The Privacy Security and Risk Conference is next week in Las Vegas. While the conversation will most likely be dominated by the California Consumer Privacy Act (CCPA), there is another privacy law that should probably be on the agenda as well. That’s right, Nevada also has a new privacy law, specifically SB220. This new privacy law is essentially a carve out from CCPA, but with a little more nuance.
So, what is SB220? Essentially, this is an amendment to existing privacy law in the state, adding the requirement of data controllers to accept “do not sell” requests. When a controller, described as an “operator” in the law itself, receives this request, they have 60 days after the receipt of the request to respond. This can be extended by no more than 30 days but requires a reason for this to be necessary. Interestingly as well, the definition for “selling” is much more narrow than CCPA.
“Sale” means the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons.
In other words, you need to be paid actual cash for it to be considered selling. Excluded from this definition are disclosures to third parties processing information on behalf of the controller or as part of a merger or acquisition. If you are sharing information with a third party to fulfil an order and the customer made this request, you can still disclose the information with your fulfilment partners to deliver the product or process payment. Important to note as well, you must have a “designated request address” for consumers to make such requests. However, if you have been preparing for CCPA or GDPR (Which I know all of you have certainly done, right?), then you should already have a website or similar way for someone to make this request. What is not present in the law, however, is the requirement to post a link or similar language to the front page of your website or even your privacy notice. I would recommend you still update your notice with this information however. For additional information on how to prepare for upcoming privacy laws call (888) 470-1528 or click here to schedule a FREE preliminary consultation to discuss your concerns.