Privacy Hat Trick: Three New State Laws to Juggle

Nevada, Oregon and New Jersey recently passed laws focusing on the collection of consumer information, serving as a reminder for advertisers, retailers, publishers and data collectors to keep up-to-date, accurate and compliant privacy and information collection policies.

Nevada: A Website Privacy Notice is Required

Nevada joined California and Delaware in explicitly requiring websites and online services to post an accessible privacy notice. The Nevada law, effective October 1, 2017, requires disclosure of the following:

  • The categories of “covered information” collected about consumers who visit the website or online service;

  • The categories of third parties with whom the operator may share such information;

  • A description of the process, if any, through which consumers may review and request changes to their information;

  • A description of the process by which operators will notify consumers of material changes to the notice;

  • Whether a third party may collect covered information about the consumer’s online activities over time and across different Internet websites or online services; and

  • The effective date of the notice.

“Covered Information” is defined to include a consumer’s name, address, email address, telephone number, social security number, an identifier that allows a specific person to be contacted physically or online, and any other information concerning a person maintained by the operator in combination with an identifier.

Takeaway: Website and online service operators (including Ad Techs and other data collectors) should review their privacy policies to ensure they are disclosing all collection of information that identifies, can be used to contact, or that is combined with information that identifies consumers. Website operators should also be sure that they are aware of, and are properly disclosing, any information that is shared with or collected by their third-party service providers and how that information is used.

Oregon: Misrepresentation of Privacy Practices = Unlawful Trade Practice.

Oregon expanded its definition of an “unlawful trade practice”, effective January 1, 2018, to expressly include using, disclosing, collecting, maintaining, deleting or disposing of information in a manner materially inconsistent with any statement or representation published on a business’s website or in a consumer agreement related to a consumer transaction.The new Oregon law is broader than other similar state laws, which limit their application to “personal information”. Oregon’s law, which does not define “information”, could apply to misrepresentations about any information collection practices, even if not related to consumer personal information.

Takeaway: Businesses should be mindful when drafting privacy policies, terms of use, sweepstakes and contest rules and other consumer-facing policies and statements not to misrepresent their practices with respect to any information collected, not just personal information.

New Jersey: ID Cards Can Only be Scanned for Limited Purposes (not Advertising)

New Jersey’s new Personal Information and Privacy Protection Act, effective October 1, 2017, limits the purposes for which a retail establishment may scan a person’s identification card to the following:

  • To verify the authenticity of the card or the identity of the person paying for goods or services with a method other than cash, returning an item or requesting a refund or exchange;

  • To verify the person’s age when providing age-restricted goods or services to the person;

  • To prevent fraud or other criminal activity using a fraud prevention service company or system if the person returns an item or requests a refund or exchange;

  • To prevent fraud or other criminal activity related to a credit transaction to open or manage a credit account;

  • To establish or maintain a contractual relationship;

  • To record, retain, or transmit information required by State or federal law;

  • To transmit information to a consumer reporting agency, financial institution, or debt collector to be used as permitted by the Fair Credit Reporting Act and the Fair Debt Collection Practices Act; or

  • To record, retain, or transmit information governed by the medical privacy and security rules of the Health Insurance Portability and Accountability Act.

The law also prohibits the retention of information scanned from an identification card for verification purposes and specifically prohibits the sharing of information scanned from an identification card with a third party for marketing, advertising or promotional activities, or any other purpose not specified above. The law does make an exception to permit a retailer’s automated return fraud system to share ID information with a third party for purposes of issuing a reward coupon to a loyal customer.

Takeaway: Retail establishments with locations in New Jersey should review their point-of-sale practices to ensure they are not scanning ID cards for marketing, advertising, promotional or any other purposes not permitted by the New Jersey law.

Read more legal analysis at the National Law Review.

This post was written byJulie Erin Rubash of  Sheppard Mullin Richter & Hampton LLP.

Recreational Pot Comes to Nevada…But Why Are The Shelves Empty?

On July 1, 2017, Nevada became the fifth state in the United States to legalize the sale of recreational marijuana. The epicenter of “what happens here, stays here” tourism just added a new vice to its repertoire! So, what’s the problem?

Among other things, Nevada’s recreational marijuana dispensaries are facing the specter of empty shelves. Why? Because a wrinkle in the ballot measure that legalized recreational marijuana sales in Nevada gives licensed liquor wholesalers a temporary 18-month monopoly on marijuana distribution rights… “unless the [Nevada] Department [of Taxation] determines that an insufficient number of marijuana distributors will result from this limitation.” In order to fill its shelves, a Nevada-licensed recreational marijuana dispensary must use a licensed recreational marijuana distributor to transport the product from the cultivation facility to their stores (whereas dispensaries selling medical marijuana were allowed to move “medical-use” product from cultivation locations without an independent distribution network).

Despite efforts by marijuana dispensaries to stock up prior to July 1, overwhelming demand for recreational marijuana has resulted in dwindling supplies. And now, distributors are nowhere to be found. That is because very few liquor wholesalers have applied to become licensed marijuana distributors, and those that have made such application have failed to meet the requirements for licensure. The Nevada Department of Taxation (NDOT) reported that as of July 7, 2017, ZERO distribution licenses have been issued by NDOT.

Perhaps liquor wholesalers fear risking their federal alcohol permits issued by the Alcohol and Tobacco Tax and Trade Bureau? It would appear that marijuana distribution licenses would have to be issued to persons other than liquor wholesalers – however, nothing is that simple. A small group of liquor wholesalers, known as the Independent Alcohol Distributors of Nevada, sued and, on June 21, won a temporary injunction against NDOT to prevent marijuana distribution licenses from being issued to persons other than liquor wholesalers.

In response, on July 7, Governor Sandoval endorsed emergency regulations that would give NDOT the authority to determine whether there are a sufficient number of marijuana distributors to service the market – a determination that would allow NDOT to open up distributor licensing to those other than licensed liquor wholesalers. The emergency regulations will be considered by NDOT on July 13. Stay tuned.

This post was written by  Kate C. Lowenhar-Fisher   Jennifer J. Gaynor   Jeffrey A. Silver and Gregory R. Gemignani  of Dickinson Wright PLLC.

Why October 1, 2014 Is An Important Date For Management Persons Of Nevada Entities

AllenM logo with tagline

Two years ago, the Nevada Supreme Court in an en band decision held that a state district court may exercise jurisdiction over the nonresident officers and directors of a Nevada corporation with its principal place of business in Spain.  Consipio Holding, BV v. Carlberg, 282 P.3d 751 (Nev. 2012).  The Supreme Court reasoned

When officers or directors directly harm a Nevada corporation, they are harming a Nevada citizen. By purposefully directing harm towards a Nevada citizen, officers and directors establish contacts with Nevada and “affirmatively direct [] conduct” toward Nevada.

At the time, Nevada, unlike Delaware, had no implied consent statute.  Thus, the Nevada Supreme Court’s holding was based on Nevada’s long-arm statute, NRS 14.065(1).

In the ensuing session, the Nevada legislature decided to address the issue as well by enacting an implied consent statute:

Every nonresident of this State who, on or after October 1, 2013, accepts election or appointment, including reelection or reappointment, as a management person of an entity, or who, on or after October 1, 2014, serves in such capacity, and every resident of this State who accepts election or appointment or serves in such capacity and thereafter removes residence from this State shall be deemed, by the acceptance or by the service, to have consented to the appointment of the registered agent of the entity as an agent upon whom service of process may be made in all civil actions or proceedings brought in this State by, on behalf of or against the entity in which the management person is a necessary or proper party, or in any action or proceeding against the management person for a violation of a duty in such capacity, whether or not the person continues to serve as the management person at the time the action or proceeding is commenced. The acceptance or the service by the management person shall be deemed to be signification of the consent of the management person that any process so served has the same legal force and validity as if served upon the management person within this State.

NRS 75.160(1).  Under the statute, an “entity” means a corporation, whether or not for profit; limited-liability company; limited partnership; or a business trust.  NRS 78.160(10)(b).  A “management person” means a director, officer, manager, managing member, general partner or trustee of an entity.  NRS 75.160(10)(c).

Apparently, the Nevada legislature did not consult with Professor Eric Chiappinelli who last year published an article arguing that Delaware’s implied consent statute was unconstitutional.  The Myth of Director Consent: After Shaffer, Beyond Nicastro37 Del. J. Corp. L. 783 (2013).

Why does the statute refer to October 1?  Pursuant to NRS 218D.330(1), each law and joint resolution passed by the Legislature becomes effective on October 1 following its passage, unless the law or joint resolution specifically prescribes a different effective date.

Article By:

Of