{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Baird Holm LLP","David Kramer"]
[null,null,"Grayson Derrick"]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 5/1/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":16,"n_cols":2,"rows_kept":16,"cut":false,"hidden":false,"merged":[]}
["Question","USA, Nebraska"]
["Key Legislation Overview"]
["What is the key legislation?","Nebraska’s primary legislation directed to data privacy is the \nFinancial Data Protection and Consumer Notification of Data Security Breach Act of 2006 (the “\nAct”)\n1. There are several federal statutory and regulatory schemes regarding data privacy, but these schemes are effective across the United States and are not exclusive to Nebraska.\n \n________\n1Neb. Rev. Stat. §§ 87-801 through 87-808"]
["Key Data Protection Provisions"]
["What data is protected?"," The Act protects personal information, of which there are two categories under the Act   2 :   \n\n \n\t Information that includes the first name or first initial, along with the last name, of a Nebraska resident, in combination with one or more of the following data elements related to that Nebraska resident:\n\t \n\t\t Social Security number; \n\t\t motor vehicle operator’s license number or state identification number; \n\t\t account, credit card, or debit card number, in combination with any security code, access code, or password that would permit access to a financial account; \n\t\t unique electronic identification number or routing code, in combination with any required security code, access code, or password; or \n\t\t unique biometric data, such as a fingerprint, voice print, or retina or iris image, or other unique physical representation. \n\t \n\t \n\t Information that includes a user name or email address, in combination with a password or security question and answer that would permit access to an online account.   \n\t Personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.   \n \n\n   \n\n ________ \n\n 2 Neb. Rev. Stat. § 87-802(5) \n"]
["Who is subject to privacy obligations?","The \nAct applies to individuals and commercial entities that conduct business in Nebraska and that own, license, or maintain computerized data that includes personal information about a resident of Nebraska.\n3 \n________3Neb. Rev. Stat. § 87-808(1)"]
["What are the principles applicable to personal data processing?","Nebraska does not have a statutory mandate regarding the general collection of personal data. \n"]
["How is the processing of personal data regulated?","If an individual or commercial entity to which the \nAct applies discloses computerized data that includes personal information about a Nebraska resident to a third-party service provider, the individual or commercial entity must require, by contract, that the third-party service provider implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal information disclosed, and that are reasonably designed to help protect the personal information from unauthorized access, acquisition, destruction, use, modification, or disclosure.\n4  \n________4Neb. Rev. Stat. § 87-808(1)"]
["How are storage, security and retention of personal data regulated?","Individuals and commercial entities subject to the \nAct must implement and maintain reasonable security procedures and practices that are appropriate to (i) the nature and sensitivity of the personal information owned, licensed, or maintained, and (ii) the nature and size of the business and/or operations of such individual or commercial entity.\n5  These requirements also apply to the disposal of personal information.\n6 Additionally, as mentioned above, if an individual or commercial entity to which the \nAct applies disclosures computerized data that includes personal information about a Nebraska resident to a third-party service provider, the individual or commercial entity must require, by contract, that the third-party service provider implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal information disclosed, and that are reasonably designed to help protect the personal information from unauthorized access, acquisition, destruction, use, modification, or disclosure.\n7   This provision of the \nAct does not apply to contracts entered into before July 19, 2018, but does apply to such contracts renewed on or after July 19, 2018.  Additionally, an individual or commercial entity is deemed compliant with this provision if it: (i) complies with a state or federal law that provides greater protection to personal information than the Act provides; or (ii) is subject to and complies with regulations promulgated under \nTitle V of the Gramm-Leach-Bliley Act or the \nHealth Insurance Portability and Accountability Act of 1996.8   \n________5Neb. Rev. Stat. § 87-808(2)(a)\n6Neb. Rev. Stat. § 87-808(1)\n7Neb. Rev. Stat. § 87-808(2)\n8Neb. Rev. Stat. § 87-808(3) "]
["What are the data subjects' rights?","Noto provided for within the \nAct. \n"]
["Are there restrictions on cross-border data transfers?","Not applicable. \n"]
["Are there any notification requirements for data breaches?","Yes.  An individual or commercial entity that is subject to the \nAct, when it becomes aware of a breach of its system security, must conduct an investigation to determine whether it is likely that personal information has been or will be used for an unauthorized purpose.\n9  If such investigation determines that the use of information about a Nebraska resident for an unauthorized purpose has occurred or is reasonably likely to occur, notice must be given to the Nebraska resident as soon as possible.\n10 If notice of a breach is required to be given to a Nebraska resident, the Nebraska Attorney General must also be notified of the breach at the time the Nebraska resident is notified.\n11 Notice may be provided through the following means: written, telephonic, or electronic.  The \nAct also provides for substitute notice under certain circumstances.  \n \n________\n9Neb. Rev. Stat. § 87-803(1)\n10Neb. Rev. Stat. § 87-803(1)\n11Neb. Rev. Stat. § 87-803(1)"]
["Who is the privacy regulator?","The Nebraska Attorney General has the exclusive investigative and enforcement authority under the \nAct.\n12  \n________12Neb. Rev. Stat. § 87-806(1)"]
["What are the consequences of a privacy breach?","In the event of a data breach, the Nebraska Attorney General may recover direct economic damages resulting from the breach on behalf of each affected Nebraska resident.\n13 The Nebraska Attorney General may enforce the provisions of the \nAct related to the use, storage, and disclosure of personal information under the provisions of the \nConsumer Protection Act.\n14  \n \n________\n13Neb. Rev. Stat. § 87-806(2). The Consumer Protection Act is located at \nNeb. Rev. Stat. § 59-1601 et seq14Neb. Rev. Stat. § 87-806(1)"]
["How is electronic marketing regulated?","Nebraska has no general statutory directive regarding electronic marketing.  However, it should be noted that the \nUniform Deceptive Trade Practices Act, as enacted in Nebraska, prohibits one from knowingly making a false or misleading statement in an internet privacy policy regarding the use of personal information submitted by members of the public.\n15  \n________15Neb. Rev. Stat. § 87-302(15)"]
["Are there any recent developments or expected reforms?","The Uniform Law Commission’s \nUniform Personal Data Protection Act was introduced in January 2022 to the Nebraska Unicameral, if passed, it will provide comprehensive data protection for personal data in Nebraska.\n"]