Title 52

NRS 603A.220 Disclosure of breach of security of system data; methods of disclosure; applicability. 1. Except as otherwise provided in subsection 7, a data collector that owns or licenses computerized data which includes personal information shall disclose any breach of the secur…

NRS 603A.260 Violation constitutes deceptive trade practice. A violation of the provisions of NRS 603A.010 to 603A.290, inclusive, constitutes a deceptive trade practice for the purposes of NRS 598.0903 to 598.0999, inclusive. (Added to NRS by 2021, 1353)

NRS 603A.270 Civil action. A data collector that provides the notification required pursuant to NRS 603A.220 may commence an action for damages against a person that unlawfully obtained or benefited from personal information obtained from records maintained by the data collector.…

NRS 603A.280 Restitution. In addition to any other penalty provided by law for the breach of the security of the system data maintained by a data collector, the court may order a person who is convicted of unlawfully obtaining or benefiting from personal information obtained as a…

NRS 603A.290 Injunction. If the Attorney General or a district attorney of any county has reason to believe that any person is violating, proposes to violate or has violated the provisions of NRS 603A.010 to 603A.290, inclusive, the Attorney General or district attorney may bring…

NRS 603A.300 Definitions. As used in NRS 603A.300 to 603A.360, inclusive, unless the context otherwise requires, the words and terms defined in NRS 603A.310 to 603A.337, inclusive, have the meanings ascribed to them in those sections. (Added to NRS by 2017, 4077; A 2019, 1172; 20…

NRS 603A.310 “Consumer” defined. “Consumer” means a person who seeks or acquires, by purchase or lease, any good, service, money or credit for personal, family or household purposes from the Internet website or online service of an operator. (Added to NRS by 2017, 4077)

NRS 603A.320 “Covered information” defined. “Covered information” means any one or more of the following items of personally identifiable information about a consumer collected by an operator through an Internet website or online service and maintained by the operator or a data b…

NRS 603A.323 “Data broker” defined. “Data broker” means a person whose primary business is purchasing covered information about consumers with whom the person does not have a direct relationship and who reside in this State from operators or other data brokers and making sales of…

NRS 603A.325 “Designated request address” defined. “Designated request address” means an electronic mail address, toll-free telephone number or Internet website established by an operator or data broker through which a consumer may submit to an operator or data broker a verified …

NRS 603A.330 “Operator” defined. 1. “Operator” means a person who: (a) Owns or operates an Internet website or online service for commercial purposes; (b) Collects and maintains covered information from consumers who reside in this State and use or visit the Internet website or o…

NRS 603A.333 “Sale” defined. 1. “Sale” means the exchange of covered information for monetary consideration by an operator or data broker to another person. 2. The term does not include: (a) The disclosure of covered information by an operator or data broker to a person who proce…

NRS 603A.337 “Verified request” defined. “Verified request” means a request: 1. Submitted by a consumer to an operator or data broker for the purposes set forth in NRS 603A.345 or 603A.346, as applicable; and 2. For which an operator or data broker can reasonably verify the authe…

NRS 603A.338 Applicability of provisions. The provisions of NRS 603A.300 to 603A.360, inclusive, do not apply to: 1. A consumer reporting agency, as defined in 15 U.S.C. § 1681a(f); 2. Any personally identifiable information regulated by the Fair Credit Reporting Act, 15 U.S.C. §…

NRS 603A.340 Notice regarding covered information collected by operator: Operator required to make available to consumers; contents; exception. 1. Except as otherwise provided in subsection 2, an operator shall make available, in a manner reasonably calculated to be accessible by…

NRS 603A.345 Submission of verified request to operator not to sell covered information collected by operator; response to verified request. 1. Each operator shall establish a designated request address through which a consumer may submit a verified request pursuant to this secti…

NRS 603A.346 Submission of verified request to data broker not to sell covered information purchased by data broker; response to verified request. 1. Each data broker shall establish a designated request address through which a consumer may submit a verified request pursuant to t…

NRS 603A.347 Data broker authorized to remedy first failure to comply with requirements concerning verified request. 1. A data broker who has not previously failed to comply with the provisions of NRS 603A.346 may remedy any failure to comply with the provisions of NRS 603A.346 w…

NRS 603A.348 Operator authorized to remedy first failure to comply with notice requirements. 1. An operator who has not previously failed to comply with the applicable provisions of subsection 1 of NRS 603A.340 may remedy any failure to comply with the applicable provisions of su…

NRS 603A.349 Operator authorized to remedy first failure to comply with requirements concerning verified request. 1. An operator who has not previously failed to comply with the provisions of NRS 603A.345 may remedy any failure to comply with the provisions of NRS 603A.345 within…

NRS 603A.350 Unlawful acts. An operator violates NRS 603A.340 if the operator: 1. Has not previously failed to comply with the applicable provisions of subsection 1 of that section and knowingly fails to remedy a failure to comply with such provisions within 30 days after being i…

NRS 603A.360 Enforcement by Attorney General; civil penalty for violation or injunction; no private right of action against operator; provisions not exclusive. 1. The Attorney General shall enforce the provisions of NRS 603A.300 to 603A.360, inclusive. 2. If the Attorney General …

NRS 603A.400 Definitions. As used in NRS 603A.400 to 603A.550, inclusive, unless the context otherwise requires, the words and terms defined in NRS 603A.405 to 603A.485, inclusive, have the meanings ascribed to them in those sections. (Added to NRS by 2023, 3452)

NRS 603A.405 “Affiliate” defined. “Affiliate” means an entity that shares common branding with another entity and controls, is controlled by or is under common control with the other entity. For the purposes of this section, an entity shall be deemed to control another entity if …

NRS 603A.410 “Authenticate” defined. “Authenticate” means to ascertain the identity of the originator of an electronic or physical document and establish a link between the document and the originator. (Added to NRS by 2023, 3453)

NRS 603A.415 “Biometric data” defined. “Biometric data” means data which is generated from the measurement or technical processing of the physiological, biological or behavioral characteristics of a person and, alone or in combination with other data, is capable of being used to …

NRS 603A.420 “Collect” defined. “Collect” means to buy, rent, access, retain, receive, acquire, infer, derive or otherwise process consumer health data in any manner. (Added to NRS by 2023, 3453)

NRS 603A.425 “Consumer” defined. “Consumer” means a natural person who has requested a product or service from a regulated entity and who resides in this State or whose consumer health data is collected in this State. The term does not include a natural person acting in an employ…

NRS 603A.430 “Consumer health data” defined. “Consumer health data” means personally identifiable information that is linked or reasonably capable of being linked to a consumer and that a regulated entity uses to identify the past, present or future health status of the consumer.…

NRS 603A.435 “Gender-affirming care” defined. “Gender-affirming care” means health services or products that support and affirm the gender identity of a person, including, without limitation: 1. Treatments for gender dysphoria; 2. Gender-affirming hormone therapy; and 3. Gender-a…

NRS 603A.440 “Genetic data” defined. “Genetic data” means any data that concerns the genetic characteristics of a person. The term includes, without limitation: 1. Data directly resulting from the sequencing of all or a portion of the deoxyribonucleic acid of a person; 2. Genotyp…

NRS 603A.445 “Health care services or products” defined. “Health care services or products” means any service or product provided to a person to assess, measure, improve or learn about the health of a person. The term includes, without limitation: 1. Services relating to any heal…

NRS 603A.450 “Precise geolocation information” defined. “Precise geolocation information” means information derived from technology, including, without limitation, latitude and longitude coordinates at the level of detail typically provided by a global positioning system, that di…

NRS 603A.455 “Process” defined. “Process” means any operation or set of operations performed on consumer health data. (Added to NRS by 2023, 3454)

NRS 603A.460 “Processor” defined. “Processor” means a person who processes consumer health data on behalf of a regulated entity. (Added to NRS by 2023, 3454)

NRS 603A.465 “Regulated entity” defined. “Regulated entity” means any person who: 1. Conducts business in this State or produces or provides products or services that are targeted to consumers in this State; and 2. Alone or with other persons, determines the purpose and means of …

NRS 603A.470 “Reproductive or sexual health care” defined. “Reproductive or sexual health care” means health care services or products that support or relate to the reproductive system or sexual well-being of a person. The term includes, without limitation, abortion, the provisio…

NRS 603A.475 “Sell” defined. “Sell” means to exchange consumer health data for money or other valuable consideration. The term does not include the exchange of consumer health data for money or other valuable consideration: 1. With a processor in a manner consistent with the purp…

NRS 603A.480 “Share” defined. “Share” means to release, disclose, disseminate, divulge, make available, provide access to, license or otherwise communicate consumer health data orally, in writing or by electronic or other means. (Added to NRS by 2023, 3455)

NRS 603A.485 “Third party” defined. “Third party” means a person who is not a consumer, regulated entity, processor or affiliate of a regulated entity. (Added to NRS by 2023, 3455)

NRS 603A.490 Applicability. 1. The provisions of NRS 603A.400 to 603A.550, inclusive, do not apply to: (a) Any person or entity that is subject to the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, and the regulations adopted pursuant thereto. (b…

NRS 603A.495 Regulated entity required to develop and maintain policy concerning privacy of consumer health data; policy to be posted on Internet website maintained by regulated entity; prohibited acts. 1. A regulated entity shall develop and maintain a policy concerning the priv…

NRS 603A.500 Collection and sharing of consumer health data by regulated entity prohibited; exceptions; required disclosures for request for consent to collect or share consumer health data. 1. A regulated entity shall not collect consumer health data except: (a) With the affirma…

NRS 603A.505 Actions required of regulated entity upon request of consumer; establishment of means of making request. 1. Except as otherwise provided in NRS 603A.510, upon the request of a consumer, a regulated entity shall: (a) Confirm whether the regulated entity is collecting,…

NRS 603A.510 Response by regulated entity to request by consumer; inability to authenticate request; fee; challenge to validity of fee charged. 1. Except as otherwise provided in this section, a regulated entity shall respond to a request made pursuant to NRS 603A.505 without und…

NRS 603A.515 Deletion of consumer health data upon request by consumer; deletion by third party; delay of deletion of data on archived or backup system. 1. Not later than 30 days after authenticating a request made pursuant to paragraph (d) of subsection 1 of NRS 603A.505 for the…