Parts 50 and 56 or in accordance with the version of the Guideline for Good Clinical Practice prescribed by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use published on November 9, 2016.
or (3) The Family Educational Rights and Privacy Act of 1974, 20 U.S.C.
(3) The Family Educational Rights and Privacy Act of 1974, 20 U.S.C.
- *SB370_R1* – 9 – (k) Any governmental or tribal entity or any person processing consumer health data on behalf of a governmental or tribal entity.
(k) Information processed by or for any governmental or tribal entity for civic or governmental purposes and operations or related services and operations.
(l) Any person who holds a non-restricted license, as defined in NRS 463.0177, or an affiliate, as defined in NRS 463.0133, of such a person.
(l) Any person who holds a nonrestricted license, as defined in NRS 463.0177, or an affiliate, as defined in NRS 463.0133, of such a person.
2.
- 82nd Session (2023) – 9 – (m) Law enforcement agencies, contractors of law enforcement agencies and law enforcement activities.
A third party that obtains consumer health data from a regulated entity through a merger, acquisition, bankruptcy or other transaction through which the third party assumes control of all or part of the assets of the regulated entity is deemed to assume all obligations of the regulated entity to comply with the provisions of sections 2 to 34, inclusive, of this act.
(n) Information that has been de-identified in accordance with the requirements for de-identification set forth in 45 C.F.R.
§ 1642.14.A third party that obtains consumer health data from a regulated entity through a merger, acquisition, bankruptcy or other transaction through which the third party assumes control of all or part of the assets of the regulated entity is deemed to assume all obligations of the regulated entity to comply with the provisions of sections 2 to 34, inclusive, of this act.
(g) The procedure for submitting a request pursuant to section 24 of this act;
of this act;edure for submitting a request pursuant to section (h) The process, if any such process exists, for a consumer to review and request changes to any of his or her consumer health data that is collected by the regulated entity;
(h) The process, if any such process exists, for a consumer to review and request changes to any of his or her consumer health data that is collected by the regulated entity;
A regulated entity shall post conspicuously on the main Internet website maintained by the regulated entity a hyperlink to the policy developed pursuant to subsection 1 or otherwise provide that policy to consumers in a manner that is clear and conspicuous.
A regulated entity shall post conspicuously on the main Internet website maintained by the regulated entity a hyperlink to the policy developed pursuant to subsection 1 or otherwise provide - 82nd Session (2023) – 10 – that policy to consumers in a manner that is clear and conspicuous.
- *SB370_R1* – 10 – 3.
3.
(a) Collect, use or share categories of consumer health data, other than those included in the privacy policy pursuant to paragraph (c) of subsection 1, without disclosing those additional categories to each consumer whose data will be collected, used or shared and obtaining the affirmative, voluntary consent of the consumer;
(a) Collect, use or share categories of consumer health data, paragraph (c) of subsection 1, without disclosing those additional categories to each consumer whose data will be collected, used or shared and obtaining the affirmative, voluntary consent of the consumer;
Any consent required by this section must be obtained before the collection or sharing, as applicable, of consumer health data.
Any consent required by this section must be obtained before the collection or sharing, as applicable, of consumer health - 82nd Session (2023) – 11 – disclose:
The request for such consent must clearly and conspicuously disclose:
request for such consent must clearly and conspicuously (a) The categories of consumer health data to be collected or shared, as applicable;
(a) The categories of consumer health data to be collected or shared, as applicable;
(b) The purpose for collecting or sharing, as applicable, the consumer health data including, without limitation, the manner in which the consumer health data will be used;
- *SB370_R1* – 11 – (b) The purpose for collecting or sharing, as applicable, the consumer health data including, without limitation, the manner in which the consumer health data will be used;
(a) Confirm whether the regulated entity is collecting, sharing or selling consumer health data relating to the consumer.
or selling consumer health data relating to the consumer., sharing (b) Provide the consumer with a list of all third parties with whom the regulated entity has shared consumer health data relating to the consumer or to whom the regulated entity has sold such consumer health data.
(b) Provide the consumer with a list of all third parties with whom the regulated entity has shared consumer health data relating to the consumer or to whom the regulated entity has sold such consumer health data.
and (b) The ability of the regulated entity to authenticate the identity of the consumer making the request.
and (b) The ability of the regulated entity to authenticate the ideSec.
Sec.
1.
1.e coExcept as otherwise provided in this section, a regulated entity shall respond to a request made pursuant to section 24 of this act without undue delay and not later than 45 days after authenticating the request.
Except as otherwise provided in this section, a regulated entity shall respond to a request made pursuant to section 24 of this act without undue delay and not later than 45 days after authenticating the request.
A regulated entity that grants itself such an extension must, not later than 45 days after authenticating the request, provide the consumer with notice of the extension and the reasons therefor.
A regulated entity that grants itself such an extension must, not later than - 82nd Session (2023) – 12 – days after authenticating the request, provide the consumer with notice of the extension and the reasons therefor.
If a regulated entity is not able to authenticate a request made pursuant to section 24 of this act after making commercially reasonable efforts, the regulated entity:
If a regulated entity is not able to authenticate a request made pursuant to section 24 of this act after making commercially rea(a) Is not required to comply with the request;
(a) Is not required to comply with the request;
and (b) May request that the consumer provide such additional information as is reasonably necessary to authenticate the request.
and - *SB370_R1* – 12 – (b) May request that the consumer provide such additional information as is reasonably necessary to authenticate the request.
Not later than 30 days after authenticating a request made pursuant to paragraph (d) of subsection 1 of section 24 of this act for the deletion of consumer health data, a regulated entity shall, except as otherwise provided in subsection 3:
Not later than 30 days after authenticating a request made pursuant to paragraph (d) of subsection 1 of section of this act for the deletion of consumer health data, a regulated ent(a) Delete all consumer health data described in the request from the records and network of the regulated entity;
(a) Delete all consumer health data described in the request from the records and network of the regulated entity;
If data described in a deletion request made pursuant to paragraph (d) of subsection 1 of section 24 of this act is stored or archived on backup systems, a regulated entity or an affiliate, processor, contractor or other third party may delay the deletion of the data for not more than 6 months after the request is authenticated, as necessary to restore the archived or backup system.
If data described in a deletion request made pursuant to paragraph (d) of subsection 1 of section 24 of this act is stored or archived on backup systems, a regulated entity or an affiliate, processor, contractor or other third party may delay the deletion of - 82nd Session (2023) – 13 – the data for not more than 2 years after the request is authenticated, as necessary to restore the archived or backup system.
A regulated entity shall establish a process by which a consumer may appeal the refusal of the regulated entity to act on a request made pursuant section 24 of this act.
A regulated entity shall establish a process by act on a request made pursuant to section 24 of this act.
The process must be:
Thety to process must be:
- *SB370_R1* – 13 – (a) Conspicuously available on the Internet website of the regulated entity;
(a) Conspicuously available on the Internet website of the regulated entity;
(a) Further the purpose for which the consumer consented to the collection or sharing of the consumer data pursuant to section 22 of this act;
(a) Further the purpose for which the consumer consented to the collection or sharing of the consumer data pursuant to section of this act;
or (b) Provide a product or service that the consumer to whom the consumer health data relates has requested from the regulated entity.
or (b) Provide a product or service that the consumer to whom entity.sumer health data relates has requested from the regulated 2.
2.
Such a contract must set forth the applicable processing instructions and the specific actions that the processor is authorized to take with regard to the consumer health data it possesses on behalf of the regulated entity.
Such a contract must set forth the applicable processing instructions and the specific actions that the processor is - 82nd Session (2023) – 14 – authorized to take with regard to the consumer health data it possesses on behalf of the regulated entity.
To the extent practicable, a processor shall assist the regulated entity with which the processor has entered into a contract pursuant to subsection 1 in complying with the provisions of sections 2 to 34, inclusive, of this act.
To the extent practicable, a processor shall assist the regulated entity with which the processor has entered into a of sections 2 to 34, inclusive, of this act.ng with the provisions 3.
3.
- *SB370_R1* – 14 – (a) Is not guilty of a deceptive trade practice pursuant to section 34 of this act solely because the processor violated the requirements of this section;
(a) Is not guilty of a deceptive trade practice pursuant to section 34 of this act solely because the processor violated the requirements of this section;
Written authorization pursuant to subsection 1 must be provided in a form written in plain language which includes, without limitation:
Written authorization pursuant to subsection 1 must be provided in a form written in plain language which includes, wit(a) The name and contact information of the person selling the consumer health data;
(a) The name and contact information of the person selling the consumer health data;
(g) A statement that any consumer health data sold pursuant to the written authorization may be disclosed to additional persons and entities by the person described in paragraph (c) and, after such disclosure, is no longer subject to the protections of this section;
- 82nd Session (2023) – 15 – (g) A statement that any consumer health data sold pursuant to the written authorization may be disclosed to additional persons and entities by the person described in paragraph (c) and, after such disclosure, is no longer subject to the protections of this sec(h) The date on which the written authorization expires pursuant to subsection 5;
(h) The date on which the written authorization expires pursuant to subsection 5;
- *SB370_R1* – 15 – 4.
4.
A person who sells consumer health data shall provide a copy of the written authorization provided pursuant to subsection 1 to the consumer who signed the written authorization and the purchaser of the consumer health data.
A person who sells consumer health data shall provide a copy of the written authorization provided pursuant to subsection to the consumer who signed the written authorization and the purchaser of the consumer health data.
A seller and purchaser of consumer health data shall each retain a copy of the written authorization provided pursuant to subsection 1 for at least 6 years after the date on which the written authorization expired pursuant to subsection 5.
A seller and purchaser of consumer health data shall each retain a copy of the written authorization provided pursuant to authorization expired pursuant to subsection 5.e on which the written Sec.
9.
The provisions of this section do not authorize the sale of a biometric identifier, as prohibited by subsection 3 of section 34.8 of this act.
Sec.
(b) “Geofence” means technology that uses coordinates for global positioning, connectivity to cellular towers, cellular data, radio frequency identification, wireless Internet data or any other form of detecting the physical location of a person to establish a virtual boundary with a radius of 1,750 feet or less around a specific physical location.
- 82nd Session (2023) – 16 – (b) “Geofence” means technology that uses coordinates for global positioning, connectivity to cellular towers, cellular data, radio frequency identification, wireless Internet data or any other form of detecting the physical location of a person to establish a specific physical location.ius of 1,750 feet or less around a (c) “Medical facility” has the meaning ascribed to it in NRS 449.0151.
(c) “Medical facility” has the meaning ascribed to it in NRS 449.0151.
(Deleted by amendment.) - *SB370_R1* – 16 – Sec.
(Deleted by amendment.) Sec.
Sec.
Secs.
34.1.
34.1, 34.2, 34.3, 34.35, 34.4, 34.45, 34.5, 34.6, 34.7, 34.8 and 34.9.
The Legislature hereby finds and declares that:
(Deleted by amendment.) Sec.
1.
The use of biometric identifiers to verify the identity of persons in personal and business settings is growing and is likely to streamline online transactions and the management of digital accounts, strengthen the security of identities and reduce the risk of cybersecurity issues and fraud for governmental entities, businesses and consumers.
2.
Biometric identifiers are unlike other identifiers that are used to verify the identity of a person or access a digital account because biometric identifiers are unique to a person and are not capable of being changed if stolen.
3.
Without ongoing measures to protect the security of biometric identifiers, persons are at a heightened risk of identity theft.
4.
The public welfare, security and safety will be served by regulating the collection, use, security, handling, storage, retention and destruction of biometric identifiers.
Sec.
34.2.
As used in sections 34.1 to 34.9, inclusive, of this act, unless the context otherwise requires, the words and terms defined in sections 34.3 to 34.45, inclusive, of this act have the meanings ascribed to them in those sections.
Sec.
34.3.
“Biometric identifier” means biometric data relating to the face, fingerprint or iris of a person.
The term includes, without limitation, data from a photo identification document that contains the image of the face of a person with sufficient resolution that artificial intelligence or a machine learning algorithm is able to match the data with other biometric data to positively identify the person.
Sec.
34.35.
“Collect” means to access, retain, receive, acquire, infer, derive or otherwise obtain a biometric identifier in any manner.
- *SB370_R1* – 17 – Sec.
34.4.
“Share” means to release, disclose, disseminate, divulge, make available or provide access to a biometric identifier.
Sec.
34.45.
“Subject” means the natural person to whom a biometric identifier relates.
Sec.
34.5.
The provisions of sections 34.1 to 34.9, inclusive, of this act do not apply to:
1.
Any person or entity that is subject to the provisions of the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, and the regulations adopted pursuant thereto.
2.
A financial institution or an affiliate of a financial institution that is subject to the provisions of the Gramm-Leach- Bliley Act, 15 U.S.C.
§§ 6801 et seq., or any personally identifiable information regulated by that Act which is collected, maintained or sold as provided in that Act.
3.
Physical or digital photographs collected, possessed or shared for purposes not related to verifying the identity of the subject.
4.
Information collected, possessed or shared for a medical purpose or to validate scientific testing or screening.
5.
Any governmental or tribal entity or any person who collects, possesses or shares a biometric identifier on behalf of a governmental or tribal entity.
6.
Any person in the business of manufacturing or selling automobiles, when acting in that capacity.
Sec.
34.6.
For the purposes of sections 34.1 to 34.9, inclusive, of this act:
1.
Any information required to be provided in writing may be provided electronically;
and 2.
Any consent or release may be obtained electronically.
Sec.
34.7.
A person who possesses a biometric identifier that relates to another person shall:
1, Develop, maintain and comply with a written policy setting forth a schedule for and procedures governing the retention and destruction of biometric identifiers.
Except where preservation of a biometric identifier for a longer period of time is required by law, subpoena or an order by a court of competent jurisdiction or other lawful authority, such a policy must require the destruction of a biometric identifier on or before the earlier of:
(a) The date on which the initial purpose of obtaining the biometric identifier has been satisfied;
or (b) One year after the most recent interaction between the person in possession of the biometric identifier and the subject.
2.
Make the policy established pursuant to subsection 1 available to the public.
- *SB370_R1* – 18 – 3.
Store and transmit biometric identifiers and protect biometric identifiers from disclosure a manner that:
(a) Meets the standard of care in the industry in which the person operates;
and (b) Is at least as protective as the manner in which the person stores, transmits or protects from disclosure, as applicable, other personally identifiable information.
Sec.
34.8.
1.
Before collecting a biometric identifier, a person shall:
(a) Inform the subject or his or her representative in writing:
(1) That the biometric identifier is being collected;
(2) The purpose for which the biometric identifier is being collected.
stored and used;
and (3) The length of time for which the biometric identifier will be retained in accordance with the policy developed pursuant to section 34.7 of this act;
(b) Obtain the informed written consent of the subject or his or her representative which may include, without limitation, a written release executed as a condition of employment;
and (c) Verify of the identity of the subject and any representative providing written consent pursuant to paragraph (b) in a manner that meets the requirements of Special Publication 800-63-3 published by the National Institute of Standards and Technology of the United States Department of Commerce.
2.
At the time a person collects a biometric identifier, the person shall ensure that the subject is present.
3.
A person shall not sell, lease, trade or otherwise receive compensation for sharing a biometric identifier.
4.
A person shall not share a biometric identifier unless:
(a) The subject or his or her representative consents to the sharing;
(b) The sharing completes a financial transaction requested or authorized by the subject or his or her representative;
(c) The sharing is required by law, a court order, a subpoena, a search warrant or other lawful process;
or (d) The sharing is performed by a person who holds a nonrestricted license, as defined in NRS 463.0177, and the biometric identifier is shared with a subsidiary or affiliate of the person for the purpose of security or surveillance.
Sec.
34.9.
1.
Except as otherwise provided in this section, a violation of sections 34.1 to 34.9, inclusive, of this act constitutes a deceptive trade practice for the purposes of NRS 598.0903 to 598.0999, inclusive.
2.
The provisions of sections 34.1 to 34.9, inclusive, of this act:
- *SB370_R1* – 19 – (a) Do not create a private right of action;
and (b) Must not be construed to affect any other provision of law.
Sec.
1.
1681a(f);
A consumer reporting agency, as defined in 15 U.S.C.
consumer reporting agency, as defined in 15 U.S.C.
§ 1681a(f);
§ 2.
2.
personally identifiable information for the purposes of fraud prevention;
3.
A person who collects, maintains or makes sales of personally identifiable information for the purposes of fraud prevention;
[or] 6.
[or] - 82nd Session (2023) – 17 – sections 2 to 34, inclusive, of this act;
Any consumer health data subject to the provisions of sections 2 to 34, inclusive, of this act;
orthe provisions of 7.
7.
Any biometric identifiers subject to the provisions of sections 34.1 to 34.9, inclusive, of this act;
or 8.
H - *SB370_R1*
Sec.
36.
This act becomes effective on March 31, 2024.
~~~~~ 23 - 82nd Session (2023)
⬇ Download PDF
View plain text versions (6)

How this bill changes current law

2 changes Share ↗

Compared against the Nevada Revised Statutes as published AI-generated reading aid — verify against the official bill.

The bill amends existing law to include specific protections and requirements for consumer health data.

  • NRS 598.0977

    If an elderly person or a person with a disability suffers → Except as otherwise provided in section 34 of this act, an elderly person or a person with a disability suffers

    This change clarifies that the new provisions in section 34 may alter the conditions under which elderly persons or persons with disabilities can bring civil actions.

  • NRS 598.0973

    a civil penalty of not more than $12,500 for each violation upon a person whom the court finds has engaged in a deceptive trade practice directed toward an elderly person or a person with a disability.

    This implies potential changes in the enforcement of civil penalties for deceptive trade practices, specifically regarding protections for elderly persons and persons with disabilities.

Amendments

4 amendments

Click Show changes on an amendment above to see how it modifies the bill.

Action History

  1. Chapter 525.

  2. Approved by the Governor.

  3. Enrolled and delivered to Governor.

  4. From printer. To re-engrossment. Re-engrossed. Fourth reprint. To enrollment.

  5. To printer.

  6. Assembly Amendment Nos. 679 and 742 not receded from. Conference requested. Conference Committee appointed by Assembly. To Senate. In Senate. Conference Committee appointed by Senate. To committee. From committee: Concur in Assembly Amendment Nos. 679 and 742 and further amend. (Conference Amend. No. CA2.) Conference report adopted by Senate. Conference report adopted by Assembly.

  7. In Assembly.

  8. Assembly Amendment Nos. 679 and 742 not concurred in. To Assembly.

  9. In Senate.

  10. From printer. To reengrossment. Reengrossed. Second reprint. Read third time. Amended. (Amend. No. 742.) To printer. From printer. To reengrossment. Reengrossed. Third reprint. Read third time. Passed, as amended. Title approved, as amended. (Yeas: 33, Nays: 8, Excused: 1.) To Senate.

  11. From committee: Amend, and do pass as amended. Placed on Second Reading File. Read second time. Amended. (Amend. No. 679.) To printer.

  12. In Assembly. Read first time. Referred to Committee on Commerce and Labor. To committee.

  13. From printer. To engrossment. Engrossed. First reprint. Read third time. Passed, as amended. Title approved, as amended. (Yeas: 13, Nays: 8.) To Assembly.

  14. From committee: Amend, and do pass as amended. Placed on Second Reading File. Read second time. Amended. (Amend. No. 403.) To printer.

  15. From printer. To committee.

  16. Read first time. Referred to Committee on Commerce and Labor. To printer.

Sponsors

Sponsorship breakdown

Export CSV (upgrade) →

3 sponsors · 6 co-sponsors · 58 not signed on

Sponsors (3)

Co-sponsors (6)

Not signed on (58)

58 members have not signed on to this bill.

Show all 58 →

"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.

Whip count is in markup. Polling the chamber and every recorded vote this session. Only the first open is slow. It’s instant for you after this. Calling the roll · Tallying · Engrossing

Subjects

technology
Cross-referencing the record. Reading this bill against every other bill in the corpus by meaning, not keywords. Only the first open is slow. It’s instant for you after this. Matching · Ranking · Engrossing

Frequently asked questions

Who sponsors SB 370?
SB 370 is sponsored by Cannizzaro, Nicole J. (Democratic), Nguyen, Rochelle T. (Democratic), Doñate, Fabian (Democratic), Daly, Skip (Democratic), Lange, Roberta (Democratic), Neal, Dina (Democratic), Pazina, Julie (Democratic), Scheible, Melanie (Democratic), and Harris, Dallas.
What is the current status of SB 370?
This bill has been enacted into law. Introduced March 23, 2023. Enacted.
Where can I track SB 370?
Track SB 370 free on One Click Politics — get push/email alerts when it moves.

Make your voice heard on SB 370

Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.

Find my representatives → Run a campaign

Stay ahead of SB 370

Last checked for changes 3 months ago · updated continuously

One Click Politics tracks every bill in Congress and all 50 states.

Track this bill →