Nebraska. Breach notification. Act
NE breach lawNebraska data breach notification law (Neb. Rev. Stat. §§ 87-801 to 87-808)
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Nebraska residents to notify affected individuals after a security breach. Core timing rule: Individuals as soon as possible. Covered data: name plus SSN, driver's licence/ID, financial account with codes, electronic identifier/routing code, biometric data; online credentials.
- Key themes
- Unique features
Encryption safe harbour lost if the key was acquired; AG notice for every notifiable breach.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Nebraska requires the maintaining entity to notify and cooperate with the owner when it becomes aware of a breach. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals as soon as possible; AG no later than individuals (any notifiable breach)
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- AG may recover direct economic damages per affected resident
§3Dates
- Key dates
- Adopted
- In force
- LB 835 (2016, eff. 2016-07-20) added AG notice and online credentials
§4Text and authority
- Text
- Authoritative text nebraskalegislature.gov
- Authority
- Nebraska Attorney General
§5Where it applies
- Domestic law of
- Nebraska
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.