Publications

Update: On Thursday, April 11, 2024, the Nebraska Legislature passed the Nebraska Data Privacy Act (“Nebraska Act”) by a 47-0 vote. Should Gov. Jim Pillen sign the Nebraska Act into law or decline to veto it, the Nebraska Act will go into effect on January 1, 2025, making Nebraska either the sixteenth or seventeenth state to enact a data privacy law, depending on whether the Maryland Online Data Privacy Act, which passed the Maryland Legislature on April 6, is enacted first. Read our summary of the Nebraska Act here.

A newly proposed bill in the Nebraska Legislature attempts to put the state at the forefront of providing enhanced protections for its residents’ personal data. The attention to consumer privacy is not new—the Nebraska Legislature considered a proposal to adopt the Nebraska Consumer Data Privacy Act (LB746) in 2020, but that bill was indefinitely postponed. Once again, lawmakers seek to pass comprehensive consumer privacy legislation in Nebraska. On January 20, 2022, Senator Mike Flood introduced LB1188. The bill proposes adoption of the Uniform Personal Data Protection Act, which purports to offer a more practical, flexible statutory framework than the privacy bill considered by the Legislature two years ago.

The Uniform Personal Data Protection Act (the “Uniform Act”), which was promulgated by the Uniform Law Commission last year, has not yet been enacted in any states, but lawmakers in Oklahoma and the District of Columbia have also recently introduced bills to adopt the law. The Uniform Act is designed to protect consumers from harmful processing of their personal data without imposing on businesses the high costs of compliance that are inherent in laws modeled after the California Consumer Privacy Act of 2018 or Europe’s General Data Privacy Regulation. The Uniform Act would require a covered business to provide consumers with notice regarding its collection and use of consumers’ personal data, conduct privacy and security risk assessments, and grant consumers the rights to access or correct any personal data collected by the business. Unlike other consumer privacy laws passed in California, Colorado, and Virginia, the Uniform Act would not require businesses to delete personal data upon request. The Uniform Act would divide data processing activities into three categories—compatible data practices, incompatible data practices, and prohibited data practices—and regulate the use of personal data based on the category involved.

Any person that maintains personal data and conducts business in Nebraska or produces goods or services directed at Nebraskans would need to comply with the law. However, small businesses that maintain personal data about fewer than 50,000 Nebraskans and earn less than 50 percent of their gross annual revenue from maintaining personal data would be exempt from the Uniform Act, provided that they process personal data solely using compatible data practices. “Compatible data practices” encompass activities that are consistent with a consumer’s expectation based on the particular transaction or likely to benefit the consumer. Such practices would not require the consumer’s consent. Allowing businesses to avoid the costs of consent in specified situations represents just one way in which the Uniform Act may appeal to Nebraskans who wish to protect consumers in the realm of data processing but are reluctant to impose high compliance costs on covered businesses. 

Nebraska is not the only state to propose comprehensive data privacy legislation this year. Privacy bills are under consideration in at least 23 other states, including Alaska, Arizona, Connecticut, Florida, Georgia, Hawaii, Indiana, Kentucky, Maryland, Massachusetts, Minnesota, Mississippi, New Jersey, New York, North Carolina, Ohio, Oklahoma, Pennsylvania, South Carolina, Tennessee, Vermont, and Washington. Thus far, Indiana has seen the most movement, with its bill passing unanimously in the Indiana Senate and awaiting consideration by the Indiana House of Representatives as of February 3, 2022. Though consumer privacy has become a popular topic of discussion in the past few years, related legislation has faced a variety of obstacles and been slow to pass. To date, only California, Virginia, and Colorado have enacted comprehensive data privacy laws.

The Nebraska bill to adopt the Uniform Personal Data Protection Act has been referred to the Banking, Commerce and Insurance Committee, and a hearing is scheduled for February 28, 2022. If enacted, the law would go into effect on January 1, 2023. Koley Jessen will continue to monitor developments related to the proposed legislation and advise as updates become available. 

Special thanks to Law Clerk Kayla Sullivan for her assistance with this article.