Chapter 603A of the Nevada Revised Statutes (NRA) handles the topic of "Security and Privacy of Personal Information". This chapter was amended by SB-220 which came into effect on October 1st 2019.
The most important change SB-220 brings is the introduction of a consumer right to opt-out of the sale of their personal information. The term "sale" is drawn up restrictively (see "Key Definitions").
Information security NRS 603A.010-603A.300 includes provisions about security of information maintained. The section describes that data collectors must implement and maintain reasonable security measures to avoid data breaches, stipulating the destruction of records if the collector decides they are no longer needed, and obliging collectors to notify Nevada resident without unreasonable delay in case of a data breach, if this breach materially compromise the security, confidentiality, or integrity of" PI. "Personal information" has a rather limited scope, "collectors" are governmental agencies, institutions of higher education or any type of business that somehow deal with nonpublic PI. Key definitions: Data collector, personal information, data breach
Notice right, right to opt out of sale NRS 603A.300 -603A.360 focus on notice rights of consumers and - with the SB-220 amendment - includes a right to opt out of the sale of data. Operators (different scope than "Collector"!) must provide consumers with a method to make verified opt-out requests. There is no private right of action. The AG can proceed with action after a 30-day remedy period has passed, damages up to $5,000 per violation can be awarded.
Key definitions: Operator, consumer, covered information