(1) A controller shall establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decision under subsection (3) of section 87-1108.

(2) The appeal process must be conspicuously available and similar to the process for initiating an action to exercise consumer rights by submitting a request under section 87-1107.

(3) A controller shall inform the consumer in writing of any action taken or not taken in response to an appeal under this section not later than the sixtieth day after the date of receipt of the appeal, including a written explanation of the reason or reasons for the decision.

(4) If the controller denies an appeal, the controller shall provide the consumer with the online mechanism described in section 87-1108 through which the consumer may contact the Attorney General to submit a complaint.