Senate committee reviews SB291 to limit social‑security collection and expand post‑breach protections

Senator Fabian Donate (D., Senate District 10) introduced Senate Bill 291 on March 17, proposing revisions to Nevada law intended to strengthen protections for personal information maintained by employers and other entities and to expand remedies for identity‑theft victims.

SB291, as presented, would require covered employers to maintain reasonable security measures for certain personal information of current and former employees and to notify those individuals of a security breach. The sponsor said an amendment would require employers, to the extent practicable, to notify current and former employees and offer identity‑theft protections such as credit monitoring for up to one year at no cost; the amendment would exempt businesses with fewer than 50 employees from the notification and identity‑protection requirement. The bill also would restrict certain routine collections of full Social Security numbers with limited statutory exceptions and would allow victims of identity theft to request a replacement driver’s license number at no charge, the sponsor said.

Sponsor testimony and examples Senator Donate and Alex Canedo, who testified with him, described personal experiences of identity theft and a rise in ransomware and other breaches. “I woke up one morning. I had hundreds of emails, … and several credit cards had been opened in my name,” Canedo testified, describing repeated fraudulent account openings beginning October 2023. Donate said that since 2023 he had also been a victim and that the bill would give residents and employees additional options to secure and recover compromised identity information.

Conceptual amendment and stakeholder concerns The sponsor presented a conceptual amendment shared in committee that narrows some provisions and adds exemptions. Key points in the amendment described at the hearing: employer notification of current and former employees “to the extent practicable,” a requirement to offer identity‑theft protections if the employer obtains such services, an exemption for businesses with fewer than 50 employees, and narrowly drawn exceptions for businesses that legitimately need Social Security numbers for regulated functions. The Nevada Resorts Association submitted suggested language the sponsor said he would incorporate post‑hearing.

Opposition and neutral testimony Several business and industry groups testified in opposition or neutral pending amendment review. The Retail Association of Nevada and the Consumer Data Industry Association opposed the bill as introduced, urging more precise language and coordination with federal law. The Nevada Resort Association and the Vegas Chamber said they were reviewing amendments and expected to move toward neutral if their edits were included. Callers and witnesses on the phone raised specific federal compliance questions: creditors and bankruptcy practitioners noted federal bankruptcy filings and other federal compliance obligations that rely on Social Security numbers (for example, the Bankruptcy Code, the Fair Credit Reporting Act, and systems used to verify service‑member status) and asked that state law carve out those uses.

Agency and technical details The Nevada Department of Motor Vehicles testified neutral and said it already issues replacement driver’s license numbers for identity‑theft victims and that removing the fee would have minimal fiscal impact (the DMV estimated no fiscal note greater than $2,000). The Nevada Division of Insurance confirmed that health insurers commonly use Social Security numbers to verify eligibility and life insurers use the Social Security Master Death File, explaining industry uses that the bill’s exceptions must preserve.

What the bill does not do yet At the March 17 hearing the committee did not take a final vote. Sponsor and stakeholders agreed to continue technical work on the amendment; several business groups said they expect to move to neutral if the sponsor incorporates their language clarifying federal exceptions and operational details.

Outlook SB291 will return to committee for amendment language and further stakeholder review. The DMV, insurance industry, banking groups and data industry representatives asked the sponsor to preserve specific statutory exceptions to avoid conflicts with federal law and established verification systems.