Nevada Imposes New Requirements For Credit Card Transactions And Data Transfers

Nevada recently amended its law on the Security of Personal Information¹ to require Nevada businesses to comply with the Payment Card Industry Data Security Standards ("PCI DSS") in any transaction where the business accepts a credit card (or other payment card) for the sale of goods or services, and to require Nevada businesses to encrypt any personal information the business transfers. Nevada's recent amendment, S.B. 227,² will take effect January 1, 2010, and will considerably broaden the information security obligations of companies "doing business" within the state's borders. Moreover, by incorporating and referencing various industry standards, the state's new law could be a precursor to similar state laws that may mandate higher standards for privacy and data security, much as California's data protection statute caused a wave of data breach notification laws throughout the country.