SB 63 — Revises provisions relating to the processing of certain data. (BDR 52-505)

(NRS 100.180, 111.2397, 118A.275, 202.24935, 205.377, 226.600, 228.620, 370.695, 597.7642, 597.818, 597.997, 603.170, 603A.260, 603A.550, 604B.910, 676A.770;

chapter 598 of NRS) Existing law authorizes a court or the Director of the Department of Business and Industry to impose a civil penalty of not more than $25,000 for each violation upon a person who has engaged in a deceptive trade practice directed toward a minor.

(NRS 598.09735) In addition, existing law provides that when the Commissioner of Consumer Affairs or the Director has cause to believe that a person has engaged or is engaging in any deceptive trade practice, the Commissioner or Director may request that the Attorney General represent him or her in instituting an appropriate legal proceeding, including an application for an injunction or temporary restraining injunctionorder. resulting from a complaint brought by the Commissioner, the Director,or the district attorney of any county of this State or the Attorney General to pay a civil penalty of not more than $10,000 for each violation.

(NRS 598.0979) Existing law requires a person who violates a court order or the district attorney of any county of this State or the Attorney General to pay a civil penalty of not more than $10,000 for each violation.

(1) may be required to pay an additional civil penalty - *SB63_R2* – 3 – not more than $15,000 for each violation;

and (2) is guilty of a felony or misdemeanor, depending on the value of the property or services lost as a result of General, upon determining that a controller has violated or is violating anyy provision of sections 24-35, to provide the controllerdeceptive writtentrade noticepractice. of the alleged violation.

(NRS 598.0999) Section 21 makes a violation of sections 2-21 a deceptive trade practice.

Section 35 requires the Attorney General, sections 24-35, to provide the controller written notice of the alleged violation.

SectionTHE 35PEOPLE grantsOF theTHE AttorneySTATE GeneralOF providesNEVADA, thatREPRESENTED thoseIN sectionsSENATE doAND notASSEMBLY, createDO aENACT privateAS rightFOLLOWS: of action.

and further THE PEOPLE OF THE STATE OF NEVADA, REPRESENTED IN SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS:

(DeletedChapter 603 of NRS is hereby amended by amendment.)adding Sec.thereto the provisions set forth as sections 2 to 21, inclusive, of this act.

Sec.

(DeletedSections by2 amendment.)to Sec.21, inclusive, of this act may be cited as the Nevada Youth Online Safety Act.

Sec.

(DeletedAs byused amendment.)in Sec.sections 2 to 21, inclusive, of this act, unless the context otherwise requires, the words and terms defined in sections 4 to 11, inclusive, of this act have the meanings ascribed to them in those sections.

- *SB63_R1* – 4 – Sec.

(Deleted“Affiliate” bymeans amendment.)a Sec.person that directly, or indirectly through one or more intermediaries, is controlled by, or is under common control with, a specified person.

As used in this section, “control,” “controlling,” “controlled by,” and “under common control with” has the meaning ascribed to it in NRS 78.418.

Sec.

(Deleted“Cloud bystorage” amendment.)means Sec.a service that enables a person to have self-service and on-demand access to a network of configurable computer resources, including, without limitation, data storage services, analytics services and document sharing and editing services that are hosted on or backed up to the Internet.

Sec.

(Deleted“Covered bydigital amendment.)platform”: Sec.

1.

Means an online application, Internet website or other online product, good or service that:

(a) Allows a person to:

(1) Become a registered user;

and (2) Establish an account, create a profile or otherwise create, share and view user-generated content;

and (b) Serves as a medium for users to:

(1) Interact with other users through accounts, profiles or other means;

or (2) Interact with or otherwise view the content generated by other users of the platform.

2.

Does not include an online application, Internet website or other online product, good or service that:

(a) Is used or intended for the exclusive or nearly exclusive purpose of:

(1) Sending or receiving electronic mail;

(2) Sending or receiving text messages;

(3) Facilitating teleconferencing or videoconferencing that enables two or more persons who have provided their contact information to each other to communicate in real time through the transmission and reception of audio and video signals;

(4) Facilitating cloud storage or cloud computing services, including, without limitation, a service that allows users to collaborate in real time to edit digital documents and photographs;

(5) Providing to pupils enrolled in a public school in this State educational or instructional materials that have been approved by the Department of Education, the board of trustees of a school district or the governing body of a charter school or university school for profoundly gifted pupils, as applicable;

(6) Enabling users to obtain technical support for a product or service;

- *SB63_R1* – 5 – (7) Enabling users to search and apply for employment opportunities and engage in other career development activities;

(8) Enabling users to shop and purchase goods and services online or to otherwise facilitate electronic commerce activities;

(9) Distributing and facilitating the download of applications and programs developed by third party developers within a single application or service which enables users to search for and download such applications and programs;

(10) Providing users with news, sports, entertainment or other content that:

(I) Is specifically selected or curated by the platform for inclusion on the platform and is not generated by users of the platform;

and (II) Is not provided with any chat or comment feature or other interactive functionality, unless such feature or functionality is incidental to, directly relates to or is dependent upon the content provided by the platform;

(11) Enabling an employer to facilitate communication with and among employees of the employer using means that are provided or hosted by the employer;

or (12) Facilitating telehealth or other forms of electronic communication between a patient and a provider of health care using means which are provided or hosted by the provider of health care.

(b) Is operated or controlled by a nonprofit organization that is recognized as exempt under section 501(c) of the Internal Revenue Code.

(c) Facilitates interactive gaming, as defined in NRS 463.016425.

(d) Provides a social gaming product or service and is operated or controlled by a gaming licensee, an affiliate of a gaming licensee or a third party that provides online services on behalf of a gaming licensee or an affiliate of a gaming licensee.

Sec.

(Deleted“Gaming bylicensee” amendment.)has Sec.the meaning ascribed to “licensee” in NRS 463.0171.

Sec.

(Deleted“Minor” bymeans amendment.)a Sec.natural person who is less than 18 years of age.

Sec.

(Deleted“Minor byuser” amendment.)means Sec.a user of a covered digital platform who is a minor.

Sec.

(Deleted“Online bycontact amendment.)information” Sec.means a unique user identifier or username that can be used to facilitate direct contact with a specific person online, including, without limitation:

1.

An electronic mail address;

or - *SB63_R1* – 6 – 2.

A user identifier or handle associated with a covered digital platform, an instant messaging platform, a voice over Internet protocol platform or a video chatting platform.

Sec.

(Deleted“Provider byof amendment.)health Sec.care” has the meaning ascribed to it in NRS 629.031.

Sec.

(Deleted“Social bygaming amendment.)product” Sec.means an online or mobile-based product or service that:

1.

Enables users to play casino-style games that are free to play;

2.

Utilizes digital tokens, coins or other digital representations of artificial value that:

(a) Do not have legal tender status recognized by the United States;

(b) Have no cash value;

and (c) Can only be utilized or redeemed by the user within the interface of the product or service;

3.

Is operated by or promoted in conjunction with a gaming licensee;

and 4.

Is specifically intended for and marketed to users who are 21 years of age or older.

Sec.

(Deleted“Telehealth” byhas amendment.)the Sec.meaning ascribed to it in NRS 629.515.

Sec.

(Deleted“User” bymeans amendment.)a Sec.person who uses a covered digital platform.

Sec.

(DeletedThe byprovisions amendment.)of Sec.sections 2 to 21, inclusive, of this act do not:

1.

Require a covered digital platform to take any action with regard to a user who does not reside in this State.

2.

Apply to any covered digital platform which does not offer services to users who are located within this State.

Sec.

(Deleted1. by amendment.) Sec.

Except as authorized by subsection 2, a covered digital platform shall not use the personal information of a minor user in an algorithmic recommendation system.

2.

A covered digital platform may use the personal information of a minor user in an algorithmic recommendation system to prevent the covered digital platform from displaying or recommending to a minor user content or advertising relating to products or services, the purchase, possession or use of which by a - *SB63_R1* – 7 – minor is prohibited by law, including, without limitation, content or advertising relating to alcohol, tobacco or cannabis products.

3.

The provisions of subsection 1 shall not be construed to prohibit contextual information delivery.

4.

As used in this section:

(a) “Algorithmic recommendation system” means a fully or partially automated system that suggests, promotes or ranks information for, or presents advertising to, a user.

(b) “Consumer device” means an electronic device that is used primarily for personal, family or household purposes and which connects to the Internet.

The term may include, without limitation, a computer, smartphone, electronic tablet, smartwatch, router, Internet gateway, smart television or video game console.

(c) “Contextual information delivery” means the delivery of information or advertising to a user based on inferences drawn exclusively from the specific content of the specific page, forum or other Internet website that a user is currently viewing at the time during which the information or advertisement is being provided on that page, forum or other Internet website.

The term does not include the recommendation of information or advertising in whole or in part based on other pages, forums or other Internet websites that have been viewed by a user.

(d) “Persistent identifier” means any data point that can be used to recognize a specific user or a specific consumer device belonging to a specific user over time and across different Internet websites, applications and other online services.

The term includes, without limitation:

(1) An Internet cookie which contains a customer number;

(2) An Internet protocol address;

or (3) The serial number or unique identifier of a consumer device.

(e) “Personal information” means information that is linked or can reasonably be linked to a specific user, household or consumer device, including, without limitation:

(1) A last name when accompanied by either a first name, set of initials or a nickname;

(2) A date of birth;

(3) A physical address, including, without limitation, a home, work or school address;

(4) Online contact information;

(5) A telephone number;

(6) A government-issued identification number, including, without limitation, a social security number, passport number or driver’s license number;

- *SB63_R1* – 8 – (7) An image or voice contained within a photo, video or audio file or in any other data;

(8) Information concerning a geographic location that is sufficient to identify both the name of a street and the locality in which the street is located;

or (9) A persistent identifier.

Sec.

(Deleted1. by amendment.) Sec.

A covered digital platform shall accept and comply with a request from the parent or guardian of a minor user to disable any or all of the following features on the account of the minor user and refrain from causing any content viewed by a minor user to be delivered through or accompanied by any or all of the following features:

(a) Infinite scrolling, including, without limitation:

(1) Content that continuously loads as the user scrolls down the page without the need for the user to open a separate page and which has no apparent end;

or (2) The use of pages with no visible or apparent end as the user continues to scroll.

(b) The display of interactive metrics, icons or emoticons which indicate:

(1) That another user has clicked a button to indicate their reaction to a user’s content;

or (2) The number of times that other users have shared, liked or reposted the user’s content.

(c) Video that begins to play without the user first clicking on the video or on a play button for that video.

(d) Functions that allow a user or advertiser to broadcast live video content in real-time to other users of the platform.

2.

For the purposes of this section, a covered digital platform shall be deemed to have disabled infinite scrolling if the covered digital platform limits a minor user to viewing the lesser of:

(a) Six or fewer discrete items of content before the minor user is required to open a separate page to view additional content or click a button or pop-up warning to consciously indicate his or her intent to view additional content;

or (b) Seven minutes worth of continuously loading content before the page on which the content is shown ends or before the minor user is required to open a separate page to view additional content or click a button or pop-up warning to consciously indicate his or her intent to view additional content.

3.

As used in this section, “content” does not include any content, material or other media that is generated by or within an interactive video game which is necessary for or incidental to the use and enjoyment of the interactive video game.

Sec.

(Deleted1. by amendment.) Sec.

A covered digital platform shall:

- *SB63_R1* – 9 – (a) Establish safeguards to limit the amount of time that minor users spend using the covered digital platform each day and the hours of the day during which the covered digital platform sends notices to minor users that are reasonable for the digital platform under the relevant circumstances;

or (b) Except as otherwise provided in subsection 3, refrain from sending notifications to a minor user:

(1) Between the hours of 12 a.m.

and 6 a.m., based on the time zone in which the minor user is located;

or (2) Between the hours of 8 a.m.

and 3 p.m., Monday through Friday, during the months of August through May, based on the time zone in which the minor user is located.

2.

Except as otherwise provided in subsection 3, a covered digital platform that receives a request from the parent or guardian of a minor user shall not send notifications to the minor user:

(a) Between the hours of 12 a.m.

and 6 a.m., based on the time zone in which the minor user is located;

or (b) Between the hours of 8 a.m.

and 3 p.m., Monday through Friday, during the months of August through May, based on the time zone in which the minor user is located.

3.

A covered digital platform subject to the provisions of paragraph (b) of subsection 1 or subsection 2 may send a notification to a minor user during a time period where the delivery of a notification would otherwise be prohibited by those provisions if the delivery of the notification is necessary:

(a) For the support of the internal operations of the covered digital platform;

or (b) To effectuate settings or restrictions made by the parent or legal guardian of the minor user through any parental control features established by the platform.

4.

As used in this section, “support of the internal operations of the covered digital platform” has the definition ascribed to “support for the internal operations of the Web site or online service” in 16 C.F.R.

§ 312.2.

Sec.

(DeletedA byviolation amendment.)of Sec.the provisions of sections 2 to 21, inclusive, of this act constitutes a deceptive trade practice for the purposes of NRS 598.0903 to 598.0999, inclusive.

Sec.

(Deleted by amendment.) - *SB63_R2* – 4 – Sec.

As used in sections 24 to 35, inclusive, of this act unless the context otherwise requires, the words and terms defined - *SB63_R1* – 10 – in sections 25 to 31.9,31, inclusive, of this act have the meanings ascribed to them in those sections.

25.7.

“Consumer” means a natural person who is a resident of this State and who is acting in an individual or personal capacity.

The term does not include a natural person who is acting in a commercial or employment capacity.

Sec.

28.5.

“Known child” means a person whom a controller knows to be a child.

Sec.

Does not include de-identified data or publiclypublically available information.

“Process” means to perform any operation or set of operations, whether performed by manual or automated means, on - *SB63_R2* – 5 – personal data, including, without limitation, the collection, use, storage, disclosure, analysis, deletion or modification of personal data.

31.3.

“Processor” means a person who processes data on behalf of a controller.

Sec.

31.5.

“Publicly available information” means information that:

1.

Is lawfully made available through the records of a governmental entity;

or 2.

A business has a reasonable basis to believe is made to be lawfully available to the general public:

(a) Through a channel of media that is widely distributed;

(b) By the consumer to whom the information pertains;

or (c) By a person to whom the consumer to whom the information pertains has disclosed the information, unless the consumer has restricted the information to a specific audience.

Sec.

31.7.

“Sale” means the exchange of personal data with a third party for money or other valuable consideration.

The term does not include:

1.

The disclosure of personal data by a controller to a processor that processes personal data on behalf of the controller;

2.

The disclosure of personal data to a third party for purposes of providing a product or service requested by a consumer;

3.

The disclosure or transfer of personal data to an affiliate of the controller;

4.

The disclosure of information pertaining to a consumer that the consumer:

(a) Has intentionally made available to the general public through a channel of media that is widely distributed;

and (b) Did not restrict to a particular audience;

or 5.

The disclosure or transfer of personal data to a third party as an asset that is a part of a merger, acquisition, bankruptcy or other transaction in which the third party assumes control of all or part of the assets of the controller.

Sec.

31.9.

“Third party” means a person or entity that is not a consumer, controller, processor or affiliate of a controller or processor.

Sec.

§§ 1681 et seq., and the - *SB63_R2**SB63_R1* – 611 – regulations adopted pursuant thereto, which is collected, maintained or sold as provided in that Act;

or (g) A controller that, during a calendar year:

or (2) Processes the personal data of less than 100,000 residents of this State and derives less than 50 percent of its gross revenue from the sale of personal data;data.

or (h) A person who is subject to the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, and the regulations adopted pursuant thereto, including, without limitation, a covered entity or a business associate of a covered entity, as those terms are defined in 45 C.F.R.

§ 160.103.

3.

Do not apply to the extent that such application would restrict the ability of a controller or processor to:

(a) Comply with all applicable federal, state and local laws, regulations and ordinances;

(b) Comply with a civil, criminal or regulatory inquiry or investigation conducted by a governmental entity or a subpoena or summons issued by a governmental entity;

(c) Cooperate with a law enforcement agency concerning conduct or activity that the controller or processor reasonably, and in good faith, believes may violate any federal, state or local law or regulation;

(d) Investigate, establish, exercise, prepare for or defend a legal claim;

(e) Provide a product or service that is specifically requested by a consumer;

- *SB63_R2* – 7 – (f) Perform under a contract to which a consumer is a party, including, without limitation, fulfilling the terms of a written warranty;

(g) Before entering into a contract with a consumer, take steps requested by the consumer relating to the formation of the contract;

(h) Take immediate steps to protect an interest that is essential for the life or physical safety of a consumer or other person, unless those steps are clearly taken for another purpose;

(i) Prevent, detect, protect against or respond to:

(1) A security incident;

(2) An instance of identity theft, fraud or harassment;

(3) A malicious or deceptive activity;

or (4) Any illegal activity;

(j) Preserve the integrity or security of systems or investigate, report or assist in the prosecution of those responsible for any activity described in paragraph (i);

(k) Assist in public or peer-reviewed scientific or statistical research which:

(1) Is in the public interest;

(2) Adheres to all applicable laws relating to privacy and ethics;

and (3) Is approved, monitored and governed by a board of institutional review, or a similar entity that independently oversees such research, that determines:

(I) Whether the deletion of information used in such research is likely to provide substantial benefits that do not exclusively accrue to the controller;

(II) That the expected benefits of the research outweigh any applicable privacy risks;

and (III) Whether the controller has implemented reasonable safeguards to mitigate any risks to privacy associated with such research, including, without limitation, risks associated with the re-identification of data;

(l) Assist another controller, processor, regulated entity, as defined in NRS 603A.465, or third party with complying with the requirements of NRS 603A.400 to 603A.550, inclusive;

or (m) Process personal data for purposes which are in the public interest and relate to public, community or population health, but only to the extent that such processing is subject to:

(1) Suitable and specific measures to safeguard the rights of the consumer whose personal data is being processed;

and (2) All applicable confidentiality requirements imposed by federal, state or local law and overseen by a person subject to such requirements.

- *SB63_R2* – 8 – Sec.

32.5.

A controller that is in possession of any de- identified data shall:

1.

Take reasonable measures to ensure that the data cannot be associated with a natural person;

2.

Publicly commit to maintaining and using the de-identified data without attempting to re-identify the data;

and 3.

Contractually obligate any recipients of de-identified data provided by the controller to comply with the requirements of this section with respect to such data.

Before processing personal data from a knownperson childwhom ora collectingcontroller theknows preciseto geolocationbe data of a known child, the controller shall obtain verifiable consent from the parent or legal guardian of the child in accordance with the Federal Children’s Online Privacy Protection Act, 15 U.S.C.

A controller shall not process any personal data of a knownperson whom the controller knows to be a child:

or (3) Profiling the child in furtherance of decisions that produce legal or similarly significant effects concerning the child;

or (b) UnlessFor theany processingpurpose that is not reasonably necessary and limited in duration to enable the controller to provide the online service, product or feature offered by the controller;controller.

or (c) For longer than is reasonably necessary to enable the controller to provide the online service, product or feature offered by the controller.

At the time that a controller collects personal data from a knownperson the controller knows to be a child with the intent of further processing the personal data, the controller shall disclose the purpose of the processing to the child.

or - *SB63_R1* – 12 – (b) Where the additional processing is reasonably necessary for carrying out and compatible with the purpose disclosed to the child.

A controller shall not collect precise geolocation data from a knownperson whom the controller knows to be a child unless:

- *SB63_R2* – 9 – (1) Informs the child that his or her precise geolocation data is being collected;

(a) “Decision“Precise thatgeolocation producesdata” legal or similarly significant effects” means ainformation decisionderived madefrom bytechnology, aincluding, controllerwithout thatlimitation, resultslatitude inand thelongitude provisioncoordinates orat denial by the controllerlevel of financialdetail andtypically lendingprovided services,by housing,a insurance,global enrollmentpositioning insystem, education,that criminaldirectly justice,identifies employmentthe opportunities,specific healthlocation careof servicesa ornatural accessperson towith basicprecision necessities,and including,accuracy withoutwithin limitation,a foodradius andof water.1,750 feet.

(b) “Precise geolocation data” means information derived from technology, including, without limitation, latitude and longitude coordinates at the level of detail typically provided by a global positioning system, that directly identifies the specific location of a natural person with precision and accuracy within a radius of 1,750 feet.

(c)(b) “Profiling” means a form of automated processing performed on the personal data of a particular person that evaluates, analyzes or predicts the personal aspects relating to the person, including, without limitation, the economic status, health status, personal preferences, interests, reliability, behavior, location or movements of the person.

(d)(c) “Targeted advertising”:

(1) Means the display of advertisements to a consumeruser of an online service, product or feature that are selected or recommended based on the personal data obtained from the online activity of the consumeruser over time and across other online services, products or features that are not affiliated with the online service, product or feature or the controller thereofthereof. for the purpose of predicting the preferences or interests of the consumer.

(I) Advertisements based on the activity of a consumeruser within online services, products or features operated by the same controller;

- *SB63_R1* – 13 – (II) Advertisements based on inferences drawn exclusively from the specific content of the online service, product or feature that the consumeruser is currently viewing at the time during which the advertisement is being provided, including inferences drawn from search queries performed by the consumeruser on the online service, product or feature;

- *SB63_R2* – 10 – (III) Advertisements directed to the consumeruser in response to a request for information or feedback submitted by the consumer;user;

Except as otherwise provided in subsection 3,2, a controller that offers any online service, product or feature that is directed at children shall:

and (b) Retain each data protection assessment conducted pursuant to paragraph (a) for at least 35 years after the controller ceases to offer the online service, product or feature.

(2) The categories of personal information of known children that are processed by or in connection with the online service, product or feature;

and (3) Each purpose for which the controller processes the personal data of known children.

(1) Benefits to the controller, the consumersusers of the online services, products or features offered by the controller, including, without limitation, such consumersusers who are known children, and the public which may result, either directly or indirectly, from processing the data of known children;

and (2) The potential risks to the rights and safety of the known children whose data is processed by the controller, as mitigated by the safeguards that the controller may reasonably implement to reduce such risks, which may include, without limitation, using de-identified data in place of personal data;

and - *SB63_R1* – 14 – (2) The contextrelationship inbetween which the controller processesand the children whose data ofthe knowncontroller children;will process.

and3. (3) The relationship between the controller and the known children whose data the controller will process.

- *SB63_R2* – 11 – 3.

A data protection assessment provided to the Attorney General pursuant to subsection 4 is confidential and is not a public book or record within the meaning of NRS 239.010.239.010, and no waiver of any applicable privilege in the information contained within any such data protection assessment occurs as a result of making any such information available or disclosing such information to the Attorney General, the Office of the Attorney General or any other officer or employee of the Office of the Attorney General.

6.

The disclosure of a data protection assessment to the Attorney General, the Office of the Attorney General or any other officer or employee of the Office of the Attorney General pursuant to subsection 4 does not constitute a waiver of the attorney-client privilege or work product protection with respect to the information contained within any such data protection assessment.

4.Sec.

The Attorney General has the exclusive authority to enforce the provisions of sections 24 to 35, inclusive, of this act.

5.

Nothing in sections 24 to 35, inclusive, of this act shall be construed to create a private right of action.

- *SB63_R2* – 12 – Sec.

Except as otherwise provided in this section and NRS 1.4683, 1.4687, 1A.110, 3.2203, 41.0397, 41.071, 49.095, - *SB63_R1* – 15 – 49.293, 62D.420, 62D.440, 62E.516, 62E.620, 62H.025, 62H.030, 62H.170, 62H.220, 62H.320, 75A.100, 75A.150, 76.160, 78.152, 80.113, 81.850, 82.183, 86.246, 86.54615, 87.515, 87.5413, 87A.200, 87A.580, 87A.640, 88.3355, 88.5927, 88.6067, 88A.345, 88A.7345, 89.045, 89.251, 90.730, 91.160, 116.757, 116A.270, 116B.880, 118B.026, 119.260, 119.265, 119.267, 119.280, 119A.280, 119A.653, 119A.677, 119B.370, 119B.382, 120A.640, 120A.690, 125.130, 125B.140, 126.141, 126.161, 126.163, 126.730, 127.007, 127.057, 127.130, 127.140, 127.2817, 128.090, 130.312, 130.712, 136.050, 159.044, 159A.044, 164.041, 172.075, 172.245, 176.01334, 176.01385, 176.015, 176.0625, 176.09129, 176.156, 176A.630, 178.39801, 178.4715, 178.5691, 178.5717, 179.495, 179A.070, 179A.165, 179D.160, 180.600, 200.3771, 200.3772, 200.5095, 200.604, 202.3662, 205.4651, 209.392, 209.3923, 209.3925, 209.419, 209.429, 209.521, 211A.140, 213.010, 213.040, 213.095, 213.131, 217.105, 217.110, 217.464, 217.475, 218A.350, 218E.625, 218F.150, 218G.130, 218G.240, 218G.350, 218G.615, 224.240, 226.462, 226.796, 228.270, 228.450, 228.495, 228.570, 231.069, 231.1285, 231.1473, 232.1369, 233.190, 237.300, 239.0105, 239.0113, 239.014, 239B.026, 239B.030, 239B.040, 239B.050, 239C.140, 239C.210, 239C.230, 239C.250, 239C.270, 239C.420, 240.007, 241.020, 241.030, 241.039, 242.105, 244.264, 244.335, 247.540, 247.545, 247.550, 247.560, 250.087, 250.130, 250.140, 250.145, 250.150, 268.095, 268.0978, 268.490, 268.910, 269.174, 271A.105, 281.195, 281.805, 281A.350, 281A.680, 281A.685, 281A.750, 281A.755, 281A.780, 284.4068, 284.4086, 286.110, 286.118, 287.0438, 289.025, 289.080, 289.387, 289.830, 293.4855, 293.5002, 293.503, 293.504, 293.558, 293.5757, 293.870, 293.906, 293.908, 293.909, 293.910, 293B.135, 293D.510, 331.110, 332.061, 332.351, 333.333, 333.335, 338.070, 338.1379, 338.1593, 338.1725, 338.1727, 348.420, 349.597, 349.775, 353.205, 353A.049, 353A.085, 353A.100, 353C.240, 353D.250, 360.240, 360.247, 360.255, 360.755, 361.044, 361.2242, 361.610, 365.138, 366.160, 368A.180, 370.257, 370.327, 372A.080, 378.290, 378.300, 379.0075, 379.008, 379.1495, 385A.830, 385B.100, 387.626, 387.631, 388.1455, 388.259, 388.501, 388.503, 388.513, 388.750, 388A.247, 388A.249, 391.033, 391.035, 391.0365, 391.120, 391.925, 392.029, 392.147, 392.264, 392.271, 392.315, 392.317, 392.325, 392.327, 392.335, 392.850, 393.045, 394.167, 394.16975, 394.1698, 394.447, 394.460, 394.465, 396.1415, 396.1425, 396.143, 396.159, 396.3295, 396.405, 396.525, 396.535, 396.9685, 398A.115, 408.3885, 408.3886, 408.3888, 408.5484, 412.153, - *SB63_R2* – 13 – 414.280, 416.070, 422.2749, 422.305, 422A.342, 422A.350, 425.400, 427A.1236, 427A.872, 427A.940, 432.028, 432.205, 432B.175, 432B.280, 432B.290, 432B.4018, 432B.407, 432B.430, - *SB63_R1* – 16 – 432B.560, 432B.5902, 432C.140, 432C.150, 433.534, 433A.360, 439.4941, 439.4988, 439.5282, 439.840, 439.914, 439A.116, 439A.124, 439B.420, 439B.754, 439B.760, 439B.845, 440.170, 441A.195, 441A.220, 441A.230, 442.330, 442.395, 442.735, 442.774, 445A.665, 445B.570, 445B.7773, 449.209, 449.245, 449.4315, 449A.112, 450.140, 450B.188, 450B.805, 453.164, 453.720, 458.055, 458.280, 459.050, 459.3866, 459.555, 459.7056, 459.846, 463.120, 463.15993, 463.240, 463.3403, 463.3407, 463.790, 467.1005, 480.535, 480.545, 480.935, 480.940, 481.063, 481.091, 481.093, 482.170, 482.368, 482.5536, 483.340, 483.363, 483.575, 483.659, 483.800, 484A.469, 484B.830, 484B.833, 484E.070, 485.316, 501.344, 503.452, 522.040, 534A.031, 561.285, 571.160, 584.655, 587.877, 598.0964, 598.098, 598A.110, 598A.420, 599B.090, 603.070, 603A.210, 604A.303, 604A.710, 604D.500, 604D.600, 612.265, 616B.012, 616B.015, 616B.315, 616B.350, 618.341, 618.425, 622.238, 622.310, 623.131, 623A.137, 624.110, 624.265, 624.327, 625.425, 625A.185, 628.418, 628B.230, 628B.760, 629.043, 629.047, 629.069, 630.133, 630.2671, 630.2672, 630.2673, 630.2687, 630.30665, 630.336, 630A.327, 630A.555, 631.332, 631.368, 632.121, 632.125, 632.3415, 632.3423, 632.405, 633.283, 633.301, 633.427, 633.4715, 633.4716, 633.4717, 633.524, 634.055, 634.1303, 634.214, 634A.169, 634A.185, 634B.730, 635.111, 635.158, 636.262, 636.342, 637.085, 637.145, 637B.192, 637B.288, 638.087, 638.089, 639.183, 639.2485, 639.570, 640.075, 640.152, 640A.185, 640A.220, 640B.405, 640B.730, 640C.580, 640C.600, 640C.620, 640C.745, 640C.760, 640D.135, 640D.190, 640E.225, 640E.340, 641.090, 641.221, 641.2215, 641A.191, 641A.217, 641A.262, 641B.170, 641B.281, 641B.282, 641C.455, 641C.760, 641D.260, 641D.320, 642.524, 643.189, 644A.870, 645.180, 645.625, 645A.050, 645A.082, 645B.060, 645B.092, 645C.220, 645C.225, 645D.130, 645D.135, 645G.510, 645H.320, 645H.330, 647.0945, 647.0947, 648.033, 648.197, 649.065, 649.067, 652.126, 652.228, 653.900, 654.110, 656.105, 657A.510, 661.115, 665.130, 665.133, 669.275, 669.285, 669A.310, 670B.680, 671.365, 671.415, 673.450, 673.480, 675.380, 676A.340, 676A.370, 677.243, 678A.470, 678C.710, 678C.800, 679B.122, 679B.124, 679B.152, 679B.159, 679B.190, 679B.285, 679B.690, 680A.270, 681A.440, 681B.260, 681B.410, 681B.540, 683A.0873, 685A.077, 686A.289, 686B.170, 686C.306, 687A.060, 687A.115, 687B.404, 687C.010, 688C.230, 688C.480, 688C.490, 689A.696, 692A.117, 692C.190, 692C.3507, 692C.3536, 692C.3538, 692C.354, 692C.420, 693A.480, 693A.615, 696B.550, - *SB63_R2* – 14 – 696C.120, 703.196, 704B.325, 706.1725, 706A.230, 710.159, 711.600, and section 34 of this act, sections 35, 38 and 41 of chapter 478, Statutes of Nevada 2011 and section 2 of chapter 391, - *SB63_R1* – 17 – Statutes of Nevada 2013 and unless otherwise declared by law to be confidential, all public books and public records of a governmental entity must be open at all times during office hours to inspection by any person, and may be fully copied or an abstract or memorandum may be prepared from those public books and public records.

(a) Shall not refuse to provide a copy of that public record in the medium that is requested because the officer, employee or agent has - *SB63_R2* – 15 – already prepared or would prefer to provide the copy in a different medium.

(b) Except as otherwise provided in NRS 239.030, shall, upon request, prepare the copy of the public record and shall not require - *SB63_R1* – 18 – the person who has requested the copy to prepare the copy himself or herself.

A controller is not required to conduct a data protection assessment pursuant to section 34 of this act for any processing activity which the controller engaged in, created or generated before JanuaryOctober 1, 2026,2025, but is required to conduct a data protection assessment for any processing activity which the 2026.ollercontroller engages in, creates or generates on or after JanuaryOctober 1, 2.2025.

2.

and (b) On JanuaryOctober 1, 2026,2025, for all other purposes.

H - *SB63_R2**SB63_R1*