Laws & Statutes › NE › NE-LB-525
LB-525
NE · State · USA
NE
USA
● Passed
Nebraska LB 525 — Agricultural Data Privacy Act
The Agricultural Data Privacy Act creates a consent-based framework for the collection, use, and sale of agricultural data by controllers and processors in Nebraska. Controllers may not process agricultural data without the written consent of the data owner, may not discriminate against persons who refuse consent, and may not sell or use data without authorization. Processors are similarly prohibited from processing, selling, or using agricultural data absent the data owner's written consent to the controller. Data owners may rescind consent in writing, triggering a 30-day deletion obligation. Enforcement is exclusively by the Nebraska Attorney General through injunctive relief and per-violation civil penalties (amount unspecified in introduced version). No private right of action is available.
Legislative History
2025-01-22 Date of introduction Date of introduction
2025-01-24 committee referral Referred to Banking, Commerce and Insurance Committee
2025-01-27 Notice of hearing for February 03, 2025 Notice of hearing for February 03, 2025
2026-01-07 Title printed. Carryover bill Title printed. Carryover bill
2026-01-20 introduced Jacobson AM1710 filed
2026-01-23 Notice of hearing for February 17, 2026 on AM1710 Notice of hearing for February 17, 2026 on AM1710
2026-02-18 introduced Jacobson AM2076 filed
2026-02-19 Jacobson priority bill Jacobson priority bill
2026-02-23 introduced Banking, Commerce and Insurance AM2221 filed
2026-02-23 Placed on General File with AM2221 Placed on General File with AM2221
2026-03-03 introduced Jacobson AM2284 to AM2221 filed
2026-03-09 introduced McKinney MO508 Indefinitely postpone pursuant to Rule 6, Sec. 3(f) filed
2026-03-09 introduced McKinney MO509 Bracket until April 17, 2026 filed
2026-03-09 introduced McKinney MO510 Recommit to the Banking, Commerce and Insurance Committee filed
2026-03-10 introduced Jacobson AM2444 to AM2221 filed
2026-03-24 introduced Cavanaugh, J. AM2849 to AM2221 filed
2026-03-24 McKinney MO508 withdrawn McKinney MO508 withdrawn
2026-03-24 McKinney MO509 withdrawn McKinney MO509 withdrawn
2026-03-24 McKinney MO510 withdrawn McKinney MO510 withdrawn
2026-03-24 Jacobson AM2284 withdrawn Jacobson AM2284 withdrawn
2026-03-24 Jacobson AM2444 adopted Jacobson AM2444 adopted
2026-03-24 Cavanaugh, J. AM2849 adopted Cavanaugh, J. AM2849 adopted
2026-03-24 Banking, Commerce and Insurance AM2221 adopted Banking, Commerce and Insurance AM2221 adopted
2026-03-24 Jacobson AM1710 withdrawn Jacobson AM1710 withdrawn
2026-03-24 Jacobson AM2076 withdrawn Jacobson AM2076 withdrawn
2026-03-24 Advanced to Enrollment and Review Initial Advanced to Enrollment and Review Initial
2026-03-30 introduced Enrollment and Review ER166 filed
2026-03-30 Placed on Select File with ER166 Placed on Select File with ER166
2026-04-01 Enrollment and Review ER166 adopted Enrollment and Review ER166 adopted
2026-04-01 Advanced to Enrollment and Review for Engrossment Advanced to Enrollment and Review for Engrossment
2026-04-07 Placed on Final Reading Placed on Final Reading
2026-04-10 Dispensing of reading at large approved Dispensing of reading at large approved
2026-04-10 Passed on Final Reading 49-0-0 Passed on Final Reading 49-0-0
2026-04-10 President/Speaker signed President/Speaker signed
2026-04-17 Presented to Governor on April 10, 2026 Presented to Governor on April 10, 2026
2026-04-17 Approved by Governor on April 14, 2026 Approved by Governor on April 14, 2026
2026-04-17 Provisions/portions of LB1185 amended into LB525 by AM2444 Provisions/portions of LB1185 amended into LB525 by AM2444
Mapped Requirements
D-01 Automated Processing Rights & Data Controls
Official Sources
Full Text ↗
Entry Last Reviewed
2026-05-07
AI generated
Summary

The Agricultural Data Privacy Act creates a consent-based framework for the collection, use, and sale of agricultural data by controllers and processors in Nebraska. Controllers may not process agricultural data without the written consent of the data owner, may not discriminate against persons who refuse consent, and may not sell or use data without authorization. Processors are similarly prohibited from processing, selling, or using agricultural data absent the data owner's written consent to the controller. Data owners may rescind consent in writing, triggering a 30-day deletion obligation. Enforcement is exclusively by the Nebraska Attorney General through injunctive relief and per-violation civil penalties (amount unspecified in introduced version). No private right of action is available.

Enforcement & Penalties
Enforcement Authority
The Attorney General has exclusive authority to enforce the Act and may bring an action against any controller or processor. Enforcement is agency-initiated or complaint-driven through an online complaint mechanism the Attorney General is required to maintain. No private right of action is available — the Act expressly prohibits construing it as providing a basis for private suit.
Penalties
Injunctive relief and civil penalties of [XXXX] dollars for each separate violation (penalty amount left blank in introduced version). All civil penalties remitted to the State Treasurer for distribution per Article VII, section 5, of the Nebraska Constitution.
Who Is Covered
Controller means an individual or other person that, alone or jointly with others, determines the purpose and means of processing agricultural data;.
Processor means a person that processes agricultural data on behalf of a controller;.
Compliance Obligations 7 obligations · click obligation ID to open requirement page
D-01 Automated Processing Rights & Data Controls · D-01.8 · Deployer · Automated Decisionmaking
Sec. 4(1); Sec. 5(1)(a)
Plain Language
Controllers must obtain written consent from the data owner before processing any agricultural data. The consent must be affirmative and in writing — no processing may occur without it. Data owners may rescind consent at any time by providing written notice to the controller. This functions similarly to an opt-in consent requirement for data collection, applied specifically to agricultural data categories.
Statutory Text
Sec. 4. (1) A person may provide written consent to any potential controller of such person's agricultural data that authorizes: (a) The potential controller to process such person's agricultural data; or (b) A third party to process such person's agricultural data on behalf of the potential controller. (2) A person that has provided written consent under this section may rescind such consent by providing a written notice of such rescission to the controller of the agricultural data. Sec. 5. (1) A controller shall not: (a) Require any person to submit to any processing of such person's agricultural data without the written consent of such person;
D-01 Automated Processing Rights & Data Controls · Deployer · Automated Decisionmaking
Sec. 5(1)(b)
Plain Language
Controllers may not discriminate against individuals who decline to consent to agricultural data collection. A person who refuses consent must receive the same services, goods, benefits, and rewards as a person who consents. This is an anti-retaliation or non-discrimination-for-exercising-rights provision that ensures consent is genuinely voluntary.
Statutory Text
A controller shall not: (b) Provide any difference in any service, good, benefit, or reward provided to any person who does not consent to the collection or possession of agricultural data;
D-01 Automated Processing Rights & Data Controls · Deployer · Automated Decisionmaking
Sec. 5(1)(c)
Plain Language
Controllers are prohibited from selling, providing to third parties, or using agricultural data without the data owner's authorization. This goes beyond the consent-to-process requirement in Section 4 — it separately prohibits any sale, transfer, or use without authorization, creating an independent violation for unauthorized secondary use or sale even if initial collection was authorized.
Statutory Text
A controller shall not: (c) Sell, provide, or use the agricultural data of any person without such person's authorization.
D-01 Automated Processing Rights & Data Controls · Deployer · Automated Decisionmaking
Sec. 5(2)
Plain Language
When a data owner rescinds their written consent, the controller must delete all agricultural data relating to that person within 30 days of receiving the written rescission notice. This is a mandatory deletion obligation with a fixed compliance timeline — not merely a right to request deletion but an automatic trigger upon receipt of rescission.
Statutory Text
A controller shall delete the agricultural data relating to a person that has provided a written notice rescinding the authorization pursuant to section 4 of this act within thirty days after receiving such written notice.
D-01 Automated Processing Rights & Data Controls · Deployer · Automated Decisionmaking
Sec. 6
Plain Language
Processors face the same prohibitions as controllers: they may not process, sell, provide, or use agricultural data unless the data owner has provided written consent to the controller authorizing such processing. This means processors cannot rely on the controller's representation alone — the underlying written consent from the data owner must exist. Processors who act without valid underlying consent face independent liability.
Statutory Text
A processor shall not process, sell to any person, provide to any person, or use the agricultural data of a person without such person providing written consent that authorizes such processing to the controller of the agricultural data under section 4 of this act.
Other · Automated Decisionmaking
Sec. 8
Plain Language
Any contractual provision that waives or limits the controller or processor obligations under Sections 5 or 6 is void and unenforceable as contrary to public policy. This means that controllers and processors cannot use terms of service, data processing agreements, or other contracts to circumvent the Act's consent and processing restrictions. This creates no new compliance obligation — it reinforces existing ones by preventing contractual evasion.
Statutory Text
Any provision of a contract or agreement that waives or limits in any way any requirement for a controller or processor described in sections 5 or 6 of this act is contrary to public policy and is void and unenforceable.
Other · Automated Decisionmaking
Sec. 10
Plain Language
The Attorney General must publish on its website information about controller and processor responsibilities, consumer rights under the Act, and an online complaint submission mechanism. This provision obligates the Attorney General's office — not regulated controllers or processors — and creates no new compliance obligation for covered entities. It does, however, establish the complaint-driven enforcement pathway.
Statutory Text
The Attorney General shall post on the Attorney General's website: (1) Information relating to: (a) The responsibilities of a controller under the Agricultural Data Privacy Act; (b) The responsibilities of a processor under the Agricultural Data Privacy Act; and (c) A consumer's rights under the Agricultural Data Privacy Act; and (2) An online mechanism through which a person may submit a complaint under the Agricultural Data Privacy Act to the Attorney General.