Nebraska Approves the Law that Shields Companies from Class Action Liability
On March 17, 2025, Legislative Bill 241 has been approved after Nebraska Governor Jim Pillen signed the law. This bill restricts the class action liability of private organizations in case of cybersecurity incidents. The new legislation will become effective three months after the adjournment of the 2025 session of Nebraska Legislature. Several states have already approved laws that protect organizations against class action data breach lawsuits. Tennessee enforced the same legislation in 2024, and some states have applied data breach safe harbor regulations to restrict the expenses due to data breaches.
The purpose of the Nebraska Shield legislation is to safeguard companies against too much liability and urge them to use strong cybersecurity. The Nebraska liability shield legislation prohibits filing class action lawsuits against private organizations associated with damaging cyber events except if those events are triggered by the company’s deliberate, or very negligent behavior. When companies enforce and retain reasonable and proper cybersecurity procedures, they are going to be shielded against class action lawsuits. The shield legislation doesn’t give protection against regulatory legal cases, for instance, those associated with penalties for HIPAA violations.
Private companies are described as any company, religious or non-profit organization, partnership, association, LLC, liability partnership, or other private entities, regardless of whether it is a for-profit or nonprofit business. Negative cyber events are classified as any event that leads to unauthorized access to, disruption of, or improper use of data systems or nonpublic data kept in an IT system. Negative cyber events therefore include hacking, malware, ransomware, and events that involve malicious insiders.
An information system is any system employed for the gathering, upkeep, processing, sharing, or usage of electronic nonpublic data or any customized program. Non-public data is described as data that is not freely available that affects an individual and could be used to distinguish an individual along with any of these data: driver’s license number; Social Security number; other state ID number; debit, or credit card number; financial account, access code or security code or password that would allow access to an individual’s biometric record or financial accounts.