Nebraska Data Privacy Act (LB 1074, 2024; Neb. Rev. Stat. 87-1101 to 87-1130): profiling opt-out and data protection assessments

Summary

Nebraska adopted its Data Privacy Act as sections 1 to 30 of LB 1074, a 2024 banking and finance omnibus approved on April 17, 2024; the privacy sections became operative on January 1, 2025, and are codified at Neb. Rev. Stat. 87-1101 to 87-1130. Like Texas, it has no numeric threshold: it applies to persons doing business in Nebraska (or producing products or services consumed by its residents) that process or sell personal data and are not small businesses under the federal Small Business Act, with a sensitive-data sale rule that reaches small businesses too. Consumers may opt out of profiling in furtherance of a decision that produces a legal or similarly significant effect, which includes decisions on financial and lending services, housing, insurance, health care, education, employment, criminal justice and basic necessities; profiling means solely automated processing. Controllers must conduct and document a data protection assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or financial, physical or reputational injury. Financial institutions, their affiliates and GLBA data are excluded. The Attorney General enforces it after a 30-day notice and cure step, with civil penalties of up to $7,500 per violation; there is no private right of action.

Key dates

1. April 17, 2024Enacted
2. 2025-01-01 (operative date)Takes effect
3. October 16, 2026Checked against sources
4. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. Sections 87-1101 to 87-1130 shall be known and may be cited as the Data Privacy Act. Source Laws 2024, LB1074, § 1.

   Supports: Name, location and source law

   Neb. Rev. Stat. 87-1101 Nebraska Legislature Primary source

2. LEGISLATIVE BILL 1074 Approved by the Governor April 17, 2024

   Supports: Approval date

   29, 30, 93, 94, 95, 98, and 102 of this act become operative on January 1, 2025.

   Supports: Operative date of the privacy sections

   LB 1074 (2024), slip law Nebraska Legislature Primary source

3. Opt out of the processing of the personal data for purposes of: (i) Targeted advertising; (ii) The sale of personal data; or (iii) Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer.

   Supports: Profiling opt-out

   Neb. Rev. Stat. 87-1107 Nebraska Legislature Primary source

4. Profiling means any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation

   Supports: Profiling definition (solely automated)

   means a decision made by the controller that results in the provision or denial by the controller of: (a) Financial and lending services

   Supports: Legal or similarly significant effect includes financial and lending services

   Neb. Rev. Stat. 87-1102 Nebraska Legislature Primary source

5. The processing of personal data for purposes of profiling, if the profiling presents a reasonably foreseeable risk of: (i) Unfair or deceptive treatment of or unlawful disparate impact on any consumer; (ii) Financial, physical, or reputational injury to any consumer

   Supports: Data protection assessment for risky profiling

   Neb. Rev. Stat. 87-1116 Nebraska Legislature Primary source

6. Is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024

   Supports: Applicability (no numeric threshold)

   Financial institution, affiliate of a financial institution, or data subject to Title V of the Gramm-Leach-Bliley Act

   Supports: Financial institution and GLBA exclusion

   Neb. Rev. Stat. 87-1103 Nebraska Legislature Primary source

7. Within the thirty-day period, the controller or processor cures the identified violation

   Supports: Cure step

   Neb. Rev. Stat. 87-1122 Nebraska Legislature Primary source

8. is liable for a civil penalty in an amount not to exceed seven thousand five hundred dollars for each violation

   Supports: Penalty

   The Attorney General may bring an action in the name of the State of Nebraska to: (a) Recover a civil penalty under this section

   Supports: Attorney General enforcement

   Neb. Rev. Stat. 87-1124 Nebraska Legislature Primary source

9. The Data Privacy Act shall not be construed as providing a basis for, or being subject to, a private right of action

   Supports: No private right of action

   Neb. Rev. Stat. 87-1125 Nebraska Legislature Primary source