SB63 - Revises provisions relating to the processing of certain data. (BDR 52-505)

- 83rd Session (2025) Senate Bill No. 63–Committee on Commerce and Labor CHAPTER.......... AN ACT relating to the Internet; establishing certain requirements relating to de-identified data; prohibiting controllers of online services, products or features from processing the personal data of children for certain purposes; establishing requirements for the collection and processing by controllers of certain types of data belonging to children; requiring controllers to conduct certain assessments; authorizing certain civil enforcement; providing penalties; and providing other matters properly relating thereto. Legislative Counsel’s Digest: The federal Children’s Online Privacy Protection Act establishes certain requirements relating to the collection, use and disclosure of the personal information of children on the Internet. (15 U.S.C. §§ 6501 et seq.) Existing federal regulations adopted pursuant to that Act require certain operators of Internet websites to: (1) establish and maintain reasonable procedures to protect the confidentiality, security and integrity of personal information collected from children; and (2) obtain verifiable parental consent before the operator collects, uses or discloses any personal information of a child. (16 C.F.R. §§ 312.5, 312.8) Sections 24-35 of this bill enact certain additional requirements relating to the collection and processing of personal data collected from children on the Internet by controllers. Section 27 defines “controller” to mean any person who: (1) operates or provides any online service, product or feature targeted to persons in this State; and (2) determines the purpose and means of processing personal data. Sections 25-26 and 28-31.9 define certain other terms, and section 24 establishes the applicability of those definitions to sections 24-35. Section 32 exempts certain entities, types of data and activities from the requirements of sections 24-35. Section 32.5 requires a controller that is in possession of de-identified data to take certain actions with respect to such data, including committing to not re- identify such data and contractually obligating any person to which the controller provides such data to comply with the requirements of section 32.5. Section 33 requires a controller to, before processing personal data from a known child or collecting the precise geolocation data of such a child, obtain verifiable consent from the parent or legal guardian of the child in accordance with the federal Children’s Online Privacy Protection Act. Section 33 prohibits a controller from processing the personal data of a known child for the purposes of: (1) providing targeted advertising to the child; (2) the sale of the personal data of the child; or (3) profiling the child for certain purposes. Section 33 additionally prohibits a controller from processing the personal data or collecting the precise geolocation data of a known child unless such processing or collection, as applicable, is reasonably necessary and limited in duration to enable the controller to provide the online service, product or feature. Section 33 further requires a controller that collects the precise geolocation data of a known child to, during all times that the controller is collecting such data, provide an indication to the child that such collection is occurring. Finally, section 33 requires a controller, if the controller seeks to collect the personal data of a known child with the intent to further process such data, to disclose to the child the purposes of such additional processing. Section 33 prohibits a controller from further processing such data for a – 2 – - 83rd Session (2025) purpose other than the purpose disclosed to the child, unless that purpose is necessary for carrying out and compatible with the purpose disclosed to the child. Section 34 requires a controller that offers any online service, product or feature that is directed at children to conduct and retain a data protection assessment for each processing activity in which the controller engages. Section 34 also requires, in certain circumstances, a controller to provide a data protection assessment prepared by the controller to the Attorney General. Sections 34 and 36 of this bill provide for the confidentiality of the information contained within a data protection assessment that is provided to the Attorney General. Section 34 also provides that, by disclosing to the Attorney General or the Office of the Attorney General a data protection assessment as required by section 34, a controller does not waive certain evidentiary privileges that would otherwise be applicable to the information contained within the data protection assessment. Existing law provides that a variety of actions constitute deceptive trade practices. (NRS 100.180, 111.2397, 118A.275, 202.24935, 205.377, 226.600, 228.620, 370.695, 597.7642, 597.818, 597.997, 603.170, 603A.260, 603A.550, 604B.910, 676A.770; chapter 598 of NRS) Existing law authorizes a court or the Director of the Department of Business and Industry to impose a civil penalty of not more than $25,000 for each violation upon a person who has engaged in a deceptive trade practice directed toward a minor. (NRS 598.09735) In addition, existing law provides that when the Commissioner of Consumer Affairs or the Director has cause to believe that a person has engaged or is engaging in any deceptive trade practice, the Commissioner or Director may request that the Attorney General represent him or her in instituting an appropriate legal proceeding, including an application for an injunction or temporary restraining order. (NRS 598.0979) Existing law requires a person who violates a court order or injunction resulting from a complaint brought by the Commissioner, the Director, the district attorney of any county of this State or the Attorney General to pay a civil penalty of not more than $10,000 for each violation. Furthermore, if a court finds that a person has willfully engaged in a deceptive trade practice, the person who committed the violation: (1) may be required to pay an additional civil penalty not more than $15,000 for each violation; and (2) is guilty of a felony or misdemeanor, depending on the value of the property or services lost as a result of the deceptive trade practice. (NRS 598.0999) Section 35 requires the Attorney General, upon determining that a controller has violated or is violating any provision of sections 24-35, to provide the controller written notice of the alleged violation. Section 35 makes it a deceptive trade practice for a controller to fail to remedy a violation of sections 24-35 within 30 days after receiving written notice of the violation from the Attorney General. Section 35 grants the Attorney General the exclusive authority to enforce the requirements of sections 24-35 and further provides that those sections do not create a private right of action. EXPLANATION – Matter in bolded italics is new; matter between brackets [omitted material] is material to be omitted. THE PEOPLE OF THE STATE OF NEVADA, REPRESENTED IN SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS: Sections 1-4, 4.1, 4.3, 4.5, 4.7, 5-9, 9.5, 10, 10.5, 11-22. (Deleted by amendment.) – 3 – - 83rd Session (2025) Sec. 23. Chapter 603A of NRS is hereby amended by adding thereto the provisions set forth as sections 24 to 35, inclusive, of this act. Sec. 24. As used in sections 24 to 35, inclusive, of this act unless the context otherwise requires, the words and terms defined in sections 25 to 31.9, inclusive, of this act have the meanings ascribed to them in those sections. Sec. 25. “Child” means a natural person who is less than 13 years of age. Sec. 25.7. “Consumer” means a natural person who is a resident of this State and who is acting in an individual or personal capacity. The term does not include a natural person who is acting in a commercial or employment capacity. Sec. 26. “Consumer device” means an electronic device that is used primarily for personal, family or household purposes and which connects to the Internet. The term may include, without limitation, a computer, smartphone, electronic tablet, smartwatch, router, Internet gateway, smart television or video game console. Sec. 27. “Controller” means any person who: 1. Operates or provides any online service, product or feature that is targeted to persons in this State; and 2. Alone or with other persons, determines the purpose and means of processing personal data. Sec. 28. “De-identified data” means data that cannot be reasonably linked to an identified or identifiable person or a particular consumer device that belongs or is linked to an identifiable person. Sec. 28.5. “Known child” means a person whom a controller knows to be a child. Sec. 29. “Online service, product or feature”: 1. Means any service, product or feature that is provided online. 2. Does not include: (a) A telecommunications service, as that term is defined in 47 U.S.C. § 153; (b) Broadband Internet access service, as that term is defined in 47 C.F.R. § 54.400; or (c) The delivery and use of a physical product. Sec. 30. “Personal data”: 1. Means any information that is linked or reasonably linkable to an identified or identifiable person. 2. Does not include de-identified data or publicly available information. – 4 – - 83rd Session (2025) Sec. 31. “Process” means to perform any operation or set of operations, whether performed by manual or automated means, on personal data, including, without limitation, the collection, use, storage, disclosure, analysis, deletion or modification of personal data. Sec. 31.3. “Processor” means a person who processes data on behalf of a controller. Sec. 31.5. “Publicly available information” means information that: 1. Is lawfully made available through the records of a governmental entity; or 2. A business has a reasonable basis to believe is made to be lawfully available to the general public: (a) Through a channel of media that is widely distributed; (b) By the consumer to whom the information pertains; or (c) By a person to whom the consumer to whom the information pertains has disclosed the information, unless the consumer has restricted the information to a specific audience. Sec. 31.7. “Sale” means the exchange of personal data with a third party for money or other valuable consideration. The term does not include: 1. The disclosure of personal data by a controller to a processor that processes personal data on behalf of the controller; 2. The disclosure of personal data to a third party for purposes of providing a product or service requested by a consumer; 3. The disclosure or transfer of personal data to an affiliate of the controller; 4. The disclosure of information pertaining to a consumer that the consumer: (a) Has intentionally made available to the general public through a channel of media that is widely distributed; and (b) Did not restrict to a particular audience; or 5. The disclosure or transfer of personal data to a third party as an asset that is a part of a merger, acquisition, bankruptcy or other transaction in which the third party assumes control of all or part of the assets of the controller. Sec. 31.9. “Third party” means a person or entity that is not a consumer, controller, processor or affiliate of a controller or processor. Sec. 32. The provisions of sections 24 to 35, inclusive, of this act: 1. Do not apply to: – 5 – - 83rd Session (2025) (a) A consumer reporting agency, as defined in 15 U.S.C. § 1681a(f); (b) Any personally identifiable information regulated by the Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq., and the regulations adopted pursuant thereto, which is collected, maintained or sold as provided in that Act; (c) A person who collects, maintains, or makes sales of personally identifiable information for the purposes of preventing fraud; (d) Any personally identifiable information protected from disclosure under the federal Driver’s Privacy Protection Act of 1994, 18 U.S.C. §§ 2721 et seq., which is collected, maintained or sold as provided in that Act; (e) Any consumer health data subject to the provisions of NRS 603A.400 to 603A.550, inclusive; (f) A financial institution or an affiliate of a financial institution that is subject to the provisions of the Gramm-Leach- Bliley Act, 15 U.S.C. §§ 6801 et seq., or any personally identifiable information regulated by that Act which is collected, maintained or sold as provided in that Act; (g) A controller that, during a calendar year: (1) Processes the personal data of less than 25,000 residents of this State; or (2) Processes the personal data of less than 100,000 residents of this State and derives less than 50 percent of its gross revenue from the sale of personal data; or (h) A person who is subject to the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, and the regulations adopted pursuant thereto, including, without limitation, a covered entity or a business associate of a covered entity, as those terms are defined in 45 C.F.R. § 160.103. 2. Do not require a controller to take any action with regard to a child who does not reside in this State. 3. Do not apply to the extent that such application would restrict the ability of a controller or processor to: (a) Comply with all applicable federal, state and local laws, regulations and ordinances; (b) Comply with a civil, criminal or regulatory inquiry or investigation conducted by a governmental entity or a subpoena or summons issued by a governmental entity; (c) Cooperate with a law enforcement agency concerning conduct or activity that the controller or processor reasonably, and – 6 – - 83rd Session (2025) in good faith, believes may violate any federal, state or local law or regulation; (d) Investigate, establish, exercise, prepare for or defend a legal claim; (e) Provide a product or service that is specifically requested by a consumer; (f) Perform under a contract to which a consumer is a party, including, without limitation, fulfilling the terms of a written warranty; (g) Before entering into a contract with a consumer, take steps requested by the consumer relating to the formation of the contract; (h) Take immediate steps to protect an interest that is essential for the life or physical safety of a consumer or other person, unless those steps are clearly taken for another purpose; (i) Prevent, detect, protect against or respond to: (1) A security incident; (2) [Text truncated for display. Full text available on LegiScan.]