Legal Niches

Nevada passes first law requiring business to encrypt customer personal information during transmission

Posted by Charlene Brownlee

Significance of the Law

Nevada has enacted the first data security law that mandates encryption for the transmission of customer personal information. ( NRS 597.970) The law goes into effect on October 1, 2008. While there are several laws that direct organizations in certain industries to consider using encryption and laws that make encryption a factor in decisions regarding breach notifications, no law required the encryption of personal information prior to this Nevada law.

Summary of the Law

The law is brief and provides that:

“A business in this State shall not transfer any personal information[1] of a customer through an electronic transmission other than a facsimile to a person outside of the secure system of the business unless the business uses encryption[2] to ensure the security of electronic transmission.”

Scope of the Law Unclear

Unfortunately, the brevity of the law results in the need for clarification on several key points:

1. Is the law limited to customers resident in Nevada?

• A “customer” is not defined in the law, nor is there a statement that the law only applies to the personal information of Nevada residents.
• Accordingly, the law could be interpreted as applying to an organization’s transmission of “any personal information of a customer,” regardless of where the customer resides. 

2. What constitutes doing business in Nevada?

• The law does not define what nexus a company must have to Nevada to fall within the scope of the law as a “business in this State.” 
• Guidance from a decision of the Nevada Supreme Court in evaluating whether a company is “doing business” in Nevada may be helpful. In this case, the court applied a two-pronged standard: 

                  (a) the nature of the company's business in the state; and

                  (b) the quantity of business conducted by the company in the state.[3] 

3. What constitutes a “secure system” of the business?

• The prohibition under the Nevada law is limited to transmission of personal information to a person “outside of the secure system of the business.”

What is a “secure system?”

4. What are the consequences of violating the law?

• The law does not include any penalty provisions, making the consequences of failing to comply unclear.
• While the new law falls under the Miscellaneous Trade Regulations and Prohibited Acts Chapter, the chapter also does not contain any generally applicable penalty provisions.

Companies operating nationally should consider whether their existing policies and procedures regarding transmission of customer personal information comply with this new law. In October 2008 merely transmitting customer personal information in an unencrypted format may violate this Nevada data security law. If an organization is not doing business in Nevada, it should monitor the developments in other states where it operates. History of the enactment of the data breach statutes suggests that the other states may soon follow.

Full post as published by The Privacy and Security Law Blog on October 19, 2007 (boomark / email).