Nev. Rev. Stat. ch. 603A – Security and Privacy of Personal Information | Midpage

Collections
Nevada Revised Statutes

Chapter 603A

Nev. Rev. Stat. ch. 603A

Security and Privacy of Personal Information

603A.010Definitions 603A.020“Breach of the security of the system data” defined 603A.030“Data collector” defined 603A.040“Personal information” defined 603A.100Applicability; waiver of provisions prohibited 603A.200Destruction of certain records 603A.210Security measures 603A.215Security measures for data collector that accepts payment card; use of encryption; liability for damages; applicability 603A.217Alternative methods of and technologies for encryption: Adoption of regulations 603A.220Disclosure of breach of security of system data; methods of disclosure; applicability 603A.260Violation constitutes deceptive trade practice 603A.270Civil action 603A.280Restitution 603A.290Injunction 603A.300Definitions 603A.310“Consumer” defined 603A.320“Covered information” defined 603A.323“Data broker” defined 603A.325“Designated request address” defined 603A.330“Operator” defined 603A.333“Sale” defined 603A.337“Verified request” defined 603A.338Applicability of provisions 603A.340Notice regarding covered information collected by operator: Operator required to make available to consumers; contents; exception 603A.345Submission of verified request to operator not to sell covered information collected by operator; response to verified request 603A.346Submission of verified request to data broker not to sell covered information purchased by data broker; response to verified request 603A.347Data broker authorized to remedy first failure to comply with requirements concerning verified request 603A.348Operator authorized to remedy first failure to comply with notice requirements 603A.349Operator authorized to remedy first failure to comply with requirements concerning verified request 603A.350Unlawful acts 603A.360Enforcement by Attorney General; civil penalty for violation or injunction; no private right of action against operator; provisions not exclusive 603A.400Definitions 603A.405Affiliate” defined 603A.410Authenticate” defined 603A.415Biometric data” defined 603A.420Collect” defined 603A.425Consumer” defined 603A.430Consumer health data” defined 603A.435Gender-affirming care” defined 603A.440Genetic data” defined 603A.445Health care services or products” defined 603A.450Precise geolocation information” defined 603A.455Process” defined 603A.460Processor” defined 603A.465Regulated entity” defined 603A.470Reproductive or sexual health care” defined 603A.475Sell” defined 603A.480Share” defined 603A.485Third party” defined 603A.490Applicability 603A.495Regulated entity required to develop and maintain policy concerning privacy of consumer health data; policy to be posted on Internet website maintained by regulated entity; prohibited acts 603A.500Collection and sharing of consumer health data by regulated entity prohibited; exceptions; required disclosures for request for consent to collect or share consumer health data 603A.505Actions required of regulated entity upon request of consumer; establishment of means of making request 603A.510Response by regulated entity to request by consumer; inability to authenticate request; fee; challenge to validity of fee charged 603A.515Deletion of consumer health data upon request by consumer; deletion by third party; delay of deletion of data on archived or backup system 603A.520Regulated entity to establish process for appeal of refusal to act on request by consumer; regulated entity required to inform consumer in writing after receipt of appeal 603A.525Regulated entity to limit authority of employees and processors to access consumer health data; regulated entity to establish, implement and maintain policies and practices for security of consumer health data 603A.530Limitations on authority to process consumer health data pursuant to contract; processor to assist regulated entity to comply with law; liability of processor for acts inconsistent with contractual provisions 603A.535Unauthorized sale or offering of consumer health data prohibited; provision of goods or services conditioned upon authorization of sale of consumer health data prohibited; required contents of authorization; revocation; expiration; invalidity; provision and retention of copies 603A.540Implementation of geofence near certain facilities, persons or entities that provide in-person health care services or products prohibited 603A.545Discrimination prohibited 603A.550Violation constitutes deceptive trade practice; no private right of action; other provisions of law unimpaired