AB278: Bill Text

Analysis by the Legislative Reference Bureau

This bill creates a privacy council attached to the department of administration consisting of nine members appointed by the governor to serve for three-year terms. One member must be nominated by each of the following persons: the chief justice of the supreme court, the president of the senate, the senate minority leader, the speaker of the assembly and the assembly minority leader. The council appoints a privacy advocate to serve outside the classified service, advises the advocate and suggests legislation concerning personal privacy protection policies relating to personally identifiable information. Under the bill, the privacy advocate advocates for state and local government policies that protect personal privacy relating to personally identifiable information collected or maintained by state agencies or local governments. The advocate provides information to individuals, state agencies and local governments and assists individuals in exercising their rights to ensure compliance with laws governing personal information practices. The advocate may advocate on behalf of any individual before any state agency or local government with respect to exercise of the individual's rights relating to personal information practices; review any personally identifiable information policies established by a state agency or local government; and gain access, under certain conditions, to certain confidential information in the custody of a state agency or local government.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

AB278, s. 1 Section 1. 13.58 (5) (a) 4. of the statutes is created to read:

AB278,2,3 13.58 (5) (a) 4. Review any proposed statutory changes recommended by the privacy advocate under s. 19.63 (1) (f).

AB278, s. 2 Section 2. 13.58 (5) (b) 1. of the statutes is amended to read:

AB278,2,8 13.58 (5) (b) 1. Direct the privacy advocate, the subunit in the department of administration with policy-making responsibility related to information technology to conduct studies or prepare reports on items related to the committee's duties under par. (a).

AB278, s. 3 Section 3. 15.01 (4) of the statutes is amended to read:

AB278,2,18 15.01 (4) "Council" means a part-time body appointed to function on a continuing basis for the study, and recommendation of solutions and policy alternatives, of the problems arising in a specified functional area of state government, except the Milwaukee river revitalization council has the powers and duties specified in s. 23.18, the council on physical disabilities has the powers and duties specified in s. 46.29 (1) and (2), the state council on alcohol and other drug abuse has the powers and duties specified in s. 14.24, the privacy council has the powers specified in s. 19.625 and, before January 1, 2001, the council on health care fraud and abuse has the powers and duties specified in s. 146.36.

AB278, s. 4 Section 4. 15.107 (13) of the statutes is created to read:

AB278,3,3 15.107 (13) Privacy council. There is created a privacy council attached to the department of administration under s. 15.03 consisting of the following members appointed to serve for 3-year terms:

AB278,3,4 (a) Four members appointed by the governor.

AB278,3,6 (b) Five members appointed by the governor, one of whom shall be nominated by each of the following:

AB278,3,7 1. The chief justice of the supreme court.

AB278,3,8 2. The president of the senate.

AB278,3,9 3. The senate minority leader.

AB278,3,10 4. The speaker of the assembly.

AB278,3,11 5. The assembly minority leader.

AB278, s. 5 Section 5. 16.61 (2) (ao) of the statutes is created to read:

AB278,3,14 16.61 (2) (ao) "Privacy advocate" means the person designated under s. 19.625 (1).

AB278, s. 6 Section 6. 16.61 (3) (v) of the statutes is created to read:

AB278,3,17 16.61 (3) (v) Shall provide the privacy advocate direct access via a computer terminal to the registry created under par. (u).

AB278, s. 7 Section 7. 19.62 (5m) of the statutes is created to read:

AB278,3,20 19.62 (5m) "Privacy advocate" means the person designated under s. 19.625 (1).

AB278, s. 8 Section 8. 19.625 of the statutes is created to read:

AB278,3,23 19.625 Powers and duties of privacy council. (1) The privacy council shall appoint the privacy advocate outside the classified service.

AB278,3,25 (2) The council shall advise the privacy advocate on the implementation of this subchapter.

AB278,4,3 (3) The council may recommend to the governor or legislature legislation concerning personal privacy protection policies relating to personally identifiable information.

AB278, s. 9 Section 9. 19.63 of the statutes is created to read:

AB278,4,6 19.63 Powers and duties of the privacy advocate. (1) The privacy advocate shall:

AB278,4,9 (a) Be an advocate for the development and implementation of state and local government policies that protect personal privacy relating to personally identifiable information collected or maintained by authorities.

AB278,4,11 (b) Provide information on an individual's rights under this subchapter to any individual requesting the information.

AB278,4,13 (c) Assist, as the advocate deems appropriate, an individual in the exercise of his or her rights under this subchapter. This assistance may include:

AB278,4,16 1. Obtaining information on an authority's policies, procedures or practices for collecting and managing personally identifiable information and providing access to the information to the individual.

AB278,4,20 2. Arranging a meeting between the individual and the staff of an authority to obtain information on the authority's policies, procedures or practices for managing personally identifiable information or to discuss a complaint that the individual has made regarding these policies, procedures or practices.

AB278,4,25 (d) Publicize the registry of records series created under s. 16.61 (3) (u) and, upon request, assist with record retrieval any person requesting additional information on a records series in the registry that is provided by a state agency, or requesting from the registry information to which access is provided by a state agency.

AB278,5,2 (e) Inform authorities and the public of the availability of the summary of case law and opinions of the attorney general prepared under s. 19.77.

AB278,5,7 (f) Review the adequacy of state and local government policies that protect personal privacy relating to personally identifiable information collected or maintained by authorities and recommend, as appropriate, changes in statutes, ordinances and policies to the governor, the legislature and local units of government.

AB278,5,8 (2) The privacy advocate may:

AB278,5,10 (a) Advocate on behalf of an individual before any authority any matter relating to the exercise of the individual's rights under this subchapter.

AB278,5,14 (b) Review an authority's policies, procedures or practices for collecting and managing personally identifiable information and providing access to the information and recommend changes in those policies, procedures or practices to the authority or the unit of government of which the authority is a part.

AB278,5,15 (c) Inspect records in the custody of an authority under s. 19.75.

AB278, s. 10 Section 10. 19.75 of the statutes is created to read:

AB278,5,22 19.75 Access to confidential records. Unless federal law or regulations require or as a condition to receipt of federal aids by this state require that the right of inspection under this section be denied or unless inspection is specifically prohibited by law, the privacy advocate may inspect any record in the custody of an authority that is not otherwise open to inspection under ss. 19.35 (1) (a) and 19.36 if all of the following apply:

AB278,5,24 (1) The inspection is necessary for the privacy advocate to discharge his or her duties prescribed by law.

AB278,6,2 (2) No person other than the privacy advocate is permitted to be present at the inspection site.

AB278,6,6 (3) The privacy advocate has entered into an agreement with the authority that specifies the content of the record to be disclosed and the terms of the disclosure, which may include reasonable requirements placed on the privacy advocate to maintain the confidentiality of the information contained in the record.

AB278, s. 11 Section 11. 20.005 (3) (schedule) of the statutes: at the appropriate place, insert the following amounts for the purposes indicated: - See PDF for table

AB278, s. 12 Section 12. 20.505 (4) (fz) of the statutes is created to read:

AB278,6,12 20.505 (4) (fz) Privacy council and privacy advocate. The amounts in the schedule for the general program operations of the privacy council and privacy advocate under subch. IV of ch. 19.

AB278, s. 13 Section 13. 20.923 (6) (ai) of the statutes is created to read:

AB278,6,14 20.923 (6) (ai) Administration, department of: privacy advocate.

AB278, s. 14 Section 14. 196.209 (5) (a) of the statutes is amended to read:

AB278,7,2 196.209 (5) (a) The commission shall appoint a telecommunications privacy council under s. 15.04 (1) (c) consisting of representatives of telecommunications providers and of consumers of telecommunications services, including this state. The privacy advocate designated under s. 19.625 (1) shall be a member of the telecommunications privacy council.

AB278, s. 15 Section 15. 230.08 (2) (zm) of the statutes is created to read:

AB278,7,4 230.08 (2) (zm) The privacy advocate.

AB278, s. 16 Section 16. Nonstatutory provisions.

AB278,7,8 (1) Initial terms. Notwithstanding section 15.107 (13) (intro.) of the statutes, as created by this act, of the members who are initially appointed to the privacy council, as created by this act:

AB278,7,10 (a) The members who are appointed under section 15.107 (13) (a) of the statutes, as created by this act, shall serve for terms expiring on July 1, 2001.

AB278,7,12 (b) The members who are appointed under section 15.107 (13) (b) 1. to 3. of the statutes, as created by this act, shall serve for terms expiring on July 1, 2002.

AB278,7,14 (c) The members who are appointed under section 15.107 (13) (b) 4. and 5. of the statutes, as created by this act, shall serve for terms expiring on July 1, 2003.

AB278,7,19 (2) Position authorizations. The authorized FTE positions for the department of administration, funded from the appropriation under section 20.505 (4) (fz) of the statutes, as created by this act, are increased by 2.0 GPR positions to provide for the position of privacy advocate, as created by this act, and to provide support services to the privacy advocate and privacy council, as created by this act.

AB278,7,20 (End)