Amendment AA20-ASA1-AB133

AB133-ASA1-AA20,2,23 (a) "Cardholder" has the meaning given in s. 943.41 (1) (b).

AB133-ASA1-AA20,2,24 (b) "Consumer report" has the meaning given in 15 USC 1681a (d).

AB133-ASA1-AA20,3,1 (c) "Consumer reporting agency" has the meaning given in 15 USC 1681a (f).

AB133-ASA1-AA20,3,2 (d) "Financial transaction card" has the meaning given in s. 943.41 (1) (em).

AB133-ASA1-AA20,3,6 (2) Disclosure prohibited. Except as provided in sub. (3), a person may not disclose to another person, for money or anything else of value, any information or data about a cardholder who is a resident of this state that is obtained by the person from financial transaction card transaction records.

AB133-ASA1-AA20,3,8 (3) Exceptions. A person may disclose information about a cardholder if any of the following apply:

AB133-ASA1-AA20,3,10 (a) The disclosure is made to a consumer reporting agency for purposes of a consumer report.

AB133-ASA1-AA20,3,11 (b) The disclosure is made to the cardholder.

AB133-ASA1-AA20,3,16 (c) The disclosure is made to or by persons that are affiliated with the issuer of the financial transaction card by common ownership or control solely for the purpose of performing functions for or on behalf of the issuer. The affiliated person may not disclose any information received pursuant to this paragraph to a person other than the issuer, unless the issuer could make the disclosure under this section.

AB133-ASA1-AA20,3,21 (d) If the issuer of the financial transaction card is a retailer, the disclosure is made to or by contractors or agents of the issuer for the purposes of performing functions for or on behalf of the issuer. The contractor or agent may not disclose any information received pursuant to this paragraph to a person other than the issuer, unless the issuer could make the disclosure under this section.

AB133-ASA1-AA20,3,24 (4) Forfeiture. A person who violates sub. (2) may be required to forfeit not more than $10,000 for each violation. Each disclosure of information or data about one cardholder constitutes a separate violation.

AB133-ASA1-AA20,4,3 (5) Injunction. The department of justice may commence an action in circuit court in the name of the state to restrain by temporary or permanent injunction any act or practice constituting a violation of sub. (2).".

AB133-ASA1-AA20,4,4 3. Page 1314, line 17: delete that line and substitute "(1) In this section:

AB133-ASA1-AA20,4,5 (a) "Financial transaction card" has the meaning given in s. 943.41".

AB133-ASA1-AA20,4,6 4. Page 1314, line 18: after that line insert:

AB133-ASA1-AA20,4,10 "(b) "Personal information" includes an individual's address, telephone number, marital status, gender, race, religious affiliation, date or place of birth, place of or type of employment or any other information that may be used to identify an individual.".

AB133-ASA1-AA20,4,11 5. Page 1314, line 21: delete "to an" and substitute "to any".

AB133-ASA1-AA20,4,13 6. Page 1314, line 22: after "social security number" insert "or to any personal information relating to an individual who is not a prisoner".

AB133-ASA1-AA20,4,14 7. Page 1363, line 15: after that line insert:

AB133-ASA1-AA20,4,16 " Section 2822v. Subchapter VI of chapter 422 [precedes 422.601] of the statutes is created to read:

AB133-ASA1-AA20,4,17 Chapter 422

AB133-ASA1-AA20,4,19 Subchapter vi consumer reporting agencies

AB133-ASA1-AA20,4,20 422.601 Definitions. In this subchapter:

AB133-ASA1-AA20,4,21 (1) "Consumer report" has the meaning given in 15 USC 1681a (d).

AB133-ASA1-AA20,4,22 (2) "Consumer reporting agency" has the meaning given in 15 USC 1681a (f).

AB133-ASA1-AA20,4,23 (3) "File" has the meaning given in 15 USC 1681a (g).

AB133-ASA1-AA20,5,2 (4) "Investigative consumer report" has the meaning given in 15 USC 1681a (e).

AB133-ASA1-AA20,5,4 (5) "Summary of rights" means the information a consumer reporting agency is required to provide under 15 USC 1681g (c).

AB133-ASA1-AA20,5,8 422.602 Disclosure to individual. (1) In general. A consumer reporting agency shall, upon the written request of an individual, provide the individual with a written disclosure report within 5 business days after receiving the written request.

AB133-ASA1-AA20,5,10 (2) Contents. The written disclosure report provided under sub. (1) shall contain all of the following:

AB133-ASA1-AA20,5,11 (a) A current consumer report pertaining to the individual.

AB133-ASA1-AA20,5,14 (b) The date of each request for credit information pertaining to the individual received by the consumer reporting agency during the 12 months before the date that the consumer reporting agency provides the written disclosure report.

AB133-ASA1-AA20,5,17 (c) The name of each person requesting credit information pertaining to the individual during the 12 months before the date that the consumer reporting agency provides the written disclosure report.

AB133-ASA1-AA20,5,19 (d) The dates, original payees and amounts of any checks upon which any adverse characterization of the consumer is based.

AB133-ASA1-AA20,5,20 (e) Any other information contained in the individual's file.

AB133-ASA1-AA20,5,22 (f) A clear and concise explanation of the contents of the written disclosure report.

AB133-ASA1-AA20,5,23 (g) A summary of rights.

AB133-ASA1-AA20,6,2 (3) Cost. A consumer reporting agency shall provide the written disclosure report required under sub. (1) free of charge, unless the individual has requested a written disclosure report from the consumer reporting agency during the preceding 12 months.

AB133-ASA1-AA20,6,5 422.603 Exceptions. Notwithstanding s. 422.602 (2), a consumer reporting agency shall not disclose to an individual making a request under s. 422.602 (1) any of the following:

AB133-ASA1-AA20,6,7 (1) The sources of any information that was both acquired solely for use in preparing an investigative consumer report and used for no other purpose.

AB133-ASA1-AA20,6,8 (2) Any credit score or other risk score or predictor relating to the consumer.

AB133-ASA1-AA20,6,9 422.604 Penalty. A violation of this subchapter is subject to s. 425.401 (2).

AB133-ASA1-AA20, s. 2822x Section 2822x. 425.401 of the statutes is renumbered 425.401 (1).

AB133-ASA1-AA20, s. 2822z Section 2822z. 425.401 (2) of the statutes is created to read:

AB133-ASA1-AA20,6,14 425.401 (2) Any person who violates s. 422.602 may be fined not more than $500 for the first offense and may be fined not more than $1000 or imprisoned for not more than 6 months or both for each subsequent offense occurring within 6 months.".

AB133-ASA1-AA20,6,15 8. Page 1431, line 11: after that line insert:

AB133-ASA1-AA20,6,16 " Section 3113g. 895.505 of the statutes is created to read:

AB133-ASA1-AA20,6,18 895.505 Disposal of records containing personal information. (1) Definitions. In this section:

AB133-ASA1-AA20,6,21 (a) "Business" means an organization or enterprise operated for profit, including a sole proprietorship, partnership, firm, business trust, joint venture, syndicate, corporation, limited liability company or association.

AB133-ASA1-AA20,6,24 (b) "Personal information" means personally identifiable data about an individual's medical or financial condition that is not generally considered to be public knowledge.

AB133-ASA1-AA20,7,3 (c) "Personally identifiable" means capable of being associated with a particular individual through one or more identifiers or other information or circumstances.

AB133-ASA1-AA20,7,6 (d) "Record" means any material on which written, drawn, printed, spoken, visual or electromagnetic information is recorded or preserved, regardless of physical form or characteristics.

AB133-ASA1-AA20,7,9 (2) Disposal of records containing personal information. A business may not dispose of a record containing personal information unless the business does any of the following:

AB133-ASA1-AA20,7,11 (a) Prior to the disposal of the record, the business shreds, erases or otherwise modifies the record to make the personal information unreadable.

AB133-ASA1-AA20,7,14 (b) The business takes actions that it reasonably believes will ensure that no unauthorized person will have access to the personal information contained in the record for the period between the record's disposal and the record's destruction.

AB133-ASA1-AA20,7,17 (3) Cause of action. Notwithstanding s. 814.04 (1), a business that violates sub. (2) is liable to any person damaged by the violation for the amount of damages and for reasonable attorney fees.".

AB133-ASA1-AA20,7,18 9. Page 1431, line 12: before that line insert:

AB133-ASA1-AA20,7,19 " Section 3113r. 895.507 of the statutes is created to read:

AB133-ASA1-AA20,7,21 895.507 Sale or lease of personal information. (1) Definitions. In this section:

AB133-ASA1-AA20,7,22 (a) "Business" has the meaning given in s. 895.505 (1) (a).

AB133-ASA1-AA20,7,23 (b) "Personal information" has the meaning given in s. 895.505 (1) (b).

AB133-ASA1-AA20,7,24 (c) "Personally identifiable" has the meaning given in s. 895.505 (1) (c).

AB133-ASA1-AA20,8,1 (d) "Record" has the meaning given in s. 895.505 (1) (d).

AB133-ASA1-AA20,8,5 (2) Prohibited activities. No business may sell or lease to any person a record that contains an individual's name or personally identifiable information if the individual to whom the name or information relates has requested the business to refrain from selling, leasing or renting the name or information.".

AB133-ASA1-AA20,8,6 10. Page 1604, line 1: before that line insert:

AB133-ASA1-AA20,8,8 "(5b) Disposal of personal information. The treatment of section 895.505 of the statutes first applies to records disposed on the effective date of this subsection.

AB133-ASA1-AA20,8,11 (5bc) Sale or lease of personal information. The treatment of section 895.507 of the statutes first applies to the sale or lease of records on the effective date of this subsection.

AB133-ASA1-AA20,8,14 (5bd) Disclosure of credit card records. The treatment of section 138.25 of the statutes first applies to disclosures of information or data on the effective date of this subsection.

AB133-ASA1-AA20,8,17 (5be) Consumer reporting agencies. The treatment of subchapter VI of chapter 422 of the statutes first applies to requests for reports made on the effective date of this subsection.".

AB133-ASA1-AA20,8,18 11. Page 1617, line 16: after that line insert:

AB133-ASA1-AA20,8,21 "(5d) Disposal of personal information. The treatment of section 895.505 of the statutes and the treatment of Section 9358 (5b) of this act takes effect on the first day of the 4th month beginning after publication.".

AB133-ASA1-AA20,8,22 (End)