{"id":2907,"date":"2019-09-04T12:38:00","date_gmt":"2019-09-04T18:38:00","guid":{"rendered":"https:\/\/trustarc.com\/?post_type=resource&p=2907"},"modified":"2025-08-26T14:10:33","modified_gmt":"2025-08-26T19:10:33","slug":"nevadas-privacy-law-sb-220","status":"publish","type":"resource","link":"https:\/\/trustarc.com\/resource\/nevadas-privacy-law-sb-220\/","title":{"rendered":"Nevada\u2019s Privacy Law: Step-by-Step Suggestions to Support Compliance with SB 220"},"content":{"rendered":"\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t\tArticles<\/strong>\n\t\t\t\t\t\t\t\t\t\t

Nevada\u2019s Privacy Law: Step-by-Step Suggestions to Support Compliance with SB 220<\/h1>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\n\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\"\"\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\tAnnie Greenley-Giudici<\/strong>\n\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/span>\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

While all eyes have been on complying with the California Consumer Privacy Act (CCPA)<\/a>, the new Nevada privacy law,\u00a0Senate Bill 220<\/a>\u00a0(SB 220) will actually take effect three months earlier on Oct. 1, 2019.<\/p>\n

SB 220 was signed into law by the governor of Nevada on May 29, 2019 and amends the state\u2019s existing privacy law, Nevada Revised State 603A (enacted in 2017), for owners and operators of websites or online commercial providers.<\/p>\n

The law grants consumers who live in Nevada the right to opt-out of the sale of their personal information and to direct website operators not to sell their information.<\/p>\n

SB 220 goes into effect Oct. 1, 2019 (3 months before CCPA) so it will be the first law in the U.S. to grant these rights.<\/p>\n

About Nevada\u2019s privacy law<\/h2>\n

SB 220 applies to operators \u201cof an Internet website or online service which collects certain items of personally identifiable information about consumers\u201d in Nevada.<\/p>\n

Health care and financial institutions subject to GLBA and HIPAA are exempted from the scope of this law.<\/p>\n

SB 220 requires that businesses have a \u201cdesignated request address\u201d\u2014email address, telephone number, website\u2014for individuals to submit requests; there is no requirement for the request address to be on a business\u2019s internet homepage.<\/p>\n

SB 220 also requires that businesses respond to verifiable requests within a defined time.<\/p>\n

Nevada\u2019s privacy law requires that businesses respond within 60 days upon receiving a request; with a 30 day extension permissible if necessary.<\/p>\n

It does not specify how an operator should verify the authenticity of a consumer request.<\/p>\n

It stipulates that an operator must \u201creasonably verify the authenticity of the request and the identity of the consumer using commercially reasonable means.\u201d<\/p>\n

SB 220 enforcement<\/h2>\n

The Nevada Attorney General has enforcement power over SB 220 provisions \u2013 if an operator directly or indirectly violated these provisions, the AG may seek a temporary or permanent injunction or impose a civil penalty of up to $5,000 for each violation.<\/p>\n

SB 220 doesn\u2019t establish a private right of action against an operator.<\/p>\n

You may be thinking to yourself at this point \u2013 if I am compliant with CCPA do I need to do anything to comply with Nevada?<\/p>\n

The answer is yes.<\/p>\n

Owners\/operators subject to SB 220 should first analyze the extent to which they are selling in scope \u201ccovered information.\u201d<\/p>\n

From there they should review their online privacy policy and ensure the required disclosures in place, and lastly, create a process by which consumers may opt-out from the sale of their information.<\/p>\n

How can companies comply with SB 220?<\/h2>\n

The privacy experts at TrustArc recommend that companies follow the below steps in their efforts to comply with SB 220.<\/p>\n

Step 1<\/h3>\n

If a company determines that they are an \u201coperator\u201d in scope, first step is to determine where their Nevada resident data is located. This would be accomplished via a data inventory and mapping exercise. The following types of covered information should be focused on as part of that review:<\/p>\n