SuperMart is a large Nevada-based business that has recently determined it sells what constitutes "covered information" under Nevada's privacy law, Senate Bill 260. Which of the following privacy…

Question

Options

• AProviding a mechanism for consumers to opt out of sales.
• BImplementing internal protocols for handling access and deletion requests.
• CPreparing a notice of financial incentive for any loyalty programs offered to its customers.
• DReviewing its vendor contracts to ensure that the vendors are subject to service provider

• A
  82% (32)
• B
  5% (2)
• C
  3% (1)
• D
  10% (4)

Explanation

Nevada's privacy law, Senate Bill 260 (SB 260), is an amendment to the existing Nevada Revised Statutes (NRS) Chapter 603A that was enacted in June 2021 and will take effect on October 1, 20. SB 260 expands the scope and definition of "covered information" under NRS 603A to include any information that identifies, relates to, describes, or is capable of being associated with a consumer, such as name, address, email, phone number, social security number, biometric data, geolocation data, and online identifiers. SB 260 also grants Nevada consumers the right to opt out of the sale of their covered information by an operator of a website or online service that collects and maintains such information. Under SB 260, an operator is defined as a person who owns or operates a website or online service for commercial purposes, collects and maintains covered information from consumers who reside in Nevada and use or visit the website or online service, and purposefully directs its activities toward Nevada. A sale is defined as the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons. However, there are some exceptions to the definition of a sale, such as: If the consumer has consented to the sale after being provided with clear and conspicuous notice of the sale and the opportunity to opt out. If the sale is to a person who processes the covered information on behalf of the operator. If the sale is to a person with whom the consumer has a direct relationship for the purposes of providing a product or service requested by the consumer. If the sale is to a person for purposes that are consistent with the reasonable expectations of the consumer considering the context in which the consumer provided the covered information to the operator. If the sale is to a person who is an affiliate of the operator. If the sale is to a person as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the person assumes control of all or part of the operator's assets. To comply with SB 260, an operator that sells covered information must provide a designated request address through which a consumer may submit a verified request to opt out of the sale. The designated request address may be an email address, a toll-free telephone number, or an Internet website. The operator must respond to the verified request within 60 days, and may extend the response period for an additional 30 days if reasonably necessary. The operator must also provide a notice to the consumer that identifies the categories of covered information that the operator collects and the categories of third parties to whom the operator may disclose the covered information. Therefore, the best privacy compliance step for SuperMart to comply with SB 260 is to provide a mechanism for consumers to opt out of sales, as this is the core requirement of the law.

No community discussion yet for this question.