LRB-3774/5
JTK/DK/PK/ML/PG/PD/RC/MK/GM/JK/RR:wlj&cjs:jf
2001 - 2002 LEGISLATURE
November 8, 2001 - Introduced by
Personal Privacy. Referred to Committee on
Personal Privacy.
AB621,2,11
1An Act to renumber 36.11 (35) (title);
to renumber and amend 36.11 (35) and
248.396 (2) (g);
to amend 40.51 (8), 40.51 (8m), 48.396 (1), 48.396 (5) (a) (intro.),
366.0137 (4), 111.91 (2) (kc), 120.13 (2) (g), 146.81 (1) (fm), 146.81 (4), 185.981
4(4t), 185.983 (1) (intro.), 301.029 (2) (a), 938.396 (1), 938.396 (2) (c), 938.396 (2)
5(gm) and 938.396 (5) (a) (intro.); and
to create 13.0991, 19.32 (1bg), (1dm), (2g)
6and (4), 19.356, 19.37 (2) (c), 22.21, 36.32 (1), 36.38, 38.12 (12), 39.49, 40.07 (4),
748.396 (1h), 48.396 (1j), 48.396 (1k), 48.396 (2) (c), 48.396 (2) (gr), 74.80, 100.52
8(1) (bg) and (br), 100.52 (4) (a) 4., 118.39, 146.82 (2) (bm), 146.84 (1) (d), 146.84
9(5), 175.22, 230.08 (4) (b) 5., 609.837, 610.65, 938.396 (1h), 938.396 (1j), 938.396
10(1k), 938.396 (2) (gr) and 979.028 of the statutes;
relating to: the use of a
11person's social security number in his or her student identification number at
12private institutions of higher education; prohibiting showing social security
13numbers on insurance identification cards; department of corrections contracts
14involving prisoner access to an individual's date of birth; confidentiality of
1patient health care records; access to certain public records containing
2personally identifiable information; access to autopsy records; preparation of
3privacy impact statements for bills that would impact personal privacy; written
4policies on entering locker rooms being used by athletic teams representing
5certain schools or by professional athletic teams; prohibiting certain telephone
6solicitations; prohibiting posting photographs of residential property on the
7Internet; appointment of certain officers in the department of electronic
8government; and disclosure of the records of a law enforcement agency or of a
9juvenile or municipal court to other law enforcement agencies, to other juvenile
10or municipal courts, to juvenile court intake workers, and to district attorneys,
11corporation counsels, and other representatives of the public interest.
Analysis by the Legislative Reference Bureau
This bill creates various prohibitions, restrictions, and requirements, and
makes changes in existing laws with respect to protection of personal privacy and
security of personal information, and changes the place of trial for certain existing
crimes. The changes include:
Identification numbers for private college students
Under current law, the University of Wisconsin System, a technical college
district board, a school board, and the governing body of a private school are
prohibited from assigning to any student an identification number that is identical
to or incorporates the student's social security number.
Beginning January 1, 2007, this bill extends this prohibition to private
institutions of higher education located in this state.
Prohibiting social security numbers on insurance cards
This bill prohibits an identification card, or other similar identification device,
that is issued to an insured or enrollee from showing the insured's or enrollee's social
security number as an identification number or in any other manner. The
prohibition applies to an insurer; a risk-sharing plan, including the state health
insurance risk-sharing plan; the private employer health care coverage program
established by the department of employee trust funds; and any self-insured plan
of the state or a county, city, village, town, or school district. Current law does not
address information shown on insurance identification cards or prohibit using a
person's social security number as, or in, the person's insurance identification
number.
Prohibiting prisoners who perform data entry from having access to an
individual's date of birth
Under current law, the department of corrections (DOC) is prohibited from
entering into any contract that would result in a prisoner performing data entry or
telemarketing services and having access to an individual's financial transaction
card numbers, checking or savings account numbers, or social security number. This
bill adds an individual's date of birth to the list of information that a prisoner may
not have access to while doing data entry or telemarketing services under a contract
entered into by DOC.
Confidentiality of patient health care records
Under current law, all records related to the health of a patient that are
prepared by or under the supervision of a health care provider (patient health care
records) are confidential and may be released only to persons with the informed
consent of the patient or of a person authorized by the patient. There are numerous
exceptions to this prohibition that require patient health care records to be released
upon request, without informed consent, including release to another health care
provider who is rendering assistance to the patient. A person who obtains a patient
health care record under one of these exceptions must keep the information
confidential and may not disclose identifying information about the patient.
This bill prohibits a person who is a recipient of a patient health care record that
is required to be released without informed consent from using identifying
information in the record to market a service or product to a patient or health care
provider. The bill expands the definitions of "health care provider" and "patient
health care record," for the purposes of confidentiality of patient health care records,
to include a pharmacy that is licensed by the pharmacy examining board. The bill
also establishes civil liability for a person who obtains a patient health care record
from a pharmacy or pharmacist under circumstances that constitute a violation of
the patient health care record confidentiality laws. Lastly, the bill authorizes the
department of justice or a district attorney to bring an action to enforce the laws
relating to confidentiality of patient health care records or to restrain a violation of
the laws by temporary or permanent injunction.
Access to public records containing personally identifiable information
Under current law, any requester has a right to inspect or copy any public record
unless otherwise provided under statutory or common law or unless, under a
"balancing test" derived from common law, the custodian demonstrates that the
public interest in withholding access to the record outweighs the strong public
interest in providing that access. See s. 19.35 (1), stats., and State ex rel. Youmans
v. Owens, 28 Wis.2d 672, 682-83 (1965) and Hathaway v. Green Bay School District,
116 Wis. 2d 388, 395-96 (1984). If a custodian fails to provide prompt access to a
requested record or to make this demonstration, a requester may obtain a court order
requiring a custodian to provide access to a record. See s. 19.37 (1), stats.
In Woznicki v. Erickson, 202 Wis.2d 178, 192-193 (1996), the Wisconsin
supreme court held that a district attorney must notify any individual who is the
subject of a record which the district attorney proposes to release to a requester prior
to release, and that the individual may appeal a decision to release a record to circuit
court, which must determine whether permitting access would result in harm to the
privacy or reputational interests of the subject individual that outweigh the public
interest in allowing access. In Milwaukee Teachers Education Assn. v. Milwaukee
Bd. of School Directors, 227 Wis. 2d 779, 799 (1999), the supreme court expanded this
decision to apply to all public records. There is no statutory basis for these decisions.
The decisions also depart from the supreme court's previous decisions, which held
that, unless otherwise provided, custodians have no obligation to withhold public
records from access and no person may require them to do so. See Newspapers, Inc.
v. Brier, 89 Wis.2d 417, 431-32 (1979) and State ex rel. Bilder v. Twp. of Delavan, 112
Wis.2d 539, 558 (1983).
This bill affirms current statutory law by providing that, unless otherwise
specifically provided by statute, no custodian of a public record is required to notify
an individual who is the subject of a record prior to providing to a requester access
to a record containing information pertaining to that individual and that, unless
otherwise provided by statute, no person is entitled to judicial review of the decision
of a custodian to provide a requester with access to a public record.
However, the bill also creates a statutory procedure under which, with certain
exceptions, individuals who are the subjects of public records relating to certain
specific personnel matters may seek a court order to restrain state or local
government officers or agencies from providing access to those records to third
parties if the subject individuals can demonstrate that the harm to their privacy or
reputational interests resulting from disclosure of the information contained in
those records outweighs the public interest in providing access to those records.
Under the bill, if the officer or agency having custody of a public record receives a
request to provide access to a record containing information relating to any of the
personnel matters specified in the bill, the officer or agency must, before providing
access, provide written notice to each subject individual of the officer's or agency's
intent to provide access to the record. If a subject individual notifies the officer or
agency, within 5 days, of his or her intent to seek a court order restraining release
of the record and files an action seeking such an order within 10 days, the record may
not be released unless the court so permits.
Autopsy records
Under current law, the public has a right to inspect or copy public records unless
otherwise provided by law or unless the custodian of the record demonstrates that
the public interest in withholding access to the record outweighs the strong public
interest in providing access. Autopsy reports, including pictures taken during
autopsies, are public records, if maintained by a government official or entity,
including a coroner, medical examiner, or district attorney.
This bill creates an exception to the public right to inspect or copy public records
specifically for autopsy reports. The bill also prohibits the custodian of an autopsy
record or any person involved in conducting an autopsy from releasing to the public
any information learned during an autopsy concerning the deceased or the cause of
his or her death without permission from the deceased's next of kin, except
information necessary to complete the medical certification on a certificate of death.
Privacy impact statements
This bill provides that whenever a bill is introduced in either house of the
legislature that would have an impact upon personal privacy, any standing
committee to which the bill is referred must not hold a public hearing on the bill or
report the bill until a privacy impact statement is prepared and received. The
statement is prepared by one or more state agencies or authorities, as determined
by the department of administration. The statement describes the impact upon
personal privacy that would result from enactment of the bill and analyzes the
desirability of that impact from the standpoint of public policy. The bill also permits
either house of the legislature, under rules of that house or joint rules, to request the
department of administration to order the preparation of a privacy impact statement
with respect to any bill before that house, either in its original form or as affected by
one or more amendments.
Under the bill, a bill has an impact on personal privacy if the bill would:
1. Provide for the creation of additional personally identifiable information
that is not readily available to the public at the time the bill is introduced;
2. Create an activity that would constitute an intrusion upon the privacy of an
individual, or alter an activity in such a way as to create such an intrusion;
3. Use the name, picture, or likeness of an individual without the consent of the
individual, or the consent of the individual's parent or guardian if the individual is
a minor; or
4. Permit or cause publicity to be given to the private life of an individual.
Policies on entering locker rooms
This bill requires each school board, private school, technical college district
board, institution and two-year collegiate campus of the University of Wisconsin
System, private institution of higher education, and professional athletic team that
has its home field or arena in this state to adopt a written policy on who may enter
and remain in a locker room used by the school or team to interview or seek
information from any person. The policy must reflect the privacy interests of the
members of the teams representing the school or the professional athletic team.
Telephone solicitations
The bill prohibits a telephone solicitor or employee or contractor of a telephone
solicitor from using a blocking service that defeats caller identification when making
a telephone solicitation. A person who violates this prohibition may be subject to a
forfeiture of $100, which is the same forfeiture that applies to violations of other
telephone solicitation requirements under current law. As with other telephone
solicitation requirements under current law, the department of agriculture, trade
and consumer protection (DATCP) has enforcement authority regarding the
prohibition.
Photographs of residential property
This bill prohibits a taxation district from posting photographs of residential
property located in the taxation district on the Internet.
Privacy and security information officers
Under current law, the department of electronic government (DEG) has general
responsibility, with certain exceptions, for management of the state's information
technology and telecommunications systems, applications, infrastructure, and
information resources, and human resources devoted to developing and maintaining
information technology systems. DEG is headed by the state chief information
officer.
This bill directs the chief information officer to appoint employees of DEG to
serve as a privacy information officer and a security information officer. The privacy
information officer is directed to provide information to employees of DEG and other
persons who are or may be the subject of any information maintained or processed
by DEG concerning applicable laws, rules, and regulations governing the protection
of privacy. The security information officer is directed to ensure the security of
information maintained or processed by DEG. Under the bill, the functions of the
privacy information officer and security information officer may not be supervised
by a division administrator whose position is included in the unclassified service.
Disclosure of juvenile records
Under current law, subject to certain exceptions, law enforcement agency
records of a juvenile, the records of the court assigned to exercise jurisdiction under
the Children's Code and the Juvenile Justice Code (juvenile court), and the records
of a municipal court exercising jurisdiction in a proceeding against a juvenile for a
local ordinance violation are confidential and may not be opened to inspection or
their contents disclosed except by order of the juvenile court. Currently, those
exceptions include an exception that permits the confidential exchange of
information between law enforcement agencies; an exception that requires a juvenile
court, on the request of a law enforcement agency to review the juvenile court's
records for the purpose of investigating alleged criminal gang activity, to open for
inspection by the law enforcement agency the records of the juvenile court relating
to any juvenile who has committed a felony at the request of or for the benefit of a
criminal gang; and an exception that requires a juvenile court, on the request of any
other juvenile court, a district attorney, or a corporation counsel to review the
juvenile court's records for the purpose of any proceeding in that other juvenile court,
to open for inspection by the requester the records of the juvenile court relating to
any juvenile who has been the subject of a proceeding under the Children's Code or
the Juvenile Justice Code.
This bill permits a law enforcement agency to disclose information in its records
relating to a juvenile as follows:
1. To another law enforcement agency as necessary for the other law
enforcement agency to pursue an investigation of any alleged criminal or delinquent
activity.
2. To a juvenile court, a municipal court, or a district attorney, corporation
counsel, municipal attorney, or other person representing the interests of the public
in a proceeding under the Children's Code or the Juvenile Justice Code as necessary
for the court to conduct, or for the person representing the interests of the public to
prepare for, a proceeding in that court.
3. To a juvenile court intake worker as necessary for the intake worker to
provide intake services.
Similarly, the bill requires a juvenile court or a municipal court to disclose its
records relating to a juvenile as follows:
1. To a law enforcement agency as necessary for the law enforcement agency
to pursue an investigation of any alleged criminal or delinquent activity.
2. To another juvenile court, another municipal court, or a district attorney,
corporation counsel, municipal attorney, or other person representing the interests
of the public in a proceeding under the Children's Code or the Juvenile Justice Code
as necessary for the other court to conduct, or for the person representing the
interests of the public to prepare for, a proceeding in that court.
3. To a juvenile court intake worker as necessary for the intake worker to
provide intake services.
The bill requires a person who obtains information under the bill to keep the
information confidential and permits the person to disclose the information only for
the purpose for which the information was obtained or as otherwise permitted under
current law, as affected by the bill.
For further information see the state and local fiscal estimate, which will be
printed as an appendix to this bill.
The people of the state of Wisconsin, represented in senate and assembly, do
enact as follows:
AB621, s. 1
1Section
1. 13.0991 of the statutes is created to read:
AB621,7,2
213.0991 Privacy impact statements. (1) In this section:
AB621,7,33
(a) "Authority" means a body created under ch. 231, 232, 233, 234, or 235.
AB621,7,54
(b) "Impact upon personal privacy" means that a bill would do one or more of
5the following:
AB621,7,76
1. Provide for the creation of additional personally identifiable information
7that is not readily available to the public at the time the bill is introduced.
AB621,7,98
2. Create an activity that would constitute an intrusion upon the privacy of an
9individual, or alter an activity in such a way as to create such an intrusion.
AB621,8,3
13. Use the name, picture, or likeness of an individual without the consent of the
2individual, or the consent of the individual's parent or guardian if the individual is
3a minor.
AB621,8,44
4. Permit or cause publicity to be given to the private life of an individual.
AB621,8,65
(c) "Personally identifiable information" has the meaning given under s. 19.62
6(5).
AB621,8,117
(d) "State agency" means an office, department, independent agency,
8institution of higher education, association, society, or other body in state
9government created or authorized to be created by the constitution or any law, which
10is entitled to expend moneys appropriated by law, including the legislature and the
11courts, but not including an authority.
AB621,8,14
12(2) (a) Whenever a bill is introduced in either house of the legislature that
13would have an impact upon personal privacy, the legislative reference bureau shall
14promptly transmit a copy of the bill to the department of administration.
AB621,8,2015
(b) Either house of the legislature may, under rules of that house or joint rules
16of the legislature, request the department of administration to order the preparation
17of a privacy impact statement with respect to any bill before that house, either in its
18original form or as affected by one or more amendments. If a house so requests, the
19chief clerk of that house shall thereupon transmit a copy of that bill and any affected
20amendments to the department of administration.
AB621,8,25
21(3) Upon receipt of a bill under sub. (2), the department of administration shall
22direct one or more state agencies or authorities to prepare a privacy impact
23statement with respect to that bill. Each privacy impact statement shall describe the
24impact upon personal privacy that would result from enactment of the bill and
25analyze the desirability of that impact from the standpoint of public policy.