Nevada Privacy Law Security Requirements

Nevada Privacy Law requiring a company that transfers customer personal information outside of its secure system through an electronic transmission to use encryption. This law is effective since October 1, 2008 and after several ammendments will be effective in January 1, 2010.

Encryption requirements:
A company that does not accept a payment card (a credit card, charge card, debit card or similar card) in connection with a sale of goods or services must use encryption

1. To transfer any personal information through an electronic, nonvoice transmission (other than a facsimile) outside the company's secure system or

2. When a data storage device (like a computer, cell phone, magnetic tape, electronic computer drive and optical computer drive) containing personal information is moved beyond the company's physical or logical controls

Payment Card Requirement
A company that accepts a payment card in connection with a sale of goods or services must comply with the current version of the Payment Card Industry Data Security Standard as adopted by the PCI Security Standards Council or its successor organization (PCI DSS), not later than the date for compliance in PCI DSS or by the PCI Security Standards Council or its successor organization. PCI DSS is an industry security standard developed by the PCI Security Standards Council, including American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa, Inc., with requirements for security management, policies, procedures, network architecture, software design and other critical protective measures. PCI DSS is intended to help organizations proactively protect customer account data.

Liability for Data Breach
A company that (i) complies with the amended law and (ii) suffers a data breach that is not caused by gross negligence or intentional misconduct by the data collector, its officers, employees or agents is not liable for damages.