Data Breach Requirements: Nev. R.S. § 603A.010 et seq.
The numbering and internal citations herein are derived from the applicable state statute.
Personal Information
The term “personal information” means a natural person’s first name or first initial and last name in combination with any one or more of the following data elements, when the name and data elements are not encrypted:
(a) Social Security number.
(b) Driver’s license number, driver authorization card number, or identification card number.
(c) Account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to the person’s financial account.
(d) A medical identification number or a health insurance identification number.
(e) A username, unique identifier, or email address in combination with a password, access code, or security question and answer that would permit access to an online account.
Security Breach Definition
The term “breach of the security of the system data” means unauthorized acquisition of computerized data that materially compromises the security, confidentiality, or integrity of personal information maintained by the data collector.
Good Faith Exception
The term “breach of the security of the system data” does not include the good faith acquisition of personal information by an employee or agent of the data collector for a legitimate purpose of the data collector, so long as the personal information is not used for a purpose unrelated to the data collector or subject to further unauthorized disclosure.
Risk of Harm Analysis
N/A
Notification Timeline
A breach notification must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system data.
Security and Investigation Exceptions
A breach notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation. The breach notification must be made after the law enforcement agency determines that the notification will not compromise the investigation.
Notification Content Requirements
N/A
Delivery Methods
A breach notice may be provided by one of the following methods:
(a) Written notification.
(b) Electronic notification, if the notification provided is consistent with the provisions in 15 U.S.C. § 7001 (The Electronic Signatures in Global and National Commerce Act).
(c) Substitute notification, if the data collector demonstrates that the cost of providing notification would exceed $250,000, the affected class of subject persons to be notified exceeds 500,000, or the data collector does not have sufficient contact information.
Substitute Notice
Substitute notification must consist of all the following:
(1) Notification by email when the data collector has electronic mail addresses for the subject persons.
(2) Conspicuous posting of the notification on the internet website of the data collector, if the data collector maintains an internet website.
(3) Notification to major statewide media.
Notice to Government Agencies
N/A
Consumer Reporting Agencies
If a data collector determines that notification is required to be given pursuant to the provisions of this section to more than 1,000 persons at any one time, the data collector shall also notify, without unreasonable delay, any consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, of the time the notification is distributed and the content of the notification.
Preemption and Compliance
A data collector which is subject to and complies with the privacy and security provisions of the Gramm-Leach-Bliley Act shall be deemed to be in compliance with the notification requirements of this section.
Data Processor Obligations
Any data collector that maintains computerized data which includes personal information that the data collector does not own shall notify the owner or licensee of the information of any breach of the security of the system data immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
Data Disposal and Security: Nev. R.S. §§ 603A.040, 603A.100, 603A.200, 603A.210, and 603A.215.
The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.
Key Terms
The term “personal information” means a natural person’s first name or first initial and last name in combination with any one or more of the following data elements, when the name and data elements are not encrypted:
(a) Social Security number.
(b) Driver’s license number, driver authorization card number or identification card number.
(c) Account, credit, or debit card number, in combination with any required security code, access code or password that would permit access to the person’s financial account.
(d) A medical identification number or health insurance identification number.
(e) A username, unique identifier or electronic mail address in combination with a password, access code or security question and answer that would permit access to an online account.
The term “reasonable measures to ensure the destruction” means any method that modifies the records containing the personal information in such a way as to render the personal information contained in the records unreadable or undecipherable, including, without limitation: (1) Shredding of the record containing the personal information; or (2) Erasing of the personal information from the records.
Security Requirements
A data collector that maintains records which contain personal information of a resident of this state shall implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.
A contract for the disclosure of the personal information of a Nevada resident which is maintained by a data collector must include a provision requiring the person to whom the information is disclosed to implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.
Data Disposal
A business that maintains records that contain personal information concerning the customers of the business shall take reasonable measures to ensure the destruction of those records when the business decides that it will no longer maintain the records.
Other Information
- If a data collector doing business in Nevada accepts a payment card in connection with a sale of goods or services, the data collector shall comply with the current version of the Payment Card Industry (PCI) Data Security Standard, as adopted by the PCI Security Standards Council or its successor organization, with respect to those transactions, not later than the date for compliance set forth in the PCI Data Security Standard or by the PCI Security Standards Council or its successor organization.
- A data collector doing business in Nevada to whom subsection 1 does not apply shall not: (a) Transfer any personal information through an electronic, nonvoice transmission other than a facsimile to a person outside of the secure system of the data collector unless the data collector uses encryption to ensure the security of electronic transmission; or (b) Move any data storage device containing personal information beyond the logical or physical controls of the data collector, its data storage contractor or, if the data storage device is used by or is a component of a multifunctional device, a person who assumes the obligation of the data collector to protect personal information, unless the data collector uses encryption to ensure the security of the information.