Nebraska Introduces First-of-its-Kind Privacy Bill Aimed at Protecting Agricultural Data

The bill is in stark contrast to all other privacy legislation introduced and enacted in the United States, in that it does not protect information related to a natural person. Instead, it protects a wide variety of agricultural industry information, including cultivation, GPS, irrigation, and historical yield data, all of which is increasingly valuable to farmers and ranchers.

A state legislative committee held a hearing on the bill earlier this month, at which some legislators raised concerns about the privacy and security of agricultural data under existing Nebraska law. As the bill proceeds, industry groups may express their views as well.

What Does the Bill Say and What Would It Do?

The Agricultural Data Privacy Act states that its purposes are to protect the privacy of agricultural producers in Nebraska and protect the agricultural industry in Nebraska. The bill includes definitions of different types of “agricultural data,” including data related to property acquisitions; purchase and sale data regarding the acquisition or selling of livestock and associated metrics; crop production, cultivation, and yield; field usage; irrigation; financial standing of agricultural production operations; GPS location of machinery, software, and related systems; equipment usage and maintenance; marketing strategy and decisions; and yield data. The bill also defines “process” and “processing” similar to the way other privacy laws define the terms, covering the “collection, use, storage, disclosure, analysis, deletion, or modification of agricultural data.” Similarly, the definition of “controller” is familiar to privacy law practitioners: an “individual or other person that, alone or jointly with others, determines the purpose and means of processing agricultural data.”

The bill provides that “persons” must provide consent to allow “controllers” to process that person’s agricultural data and to permit a third party to process data on behalf of a controller. “Person” is not defined — that may be corrected as the bill winds its way through the legislature — but it is almost certainly meant to mean the owner of the data, which would be the landowner or farmer. Such consent, if provided, may be rescinded by the person at any time.

The bill places specific restrictions on controllers. They may not (1) process the person’s agricultural data without the consent of the person; (2) provide a difference in services, goods, benefits, or rewards to any person who does not consent to the controller’s collection or possession of that person’s agricultural data; or (3) sell, provide, or use agricultural data of any person without that person’s permission. (Unlike current privacy laws, the bill does not yet define the term “sell.”) The bill also provides a right for owners to request that processors delete their agricultural data.

The bill specifically states there is no private right of action. The Nebraska Attorney General would have exclusive authority to enforce the law and could seek injunctive relief or recover a civil penalty (dollar amount not specified) for each separate violation of the law. The bill does not provide the Attorney General with rulemaking authority, but Section 10 indicates that the state Attorney General shall provide information on its website regarding controller and processor responsibilities, rights provided under the bill, and an online mechanism through which a person can submit a complaint to the Attorney General under the law.

A New Model for Privacy Bills?

This bill could serve as a model for other states with significant farming and ranching operations to consider. As the agricultural sector and associated equipment becomes increasingly technology-driven, the amount of data being produced is likewise increasing, and establishing rules regarding such data may be of interest in the other farming and ranching states. In addition, we will be watching to see if legislatures around the country apply a similar approach to protecting other types of sensitive commercial data using the now-familiar privacy law rights and requirements structure.

One to Watch

If you have questions about how this bill may affect your business, please reach out to your ArentFox Schiff contact or a member of the firm’s Privacy, Data Protection & Data Security group or the firm’s Agriculture & AgTech group.