Nebraska's Breach Act, Sections 87-801 to 87-808: Investigate First, Then Tell Residents and the Attorney General

What Sections 87-801 to 87-808 Cover

Section 87-801 names the act; its source notes list Laws 2006, LB 876 and Laws 2018, LB757. Under section 87-807, it applies to the discovery of or notification about a breach occurring on or after July 14, 2006. LB835, introduced by Senators Mello and Coash and approved April 13, 2016, amended the definitions, the notice section and the compliance section. LB757, introduced by Senator Morfeld and approved February 28, 2018, amended 87-801 and 87-806 and created 87-808 "to require additional reasonable security procedures and practices regarding personal information."

Duties fall on "an individual or a commercial entity," and section 87-802 defines commercial entity to include a "government, governmental subdivision, agency, or instrumentality" and any legal entity "whether for profit or not for profit." A breach is unauthorized acquisition of unencrypted computerized data that compromises personal information. Acquisition under a search warrant, subpoena or court order, or a state agency's subpoena or order, is not a breach. Data is not treated as encrypted if the key "was or is reasonably believed to have been acquired" in the breach.

Personal information comes in two forms. The first is a name with a Social Security number, a motor vehicle operator's license or state ID number, an account or card number with its access code, a unique electronic identification number or routing code with its code, or unique biometric data such as "a fingerprint, voice print, or retina or iris image." The second needs no name: "A user name or email address, in combination with a password or security question and answer, that would permit access to an online account." Redaction leaves no more than the last four digits of the listed numbers.

The Investigation and Notice Duty

Section 87-803(1) puts a step between discovery and notice. A business that owns or licenses the data must, when it becomes aware of a breach, "conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be used for an unauthorized purpose." Notice to the affected resident follows only if the investigation finds that such use "has occurred or is reasonably likely to occur," and is then due "as soon as possible and without unreasonable delay," consistent with law enforcement needs and with measures to determine scope and restore the system.

A business holding data it does not own must notify the owner and "cooperate" with it, which includes sharing information relevant to the breach other than its own proprietary information. Its trigger is the same unauthorized-use test. Under subsection (4), a law enforcement determination that notice would impede a criminal investigation suspends notice until the agency decides it no longer will.

Notice to the Attorney General

Subsection (2) provides that if resident notice is required, the business "shall also, not later than the time when notice is provided to the Nebraska resident, provide notice of the breach of security of the system to the Attorney General." There is no minimum number of affected residents and no prescribed content. The Attorney General's notice therefore cannot trail the consumer notice, which is the reverse of Iowa's five-business-day window after consumer notice (see the post on chapter 715C).

The two safe harbors in section 87-804 keep the Attorney General in the loop. A business following its own notice procedures, or a regulated business following its primary or functional regulator's procedures, is deemed compliant only if it "notifies affected Nebraska residents and the Attorney General" under those procedures. Section 87-805 makes any waiver of the act void.

How Notice Can Be Delivered

Section 87-802(4) allows written, telephonic or E-SIGN-consistent electronic notice, and two kinds of substitute notice:

The Security Procedures Requirement

Section 87-808(1) requires a business that "owns, licenses, or maintains" Nebraska residents' computerized personal information to keep "reasonable security procedures and practices" appropriate to the information's sensitivity and to "the nature and size of, and the resources available to," the business, including safeguards at disposal. Subsection (2) requires a contract obliging any nonaffiliated service provider receiving the data to keep comparable procedures. That subsection does not reach contracts entered before July 19, 2018, but a renewal on or after that date must comply.

Subsection (3) treats a business as compliant if it complies with a more protective state or federal law, or with the Gramm-Leach-Bliley Title V regulations or HIPAA "as such acts and sections existed on January 1, 2018," where it is subject to them.

Enforcement

Section 87-806 splits the remedies. For notice failures under 87-803, the Attorney General may issue subpoenas and "seek and recover direct economic damages for each affected Nebraska resident injured." A violation of 87-808 is treated as a violation of section 59-1602 under the Consumer Protection Act, and "does not give rise to a private cause of action." Section 59-1614 sets the civil penalty for a 59-1602 violation at not more than $2,000 for each violation.

The Attorney General filed suit on December 16, 2024 in Lancaster County District Court against Change Healthcare, UnitedHealth Group and Optum. The complaint pleads 87-803 in its third count, alleging direct written notice began in July 2024 "at the earliest" and that "each such failure is its own violation." Its fourth count pleads 87-808 with civil penalties under 59-1614.

In an order dated November 10, 2025 in Case No. CI 24-4356, Judge Susan I. Strong overruled the motion to dismiss the amended complaint. She found the 87-803 count adequately alleged notice delay and direct economic damages. On the security claims, the defendants invoked the Consumer Protection Act's exemption in section 59-1617(1) for conduct regulated by another authority, arguing that HIPAA governs their security. The court held that failures alleged under HIPAA "appear to be exempt," but that other alleged failures and the delayed-notice allegations were not tied to federal rules and could proceed. The Attorney General's November 13, 2025 release describes the breach as affecting nearly 900,000 Nebraskans. The order rules on pleadings only; no judgment was located.

Frequently Asked Questions