Who Is Covered?

Any data collector that owns or licenses computerized data which includes personal information. Nev. Rev. Stat. Ann. § 603A.220(1).

“Data collector” means any governmental agency, institution of higher education, corporation, financial institution or retail operator or any other type of business entity or association that, for any purpose, whether by automated collection or otherwise, handles, collects, disseminates or otherwise deals with nonpublic personal information. Nev. Rev. Stat. Ann. § 603A.030.

What Information Is Protected?

“Personal information” means a natural person’s first name or first initial and last name in combination with any one or more of the following data elements, when the name and data elements are not encrypted:

1. Social security number.
2. Driver’s license number, driver authorization card number or identification card number.
3. Account number, credit card number or debit card number, in combination with any required security code, access code or password that would permit access to the person’s financial account.
4. A medical identification number or a health insurance identification number.
5. A user name, unique identifier or electronic mail address in combination with a password, access code or security question and answer that would permit access to an online account. Nev. Rev. Stat. Ann. § 603A.040(1).

What Is A “Breach”?

“Breach of the security of the system data” means unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information maintained by the data collector. The term does not include the good faith acquisition of personal information by an employee or agent of the data collector for a legitimate purpose of the data collector, so long as the personal information is not used for a purpose unrelated to the data collector or subject to further unauthorized disclosure. Nev. Rev. Stat. Ann. § 603A.020.

What Triggers Notification?

The discovery or notification of the breach of data relating to any resident of Nevada whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Nev. Rev. Stat. Ann. § 603A.220(1).

How Is Notice Provided To Individuals?

Timing: The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system data. Nev. Rev. Stat. Ann. § 603A.220(1).

Delivery: Notice may be by:

1. Written notification.
2. Electronic notification, if the notification provided is consistent with the provisions of the E-Sign Act.
3. Substitute notification, if the data collector demonstrates that the cost of providing notification would exceed $250,000, the affected class of subject persons to be notified exceeds 500,000 or the data collector does not have sufficient contact information. Nev. Rev. Stat. Ann. § 603A.220(4).

Content: None specified.

Is Notice To The Government Required?

No.

Is Notice To Credit Reporting Agencies Required?

Yes. If a data collector determines that notification is required to be given pursuant to the provisions of this section to more than 1,000 persons at any one time, the data collector shall also notify, without unreasonable delay, any consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, of the time the notification is distributed and the content of the notification. Nev. Rev. Stat. Ann. § 603A.220(6)

Are There Security Measure Standards?

Yes. A data collector that maintains records which contain personal information of a resident of this state shall implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification or disclosure. Nev. Rev. Stat. Ann. § 603A.210(1).

Contract Requirements: Additionally, a contract for the disclosure of the personal information of a resident of this state which is maintained by a data collector must include a provision requiring the person to whom the information is disclosed to implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification or disclosure. Nev. Rev. Stat. Ann. § 603A.210(3).

Payment Cards: If a data collector doing business in this state accepts a payment card in connection with a sale of goods or services, the data collector shall comply with the current version of the Payment Card Industry (PCI) Data Security Standard, as adopted by the PCI Security Standards Council or its successor organization, with respect to those transactions, not later than the date for compliance set forth in the Payment Card Industry (PCI) Data Security Standard or by the PCI Security Standards Council or its successor organization. Nev. Rev. Stat. Ann. § 603A.215(1).

Destruction of Records: A business that maintains records which contain personal information concerning the customers of the business shall take reasonable measures to ensure the destruction of those records when the business decides that it will no longer maintain the records. “Reasonable measures to ensure the destruction” means any method that modifies the records containing the personal information in such a way as to render the personal information contained in the records unreadable or undecipherable, including, without limitation: (1) Shredding of the record containing the personal information; or (2) Erasing of the personal information from the records. Nev. Rev. Stat. Ann. § 603A.200.

What Are The Possible Consequences Of A Violation?

If the Attorney General or a district attorney of any county has reason to believe that any person is violating, proposes to violate or has violated the provisions of Nev. Rev. Stat. Ann. § 603A.010 to 603A.290, inclusive, the Attorney General or district attorney may bring an action against that person to obtain a temporary or permanent injunction against the violation. Nev. Rev. Stat. Ann. § 603A.290.

Are There Any Exemptions/Exceptions?

A data collector will be deemed in compliance with the notification requirements if it:

1. Maintains its own notification policies and procedures as part of an information security policy for the treatment of personal information that is otherwise consistent with the timing requirements of this section shall be deemed to be in compliance with the notification requirements of this section if the data collector notifies subject persons in accordance with its policies and procedures in the event of a breach of the security of the system data.
2. Is subject to and complies with the privacy and security provisions of the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801, et seq., shall be deemed to be in compliance with the notification requirements of this section. Nev. Rev. Stat. Ann. § 603A.220(5).