Nebraska LB 1294: Adopt the Data Privacy Act, change provisions relating to certain certificates and information relating to vital records, and provide for certain records to be exempt from public disclosure

Bill Text

LEGISLATURE OF NEBRASKA
ONE HUNDRED EIGHTH LEGISLATURE
SECOND SESSION
LEGISLATIVE BILL 1294

Introduced by Bostar, 29; Aguilar, 35; Ballard, 21; Jacobson, 42; von
Gillern, 4.
Read first time January 16, 2024
Committee: Banking, Commerce and Insurance
A BILL FOR AN ACT relating to data privacy; to amend sections 71-605.021
and 71-616, Reissue Revised Statutes of Nebraska, section 84-712.05,2
Revised Statutes Cumulative Supplement, 2022, and section 71-612,3
Revised Statutes Supplement, 2023; to adopt the Data Privacy Act; to4
change provisions relating to the preservation and use of certain5
certificates and information relating to vital records; to provide6
for certain records to be exempt from public disclosure; to provide7
an operative date; to provide severability; and to repeal the8
original sections.9
Be it enacted by the people of the State of Nebraska,10
LB1294
2024
LB1294
2024
-1-

Section 1. Sections 1 to 30 of this act shall be known and may be1
cited as the Data Privacy Act.2
Sec. 2. For purposes of the Data Privacy Act:3
(1) Affiliate means a legal entity that controls, is controlled by,4
or is under common control with another legal entity or shares common5
branding with another legal entity. For purposes of this subdivision,6
control or controlled means:7
(a) The ownership of, or power to vote, more than fifty percent of8
the outstanding shares of any class of voting security of a company;9
(b) The control in any manner over the election of a majority of the10
directors or of individuals exercising similar functions; or11
(c) The power to exercise controlling influence over the management12
of a company;13
(2) Authenticate means to verify through reasonable means that the14
consumer who is entitled to exercise the consumer's rights under sections15
7 to 11 of this act is the same consumer exercising those consumer rights16
with respect to the personal data at issue;17
(3)(a) Biometric data means data that is used to identify a specific18
individual through an automatic measurement of a biological19
characteristic of an individual and includes any:20
(i) Fingerprint;21
(ii) Voice print;22
(iii) Retina image;23
(iv) Iris image;24
(v) Information derived from wastewater; or25
(vi) Unique biological pattern or characteristic; and26
(b) Biometric data does not include a physical or digital27
photograph; a video or audio recording or data generated from a physical28
or digital photograph; or information collected, used, or stored for29
health care treatment, payment, or operations under the Health Insurance30
Portability and Accountability Act;31
LB1294
2024
LB1294
2024
-2-

(4) Business associate has the meaning assigned to the term by the1
Health Insurance Portability and Accountability Act;2
(5) Child means an individual younger than thirteen years of age;3
(6)(a) Consent means, when referring to a consumer, a clear and4
affirmative act signifying a consumer's freely given, specific, informed,5
and unambiguous agreement to process personal data relating to the6
consumer, and includes a written statement, including a statement written7
by electronic means, or any other unambiguous affirmative action.8
(b) Consent, when referring to a consumer, does not include:9
(i) Acceptance of a general or broad term of use or similar document10
that contains a description of personal data processing along with other,11
unrelated information;12
(ii) Hovering over, muting, pausing, or closing a given piece of13
content; or14
(iii) Agreement obtained through the use of a dark pattern;15
(7)(a) Consumer means an individual who is a resident of this state16
acting only in an individual or household context.17
(b) Consumer does not include an individual acting in a commercial18
or employment context;19
(8) Controller means an individual or other person that, alone or20
jointly with others, determines the purpose and means of processing21
personal data;22
(9) Covered entity has the same meaning as defined in 45 C.F.R.23
160.103, as such regulation existed on January 1, 2024;24
(10) Dark pattern means a user interface designed or manipulated25
with the effect of substantially subverting or impairing user autonomy,26
decision-making, or choice, and includes any practice determined by the27
Federal Trade Commission to be a dark pattern as of January 1, 2024;28
(11) Decision that produces a legal or similarly significant effect29
concerning a consumer means a decision made by the controller that30
results in the provision or denial by the controller of:31
LB1294
2024
LB1294
2024
-3-

(a) Financial and lending services;1
(b) Housing, insurance, or health care services;2
(c) Education enrollment;3
(d) Employment opportunities;4
(e) Criminal justice; or5
(f) Access to basic necessities, such as food and water;6
(12) Deidentified data means data that cannot reasonably be linked7
to an identified or identifiable individual, or a device linked to that8
individual;9
(13) Health care provider has the same meaning as in the Healt