Quick Guide to the Nebraska Data Privacy Act

What Rights Do Nebraska Residents Have Under the New Law?

The NDPA gives consumers the following rights.

  • Right to Know - Consumers have the right to confirm whether a business is processing their personal data and to access that data.
  • Right to Correct - Consumers can request that a business correct any inaccurate personal information it holds about a consumer.
  • Right to Delete - Upon request, businesses must delete personal data concerning the consumer.
  • Right to Portability - Upon request, businesses must provide a copy of the consumer’s personal data in a readily portable format so that it can be transmitted to another controller.
  • Right to Opt Out - Consumers can opt out of:
    • The sale of their personal data
    • Targeted advertising
    • Profiling in furtherance of automated decisions that produce legal or similarly significant effects

Like most new data privacy laws, the NDPA requires businesses to recognize universal opt-out mechanisms (UOOMs), such as Global Privacy Control, on their websites.

What Is “Personal Data”?

Personal data is “any information that is linked or reasonably linkable to an identified or identifiable individual.” Deidentified data or publicly available information is excluded from this definition.

Personal data is more than just names and email addresses, though, and can cover anything from IP addresses to internet cookies to shopping habits.

Are Data Protection Assessments Required?

The NDPA requires organizations to perform data protection assessments for the following types of processing:

  • Targeted advertising
  • Sale of personal data
  • Profiling of consumers, where it presents a foreseeable risk of harm
  • Processing of sensitive personal data
  • Any other processing activity that presents a heightened risk of harm to consumers

How Much Do Violations Cost?

The statute provides for damages of up to $7,500 per violation, plus attorney fees and expenses. The Attorney General's Office must give businesses 30 days to cure any alleged violations.

Can Businesses Be Sued by Consumers?

The NDPA does not grant a private right of action to consumers, meaning they cannot sue an organization over violations. Only the Nebraska Attorney General’s Office has authority to enforce the law.