87-1112.

Controller; personal data; requirements on collection and use.

(1) A controller:

(a) Shall limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which that personal data is processed, as disclosed to the consumer; and

(b) For purposes of protecting the confidentiality, integrity, and accessibility of personal data, shall establish, implement, and maintain reasonable administrative, technical, and physical data security practices that are appropriate to the volume and nature of the personal data at issue.

(2) A controller shall not:

(a) Except as otherwise provided in the Data Privacy Act, process personal data for a purpose that is neither reasonably necessary to nor compatible with the disclosed purpose for which the personal data is processed, as disclosed to the consumer, unless the controller obtains the consumer's consent;

(b) Process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers;

(c) Discriminate against a consumer for exercising any of the consumer rights contained in the Data Privacy Act, including by denying a good or service, charging a different price or rate for a good or service, or providing a different level of quality of a good or service to the consumer; or

(d) Process the sensitive data of a consumer without obtaining the consumer's consent, or, in the case of processing the sensitive data of a known child, without processing that data in accordance with the federal Children's Online Privacy Protection Act of 1998, 15 U.S.C. 6501 et seq., as such act existed on January 1, 2024.

(3) Subdivision (2)(c) of this section shall not be construed to require a controller to provide a product or service that requires the personal data of a consumer that the controller does not collect or maintain or to prohibit a controller from offering a different price, rate, level, quality, or selection of a good or service to a consumer, including offering a good or service for no fee, if the consumer has exercised the consumer's right to opt out under section 87-1107 or the offer is related to a consumer's voluntary participation in a bona fide loyalty, reward, premium feature, discount, or club card program.