Provide immunity from liability for cybersecurity events

LB 241 (signed March 17, 2025) shields private businesses - including corporations, nonprofits, and other private entities - from class action lawsuits following cybersecurity events, unless the breach resulted from their willful, wanton, or gross negligence. The bill defines a "cybersecurity event" as unauthorized access or disruption of systems holding nonpublic information (like Social Security numbers or financial data) and clarifies that entities are not liable for such events under normal circumstances. It specifically exempts private entities from liability in class actions related to these incidents, focusing on preventing lawsuits for routine breaches rather than imposing new privacy requirements. This law directly affects businesses handling sensitive personal data by reducing legal risks from data breaches, provided they meet basic cybersecurity standards.