Nevada, Oregon and New Jersey recently passed laws focusing on the collection of consumer information, serving as a reminder for advertisers, retailers, publishers and data collectors to keep up-to-date, accurate and compliant privacy and information collection policies.
Nevada: A Website Privacy Notice is Required
Nevada joined California and Delaware in explicitly requiring websites and online services to post an accessible privacy notice. The Nevada law, effective October 1, 2017, requires disclosure of the following:
- The categories of “covered information” collected about consumers who visit the website or online service;
- The categories of third parties with whom the operator may share such information;
- A description of the process, if any, through which consumers may review and request changes to their information;
- A description of the process by which operators will notify consumers of material changes to the notice;
- Whether a third party may collect covered information about the consumer’s online activities over time and across different Internet websites or online services; and
- The effective date of the notice.
“Covered Information” is defined to include a consumer’s name, address, email address, telephone number, social security number, an identifier that allows a specific person to be contacted physically or online, and any other information concerning a person maintained by the operator in combination with an identifier.
Takeaway: Website and online service operators (including Ad Techs and other data collectors) should review their privacy policies to ensure they are disclosing all collection of information that identifies, can be used to contact, or that is combined with information that identifies consumers. Website operators should also be sure that they are aware of, and are properly disclosing, any information that is shared with or collected by their third-party service providers and how that information is used.
Oregon: Misrepresentation of Privacy Practices = Unlawful Trade Practice.
Oregon expanded its definition of an “unlawful trade practice”, effective January 1, 2018, to expressly include using, disclosing, collecting, maintaining, deleting or disposing of information in a manner materially inconsistent with any statement or representation published on a business’s website or in a consumer agreement related to a consumer transaction.The new Oregon law is broader than other similar state laws, which limit their application to “personal information”. Oregon’s law, which does not define “information”, could apply to misrepresentations about any information collection practices, even if not related to consumer personal information.
Takeaway: Businesses should be mindful when drafting privacy policies, terms of use, sweepstakes and contest rules and other consumer-facing policies and statements not to misrepresent their practices with respect to any information collected, not just personal information.
New Jersey: ID Cards Can Only be Scanned for Limited Purposes (not Advertising)
New Jersey’s new Personal Information and Privacy Protection Act, effective October 1, 2017, limits the purposes for which a retail establishment may scan a person’s identification card to the following:
- To verify the authenticity of the card or the identity of the person paying for goods or services with a method other than cash, returning an item or requesting a refund or exchange;
- To verify the person’s age when providing age-restricted goods or services to the person;
- To prevent fraud or other criminal activity using a fraud prevention service company or system if the person returns an item or requests a refund or exchange;
- To prevent fraud or other criminal activity related to a credit transaction to open or manage a credit account;
- To establish or maintain a contractual relationship;
- To record, retain, or transmit information required by State or federal law;
- To transmit information to a consumer reporting agency, financial institution, or debt collector to be used as permitted by the Fair Credit Reporting Act and the Fair Debt Collection Practices Act; or
- To record, retain, or transmit information governed by the medical privacy and security rules of the Health Insurance Portability and Accountability Act.
The law also prohibits the retention of information scanned from an identification card for verification purposes and specifically prohibits the sharing of information scanned from an identification card with a third party for marketing, advertising or promotional activities, or any other purpose not specified above. The law does make an exception to permit a retailer’s automated return fraud system to share ID information with a third party for purposes of issuing a reward coupon to a loyal customer.
Takeaway: Retail establishments with locations in New Jersey should review their point-of-sale practices to ensure they are not scanning ID cards for marketing, advertising, promotional or any other purposes not permitted by the New Jersey law.