Nevada and Maine Enact Internet Privacy Laws

Recently, both Nevada and Maine enacted new data privacy legislation. While these laws borrow certain aspects of the California Consumer Privacy Act (CCPA), both are much narrower both in terms of their scope and in the rights provided to individuals. The Nevada law, which builds on an existing statute requiring that websites disclose their privacy practices, applies to websites and other online services that collect personal information from Nevada residents. The Maine statute is even narrower in that it applies only to broadband internet access service providers that operate within Maine.

While these laws are limited than the CCPA, they contain some of the same requirements and consumer rights. For example, both laws require covered entities to provide notice of their privacy practices at the time of data collection, protect collected personal information, and forbid discrimination against individuals who exercise their rights under the law. In addition, both laws provide individuals with the right to opt out of allowing their data to be sold. However, both laws use a narrower definition of “sale” than the CCPA and neither laws provides consumers with other rights enumerated under the CCPA, such as the right of access and the so-called “right to be forgotten.” In addition, Maine’s law is notable in that it requires covered entities to obtain express opt-in consent before selling individuals’ personal information to third parties. This requirement goes further than the CCPA or Nevada law and is relatively unique among US privacy laws, which generally favor opt-out consent.

Nevada’s law goes into effect on October 1, 2019, while the Maine statute is effective July 1, 2020. Several other state legislatures, including Illinois and New Jersey, are also considering legislation similar to the Nevada statute.

TIP: Privacy regulation continues to shift in the United States at an unprecedented rate. On top of to these new online privacy laws, the California legislature continues to tweak the CCPA in preparation for its January 2020 effective date and over a dozen state legislatures have introduced CCPA-copycat legislation. In addition, local, state, and federal officials continue to consider enhanced regulation of certain types of personal information, such as biometric data. Continue to monitor these developments and how they may impact your organization.