Amendment AA1-AB288

LRBa0461/2

MGD:kmg:jf

2003 - 2004 LEGISLATURE

ASSEMBLY AMENDMENT 1, TO 2003 ASSEMBLY BILL 288

May 1, 2003 - Offered by Representative Staskunas.

AB288-AA1,1,1 At the locations indicated, amend the bill as follows:

AB288-AA1,1,3 1. Page 1, line 9: after "information," insert "notice regarding unauthorized use of personal information,".

AB288-AA1,1,4 2. Page 7, line 11: after that line insert:

AB288-AA1,1,5 " Section 10m. 895.507 of the statutes is created to read:

AB288-AA1,1,7 895.507 Notice of unauthorized use of personal identifying information. (1) Definitions. In this section:

AB288-AA1,1,9 (a) "Entity" means a person, other than an individual, that in the ordinary course of business maintains personal identifying information.

AB288-AA1,1,11 (b) "Personal identifying information" has the meaning given in s. 943.201 (1) (b) but does not include publicly available information.

AB288-AA1,1,13 (c) "Publicly available information" means any information that an entity reasonably believes is one of the following:

AB288-AA1,2,1 1. Information that is lawfully made widely available through any media.

AB288-AA1,2,4 2. Information that is lawfully made available to the general public from federal, state, or local government records or disclosures to the general public that are required to be made by federal, state, or local law.

AB288-AA1,2,10 (2) Required notice. (a) If an entity knows of the unauthorized use of unencrypted personal identifying information that was obtained from the entity while in the entity's possession, it shall make reasonable efforts to notify each individual who is the subject of the personal identifying information. The notice shall indicate that the entity knows of the unauthorized use of personal identifying information relating to the individual.

AB288-AA1,2,14 (b) 1. The entity shall provide the notice under par. (a) in a manner and, subject to sub. (4), within a time that is reasonable, taking into consideration the number of notices that it must provide and the methods of communication available to the entity.

AB288-AA1,2,18 2. Notwithstanding subd. 1., the entity shall provide any notice required under par. (a) within 30 days after the entity learns of the unauthorized use of the personal identifying information or, if sub. (4) applies, within 30 days after the end of the time period specified by a law enforcement agency under that subsection.

AB288-AA1,2,21 (c) Notwithstanding pars. (a) and (b), an entity is not required to provide notice to an individual of the unauthorized use of personal identifying information relating to that individual if the entity learns of the unauthorized use from that individual.

AB288-AA1,2,24 (3) Effect on civil claims. Compliance with this section is not a defense to a claim in a civil action or proceeding. Failure to comply with this section does not constitute negligence or a breach of any duty as a matter of law.

AB288-AA1,3,4 (4) Request by law enforcement not to notify. If a law enforcement agency asks an entity not to provide a notice that is otherwise required under sub. (2) for any period of time, the notification process required under sub. (2) shall begin at the end of that time period.".

AB288-AA1,3,5 (End)