Amendment AA10-ASA1-AB100

AB100-ASA1-AA10, s. 122n Section 122n. 19.36 (14) of the statutes is created to read:

AB100-ASA1-AA10,2,9 19.36 (14) Social security account numbers. (a) In this subsection, "employee" includes an individual holding a local public office or a state public office.

AB100-ASA1-AA10,2,18 (b) Except as provided in par. (c), if a new record containing a social security account number of an individual, together with information revealing the identity of that individual, is kept by an authority on or after January 1, 2007, or if a record in the custody of an authority is modified to insert the social security account number of an individual on or after January 1, 2007, and the record contains information revealing the identity of that individual, the authority shall delete the social security account number before permitting access to the record to any person other than an officer or employee of the authority, unless the requester is specifically authorized by federal or state law or by the record subject to have access to the number.

AB100-ASA1-AA10,2,21 (c) Unless otherwise provided by federal or state law, including common law principles, a requester may have access to a record containing the social security account number of an individual if any of the following applies:

AB100-ASA1-AA10,3,2 1. The record pertains to that individual alone, to the marital or parental rights or responsibilities of that individual and his or her spouse or former spouse, to property of that individual held jointly or in common tenancy with one or more other individuals, or to a civil legal action or proceeding in which the individual is a specifically named party, and the individual provides appropriate identification to the custodian.

AB100-ASA1-AA10,3,6 2. The requester is an authorized representative of an insurer or an organization that performs investigations for insurers and the social security account number is relevant to an investigation of suspected, anticipated, or actual insurance fraud.

AB100-ASA1-AA10,3,14 (d) No authority may provide access under s. 19.35 (1) to any record to which access is restricted under par. (b) that contains the social security account number of an individual, together with information revealing the identity of that individual, to any officer or employee of the authority other than the legal custodian or an employee working under the immediate supervision of the custodian unless the number is redacted, the officer's or employee's official responsibilities require the officer or employee to have access to the number, or the officer or employee is authorized by the record subject to have access to the number.

AB100-ASA1-AA10, s. 122p Section 122p. 19.37 (4) of the statutes is renumbered 19.37 (4) (a).

AB100-ASA1-AA10, s. 122q Section 122q. 19.37 (4) (b) and (c) of the statutes are created to read:

AB100-ASA1-AA10,3,21 19.37 (4) (b) If any person misrepresents his or her identity for the purpose of obtaining access to the social security account number of another individual under s. 19.36 (13) (a), the person may be required to forfeit not more than $1,000 for each social security account number obtained by the person by means of such misrepresentation.

AB100-ASA1-AA10,4,2 (c) If an insurer or other person obtains a social security account number under s. 19.36 (13) (b) and uses that number for purposes other than an investigation as provided in that paragraph, the person may be required to forfeit not more than $1,000 for each social security account number used by the person for such unauthorized purposes.".

AB100-ASA1-AA10,4,3 2. Page 525, line 10: after that line insert:

AB100-ASA1-AA10,4,4 " Section 1229m. 59.20 (3) (d) of the statutes is amended to read:

AB100-ASA1-AA10,4,8 59.20 (3) (d) Any register of deeds who in good faith makes an erroneous determination as to the accessibility of a portion of a record, to members of the public under s. 19.36 (6), is not subject to any penalty for denial of access to the record under s. 19.37 (4) (a).".

AB100-ASA1-AA10,4,9 3. Page 525, line 16: after that line insert:

AB100-ASA1-AA10,4,10 " Section 1230s. 59.43 (1) (intro.) of the statutes is amended to read:

AB100-ASA1-AA10,4,12 59.43 (1) Register of deeds; duties. (intro.) The Subject to sub. (1m), the register of deeds shall:".

AB100-ASA1-AA10,4,13 4. Page 525, line 21: after that line insert:

AB100-ASA1-AA10,4,14 " Section 1232m. 59.43 (1m) of the statutes is created to read:

AB100-ASA1-AA10,4,18 59.43 (1m) Restrictions on recording instruments with social security numbers. (a) Except as otherwise provided in this subsection, a register of deeds may not record any instrument offered for recording if the instrument contains more than the last 4 characters of the social security number of an individual.

AB100-ASA1-AA10,5,3 (b) If a register of deeds is presented with an instrument for recording that contains more than the last 4 numbers of an individual's social security number, and if the register of deeds records the instrument but does not discover that the instrument contains more than the last 4 numbers of an individual's social security number until after the instrument is recorded, the register of deeds may not be held liable for the instrument drafter's placement of more than the last 4 numbers of an individual's social security number on the instrument and the register of deeds may remove or obscure characters from the social security number such that no more than the last 4 characters of the social security number are discernable on the instrument.

AB100-ASA1-AA10,5,10 (c) If a register of deeds records an instrument that contains the complete social security number of an individual, the instrument drafter is liable to the individual whose social security number appears in the recorded public document for damages of not more than $5,000, plus any actual damages resulting from the instrument being recorded. A person may not be held liable for actual damages under this paragraph unless the individual harmed paid or incurred any costs as a result of the instrument being recorded.

AB100-ASA1-AA10,5,11 (d) Paragraphs (a) to (c) do not apply to a federal income tax lien.".

AB100-ASA1-AA10,5,12 5. Page 749, line 17: before that line insert:

AB100-ASA1-AA10,5,13 " Section 1829f. 100.53 of the statutes is created to read:

AB100-ASA1-AA10,5,15 100.53 Notice of unauthorized disclosure of computerized personal information. (1) Definitions. In this section:

AB100-ASA1-AA10,5,17 (a) "Computerized personal information" means personal information that is stored on a computer or on an optical, electromagnetic, or other electronic medium.

AB100-ASA1-AA10,5,21 (b) "Major credit reporting agencies" means firms, as determined by the department, most actively engaged in the business of collecting and dispensing financial information regarding individuals, including information regarding creditworthiness.

AB100-ASA1-AA10,5,24 (c) "Personal information" means an individual's social security number and any of the information specified in s. 895.505 (1) (e), except that it does not include information that is available to the public.

AB100-ASA1-AA10,6,6 (2) Notification of unauthorized acquisition. (a) If a person that owns computerized personal information or licenses computerized personal information from another knows or has reason to know that the computerized personal information has been acquired by a person who is not authorized to do so by the individual who is the subject of the computerized personal information, the person shall, as soon as practicable, do all of the following:

AB100-ASA1-AA10,6,8 1. Provide written notice under sub. (3) (a) to the individual who is the subject of the computerized personal information that has been acquired.

AB100-ASA1-AA10,6,10 2. Provide notice under sub. (3) (b) to not less than 3 major credit reporting agencies.

AB100-ASA1-AA10,6,16 (b) If a person that maintains computerized personal information owned or licensed by another knows or has reason to know that the computerized personal information has been acquired by a person who has not been authorized to do so by the owner or licensee of the computerized personal information, the person shall notify as soon as practicable the owner or licensee of the computerized personal information.

AB100-ASA1-AA10,6,18 (3) Content and form of notice. (a) Notice under sub. (2) (a) 1. shall be given in writing and contain all of the following:

AB100-ASA1-AA10,6,21 1. A statement that computerized personal information pertaining to the individual and owned or licensed by the person giving notice has been acquired by a person who is not authorized to do so by the individual.

AB100-ASA1-AA10,6,23 2. A description of the personal information that has been acquired and the date when the acquisition occurred.

AB100-ASA1-AA10,7,3 3. A warning that the unauthorized acquisition of personal information may adversely affect the individual's credit rating, and an advisory to monitor the individual's credit information.

AB100-ASA1-AA10,7,5 4. Telephone numbers and mailing addresses for not less than 3 major credit reporting agencies.

AB100-ASA1-AA10,7,7 (b) Notice under sub. (2) (a) 2. shall be given in writing and contain all of the following:

AB100-ASA1-AA10,7,11 1. A statement that computerized personal information pertaining to an individual and owned or licensed by the person giving notice has been acquired by a person who is not authorized to do so by the individual who is the subject of the personal information.

AB100-ASA1-AA10,7,12 2. The name of the individual who is the subject of the personal information.

AB100-ASA1-AA10,7,14 3. A general identification of the type of personal information that has been acquired.

AB100-ASA1-AA10,7,15 4. The date when the personal information was acquired.

AB100-ASA1-AA10,7,19 (c) If a person is required give notice under sub. (2) (a) 1. to more than one individual as a result of a single acquisition of computerized personal information and the cost of giving written notice to all individuals would exceed $250,000, the person may give notice by doing all of the following:

AB100-ASA1-AA10,7,21 1. Sending an electronic mail message to an individual's electronic mail address.

AB100-ASA1-AA10,7,22 2. Conspicuously posting notice at the person's Internet Web site.

AB100-ASA1-AA10,7,25 3. Notifying news media in this state in a manner reasonably calculated to provide media notice of the acquisition of personal information to all individuals who are the subject of the acquisition.

AB100-ASA1-AA10,8,3 (4) Enforcement. (a) The department of justice or any district attorney may commence an action in circuit court in the name of the state to restrain by temporary or permanent injunction any violation of this section.

AB100-ASA1-AA10,8,11 (b) Any person who is injured by a violation of this section may bring an action against the violator for damages, injunctive relief, or both. An action under this subsection may be brought against a county, town, city, or village, or against the state or any office, department, independent agency, authority, institution, association, society, or other body in state government created or authorized to be created by the constitution or any law, including the legislature and the courts. Notwithstanding s. 814.04 (1), in an action under this subsection, the court shall award a prevailing plaintiff reasonable attorney fees.".

AB100-ASA1-AA10,8,12 6. Page 751, line 2: after that line insert:

AB100-ASA1-AA10,8,13 " Section 1833m. 103.135 of the statutes is created to read:

AB100-ASA1-AA10,8,18 103.135 Records containing social security numbers of employees. (1) Definition. In this section, "officer" means an officer of a governmental body, an officer or director of a corporation, a member or manager of a limited liability company, a partner of a partnership or a joint venture, or an owner of a sole proprietorship.

AB100-ASA1-AA10,8,23 (2) Access prohibited; exceptions. Unless access is authorized under s. 19.36 (14), no employer may provide access to any record that contains the social security account number of an employee of that employer, together with information revealing the identity of that employee, to any person unless any of the following applies:

AB100-ASA1-AA10,8,24 (a) The number is redacted.

AB100-ASA1-AA10,9,2 (b) The person is authorized by federal or state law or by the employee who is the subject of the record to have access to the number.

AB100-ASA1-AA10,9,5 (c) The person is an officer, employee, or agent of the employer and the official responsibilities of the officer, employee, or agent require him or her to have access to the number.".

AB100-ASA1-AA10,9,6 7. Page 781, line 7: after that line insert:

AB100-ASA1-AA10,9,7 " Section 1929y. 134.44 of the statutes is created to read:

AB100-ASA1-AA10,9,10 134.44 Requests by retailers for social security numbers. (1) No seller of goods at retail may request that a customer disclose the customer's social security number.

AB100-ASA1-AA10,9,15 (2) Subsection (1) does not apply to an agent of the department of natural resources appointed under s. 29.024 (6) (a) 3. who requests a customer's social security number if the customer is applying to the agent for an approval as defined in s. 29.001 (12) and the customer's social security number is required under s. 29.024 (2g) or (2r).

AB100-ASA1-AA10,9,16 (3) Any seller who violates sub. (1) shall be fined not more than $100.".

AB100-ASA1-AA10,9,17 8. Page 782, line 8: after that line insert:

AB100-ASA1-AA10,9,18 " Section 1935m. 138.25 of the statutes is created to read:

AB100-ASA1-AA10,9,19 138.25 Credit scores. (1) Definitions. In this section:

AB100-ASA1-AA10,9,23 (a) "Credit report" means means any written, oral, or other communication of any information by a credit reporting agency bearing on a individual's credit worthiness, credit standing, or credit capacity, which is used or is expected to be used, or collected in whole or in part, for a purpose specified in 15 USC 1681b or for the purpose of serving as a factor in establishing the individual's eligibility for any of the following:

AB100-ASA1-AA10,10,3 1. Credit to be used primarily for personal, family, or household purposes.

AB100-ASA1-AA10,10,4 2. Employment, promotion, reassignment, or retention as an employee.

AB100-ASA1-AA10,10,5 3. Rental of a residential dwelling unit.

AB100-ASA1-AA10,10,12 (b) "Credit reporting agency" means any person who, for fees, dues, or other compensation, or on a cooperative nonprofit basis, regularly engages in whole or in part in the business of assembling or evaluating credit or other information on individuals for the purpose of preparing credit reports that the credit reporting agency furnishes to third parties, but does not include any governmental agency whose records are maintained primarily for traffic safety, law enforcement, or licensing purposes.

AB100-ASA1-AA10,10,15 (2) Prohibition. No credit reporting agency may use the number of creditor inquiries as a factor in any credit scoring methodology used by the credit reporting agency in preparing credit reports.

AB100-ASA1-AA10,10,16 (3) Enforcement. The division of banking shall enforce this section.".

AB100-ASA1-AA10,10,17 9. Page 823, line 16: after that line insert:

AB100-ASA1-AA10,10,18 " Section 2110m. 230.16 (12) of the statutes is created to read:

AB100-ASA1-AA10,10,21 230.16 (12) An applicant's social security number may not be used for the purpose of identifying the applicant on any examination under this subchapter or under rules of the administrator.".

AB100-ASA1-AA10,10,22 10. Page 1030, line 1: before that line insert:

AB100-ASA1-AA10,11,3 "(1v) Credit scores. The treatment of section 138.25 of the statutes first applies to credit reports furnished to third parties on the effective date of this subsection.".

AB100-ASA1-AA10,11,4 11. Page 1030, line 1: delete that line and substitute:

AB100-ASA1-AA10,11,6 "(1wk) Certificate of withdrawal fee. The treatment of section 180.0122 (1) (w)".

AB100-ASA1-AA10,11,7 12. Page 1042, line 4: after that line insert:

AB100-ASA1-AA10,11,11 "(3m) Restrictions on recording instruments with social security numbers. The treatment of section 59.43 (1) (intro.) and (1m) of the statutes first applies to an instrument that is presented to a register of deeds for recording on the effective date of this subsection.".

AB100-ASA1-AA10,11,12 (End)