AB621: Bill Text

AB621,2,6 (ag) "Computerized personal information" means personal information that is stored on a computer or on an optical, electromagnetic, or other electronic medium.

AB621,2,8 (ar) 1. "Entity" means a person, other than an individual, that does any of the following:

AB621,3,2 a. Conducts business in this state and maintains personal information in the ordinary course of business.

AB621,3,3 b. Stores personal information in this state.

AB621,3,5 c. Maintains for a resident of this state a depository account as defined in s. 815.18 (2) (e).

AB621,3,6 d. Lends money to a resident of this state.

AB621,3,10 2. "Entity" includes the state and any office, department, independent agency, authority, institution, association, society, or other body in state government created or authorized to be created by the constitution or any law, including the legislature and the courts.

AB621,3,14 (b) "Major credit reporting agencies" means firms, as determined by the department, most actively engaged in the business of collecting and dispensing financial information regarding individuals, including information regarding creditworthiness.

AB621,3,16 (c) "Personal information" means any of the following information, unless the information is publicly available:

AB621,3,17 1. An individual's electronic mail address.

AB621,3,18 2. Any of the information specified in s. 943.201 (1) (b) 4. to 15.

AB621,3,20 (d) "Publicly available information" means any information that an entity reasonably believes is one of the following:

AB621,3,21 1. Information that is lawfully made widely available through any media.

AB621,3,24 2. Information that is lawfully made available to the general public from federal, state, or local government records or disclosures to the general public that are required to be made by federal, state, or local law.

AB621,4,7 (2) Notification of unauthorized acquisition. (a) If an entity that owns computerized personal information or licenses computerized personal information from another knows or has reason to know that the computerized personal information has been acquired by a person who is not authorized to do so by the individual who is the subject of the computerized personal information, the entity shall, within 15 business days after the entity learned that the information was acquired, do all of the following:

AB621,4,9 1. Provide written notice under sub. (3) (a) to the individual who is the subject of the computerized personal information that has been acquired.

AB621,4,11 2. Provide notice under sub. (3) (b) to not less than 3 major credit reporting agencies.

AB621,4,17 (b) If an entity that maintains computerized personal information owned or licensed by another knows or has reason to know that the computerized personal information has been acquired by a person who has not been authorized to do so by the owner or licensee of the computerized personal information, the entity shall, within 15 business days after the entity learn that the information was acquired, notify the owner or licensee of the computerized personal information.

AB621,4,19 (3) Content and form of notice. (a) Notice under sub. (2) (a) 1. shall be given in writing by mail and contain all of the following:

AB621,4,22 1. A statement that computerized personal information pertaining to the individual and owned or licensed by the entity giving notice has been acquired by a person who is not authorized to do so by the individual.

AB621,4,24 2. A description of the personal information that has been acquired and, if known, the approximate date when the acquisition occurred.

AB621,5,3 3. A warning that the unauthorized acquisition of personal information may adversely affect the individual's credit rating, and an advisory to monitor the individual's credit information.

AB621,5,5 4. Telephone numbers and mailing addresses for not less than 3 major credit reporting agencies.

AB621,5,7 (b) Notice under sub. (2) (a) 2. shall be given in writing by mail and contain all of the following:

AB621,5,11 1. A statement that computerized personal information pertaining to an individual and owned or licensed by the entity giving notice has been acquired by a person who is not authorized to do so by the individual who is the subject of the personal information.

AB621,5,12 2. The name of the individual who is the subject of the personal information.

AB621,5,14 3. A general identification of the type of personal information that has been acquired.

AB621,5,16 4. The approximate date when the personal information was acquired, if known.

AB621,5,20 (c) If an entity is required to give notice under sub. (2) (a) 1. to more than one individual as a result of a single acquisition of computerized personal information and the cost of giving written notice to all individuals would exceed $250,000, the entity may give notice by doing all of the following:

AB621,5,22 1. Sending an electronic mail message to an individual's electronic mail address.

AB621,5,23 2. Conspicuously posting notice at the entity's Internet Web site.

AB621,6,3 3. Notifying news media in this state in a manner reasonably calculated to provide notice of the acquisition of personal information to all individuals who are the subject of the acquisition.

AB621,6,6 (4) Enforcement. (a) The department of justice or any district attorney may commence an action in circuit court in the name of the state to restrain by temporary or permanent injunction any violation of this section.

AB621,6,13 (b) Any person who is injured by a violation of this section may bring an action against the violator for damages, injunctive relief, or both. An action under this subsection may be brought against the state or any office, department, independent agency, authority, institution, association, society, or other body in state government created or authorized to be created by the constitution or any law, including the legislature and the courts. Notwithstanding s. 814.04 (1), in an action under this subsection, the court shall award a prevailing plaintiff reasonable attorney fees.

AB621,6,14 (End)