AB621: Bill Text

LRB-2195/3

CTS:wlj:rs

2005 - 2006 LEGISLATURE

2005 Assembly BILL 621

August 24, 2005 - Introduced by Representatives Molepske, Black, Staskunas, Benedict, Hahn, Ott, Parisi, Berceau, McCormick, Zepnick, Lehman, Gunderson, Fields and Schneider, cosponsored by Senators Erpenbach, Roessler, Carpenter and Wirch. Referred to Committee on Financial Institutions.

AB621,1,3 An Act to create 100.54 of the statutes; relating to: requiring notice of unauthorized acquisitions of computerized personal information and granting rule-making authority.

Analysis by the Legislative Reference Bureau

This bill requires notification of the unauthorized acquisition of personal information that is stored on a computer or other electronic medium (unauthorized acquisition). The bill's notice requirements apply to entities, including the state, that do any of the following: 1) conduct business in Wisconsin and maintain personal information in the ordinary course of business; 2) store personal information in this state; 3) maintain a depository account for a Wisconsin resident; or 4) lend money to a Wisconsin resident.

Under the bill, personal information includes any of the following information about an individual, if accompanied by the name of the individual to whom the information pertains: electronic mail address; driver's license number; social security number; employer or place of employment; mother's maiden name; depository account number and certain other financial information; deoxyribonucleic acid (DNA) profile; and any other information about an individual that can be associated with an individual through identifiers or other information. Personal information does not include information that is lawfully available to the public.

Under the bill, if an entity that owns or licenses computerized personal information knows or has reason to know of an unauthorized acquisition, the entity must, within 15 business days, give notice to the individual who is the subject of the information that was acquired and to at least three major credit reporting agencies. The bill requires that the notice to the individual contain certain information, including a warning that an unauthorized acquisition may adversely affect the individual's credit rating, an advisory to monitor the individual's credit information, and telephone numbers and addresses for at least three major credit reporting agencies. The notice must be given in writing by mail, except that, if an entity is required to give notice to more than one individual as a result of a single unauthorized acquisition and the cost of giving written notice to all individuals would exceed $250,000, notice may be given by doing all of the following: 1) sending an electronic mail message to the individuals; 2) posting a notice on the Internet; and 3) notifying news media. The bill requires that a notice to credit reporting agencies include the name of the individual who is the subject of the unauthorized disclosure and a general identification of the type of information that was acquired.

Also under the bill, if an entity that maintains computerized personal information owned or licensed by another knows or has reason to know that the information has been acquired by a person not authorized to do so by the owner or licensee of the information, that entity must, within 15 business days, notify the owner or licensee.

The bill provides that the Department of Justice or the district attorney may bring an action for an injunction against a person who violates the provisions of the bill. The bill also permits an individual injured by a violation to bring an action against the violator, including the state or any body in state government, for damages.

For further information see the state fiscal estimate, which will be printed as an appendix to this bill.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

AB621, s. 1 Section 1. 100.54 of the statutes is created to read:

AB621,2,3 100.54 Notice of unauthorized disclosure of computerized personal information. (1) Definitions. In this section:

AB621,2,4 (a) "Business day" has the meaning given in s. 421.301 (6).

AB621,2,6 (ag) "Computerized personal information" means personal information that is stored on a computer or on an optical, electromagnetic, or other electronic medium.

AB621,2,8 (ar) 1. "Entity" means a person, other than an individual, that does any of the following:

AB621,3,2 a. Conducts business in this state and maintains personal information in the ordinary course of business.

AB621,3,3 b. Stores personal information in this state.

AB621,3,5 c. Maintains for a resident of this state a depository account as defined in s. 815.18 (2) (e).

AB621,3,6 d. Lends money to a resident of this state.

AB621,3,10 2. "Entity" includes the state and any office, department, independent agency, authority, institution, association, society, or other body in state government created or authorized to be created by the constitution or any law, including the legislature and the courts.

AB621,3,14 (b) "Major credit reporting agencies" means firms, as determined by the department, most actively engaged in the business of collecting and dispensing financial information regarding individuals, including information regarding creditworthiness.

AB621,3,16 (c) "Personal information" means any of the following information, unless the information is publicly available:

AB621,3,17 1. An individual's electronic mail address.

AB621,3,18 2. Any of the information specified in s. 943.201 (1) (b) 4. to 15.

AB621,3,20 (d) "Publicly available information" means any information that an entity reasonably believes is one of the following:

AB621,3,21 1. Information that is lawfully made widely available through any media.

AB621,3,24 2. Information that is lawfully made available to the general public from federal, state, or local government records or disclosures to the general public that are required to be made by federal, state, or local law.

AB621,4,7 (2) Notification of unauthorized acquisition. (a) If an entity that owns computerized personal information or licenses computerized personal information from another knows or has reason to know that the computerized personal information has been acquired by a person who is not authorized to do so by the individual who is the subject of the computerized personal information, the entity shall, within 15 business days after the entity learned that the information was acquired, do all of the following:

AB621,4,9 1. Provide written notice under sub. (3) (a) to the individual who is the subject of the computerized personal information that has been acquired.

AB621,4,11 2. Provide notice under sub. (3) (b) to not less than 3 major credit reporting agencies.

AB621,4,17 (b) If an entity that maintains computerized personal information owned or licensed by another knows or has reason to know that the computerized personal information has been acquired by a person who has not been authorized to do so by the owner or licensee of the computerized personal information, the entity shall, within 15 business days after the entity learn that the information was acquired, notify the owner or licensee of the computerized personal information.

AB621,4,19 (3) Content and form of notice. (a) Notice under sub. (2) (a) 1. shall be given in writing by mail and contain all of the following:

AB621,4,22 1. A statement that computerized personal information pertaining to the individual and owned or licensed by the entity giving notice has been acquired by a person who is not authorized to do so by the individual.

AB621,4,24 2. A description of the personal information that has been acquired and, if known, the approximate date when the acquisition occurred.

AB621,5,3 3. A warning that the unauthorized acquisition of personal information may adversely affect the individual's credit rating, and an advisory to monitor the individual's credit information.

AB621,5,5 4. Telephone numbers and mailing addresses for not less than 3 major credit reporting agencies.

AB621,5,7 (b) Notice under sub. (2) (a) 2. shall be given in writing by mail and contain all of the following:

AB621,5,11 1. A statement that computerized personal information pertaining to an individual and owned or licensed by the entity giving notice has been acquired by a person who is not authorized to do so by the individual who is the subject of the personal information.

AB621,5,12 2. The name of the individual who is the subject of the personal information.

AB621,5,14 3. A general identification of the type of personal information that has been acquired.

AB621,5,16 4. The approximate date when the personal information was acquired, if known.

AB621,5,20 (c) If an entity is required to give notice under sub. (2) (a) 1. to more than one individual as a result of a single acquisition of computerized personal information and the cost of giving written notice to all individuals would exceed $250,000, the entity may give notice by doing all of the following:

AB621,5,22 1. Sending an electronic mail message to an individual's electronic mail address.

AB621,5,23 2. Conspicuously posting notice at the entity's Internet Web site.