Nebraska senators debate higher threshold for data-breach class actions; amendment to preserve Data Privacy Act fails

Senators spent an extended period debating LB241 on select file Friday, a bill that would limit private class-action lawsuits over cybersecurity events to cases in which a private entity was grossly negligent, willful or wanton in causing a breach.

Senator John Kavanaugh offered AM 4 74, an amendment that would have declared LB241 not intended to conflict with the Nebraska Data Privacy Act. Kavanaugh said the amendment was intended to avoid different statutory definitions for terms such as “publicly available information” and “biometric” appearing in separate statutes and bills.

Sponsor Senator Hallstrom defended LB241 as a narrowly focused measure limiting private suits that would otherwise produce “class action” litigation with little recovery for individuals and large fees for trial lawyers. “This bill deals solely with private causes of action,” Hallstrom said, and argued the bill does not alter the state Data Privacy Act or other enforcement mechanisms.

Supporters, including Senator Jacobson, said the bill protects entities that must collect sensitive personal information (for example, banks and insurers) from opportunistic class-action suits when they have complied with standard security practices. Opponents, including Senator John Kavanaugh, Senator Duncan, and Senator Conrad, said raising the standard from negligence to gross negligence reduces consumer remedies and risks creating inconsistent standards across recent and pending privacy-related bills such as LB504 and LB504’s statutory definitions.

The amendment brought by Kavanaugh was defeated on a roll call and was not adopted. The Legislature later voted to advance LB241 to E&R (engrossing) for further processing.

Votes and formal actions recorded on the floor were procedural: AM 4 74 was not adopted; LB241 was advanced from select file.