Amendment SSA1-SB164

LRBs0206/1

CTS:all:pg

2005 - 2006 LEGISLATURE

SENATE SUBSTITUTE AMENDMENT 1, TO 2005 SENATE BILL 164

September 19, 2005 - Offered by Senator Kanavas.

SB164-SSA1,1,2 An Act to create 895.507 of the statutes; relating to: notice regarding unauthorized acquisition of personal information.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

SB164-SSA1, s. 1 Section 1. 895.507 of the statutes is created to read:

SB164-SSA1,1,5 895.507 Notice of unauthorized acquisition of personal information. (1) Definitions. In this section:

SB164-SSA1,1,7 (a) 1. "Entity" means a person, other than an individual, that does any of the following:

SB164-SSA1,1,9 a. Conducts business in this state and maintains personal information in the ordinary course of business.

SB164-SSA1,1,10 b. Stores personal information in this state.

SB164-SSA1,1,12 c. Maintains for a resident of this state a depository account as defined in s. 815.18 (2) (e).

SB164-SSA1,2,1 d. Lends money to a resident of this state.

SB164-SSA1,2,2 2. "Entity" includes all of the following:

SB164-SSA1,2,6 a. The state and any office, department, independent agency, authority, institution, association, society, or other body in state government created or authorized to be created by the constitution or any law, including the legislature and the courts.

SB164-SSA1,2,7 b. A city, village, town, or county.

SB164-SSA1,2,8 (am) "Name" includes all of the following:

SB164-SSA1,2,9 1. An individual's first name.

SB164-SSA1,2,11 2. The first letter of an individual's first name combined with the individual's last name.

SB164-SSA1,2,14 (b) "Personal information" means any of the information specified in s. 943.201 (1) (b) 4., 5., 9., 11., 12. a. and c., and 13. if the information is accompanied by the name of the individual to whom the information pertains and is not publicly available.

SB164-SSA1,2,16 (c) "Publicly available information" means any information that an entity reasonably believes is one of the following:

SB164-SSA1,2,17 1. Information that is lawfully made widely available through any media.

SB164-SSA1,2,20 2. Information that is lawfully made available to the general public from federal, state, or local government records or disclosures to the general public that are required to be made by federal, state, or local law.

SB164-SSA1,3,2 (2) Notice required. (a) If an entity whose principal place of business is located in this state or an entity that stores personal information in this state knows that personal information in the entity's possession has been acquired by a person whom the entity has not authorized to acquire the personal information, the entity shall make reasonable efforts to notify each subject of the personal information. The notice shall indicate that the entity knows of the unauthorized acquisition of personal information pertaining to the subject of the personal information.

SB164-SSA1,3,9 (b) If an entity whose principal place of business is not located in this state knows that personal information pertaining to a resident of this state has been acquired by a person whom the entity has not authorized to acquire the personal information, the entity shall make reasonable efforts to notify each resident of this state who is the subject of the personal information. The notice shall indicate that the entity knows of the unauthorized acquisition of personal information pertaining to the resident of this state who is the subject of the personal information.

SB164-SSA1,3,12 (cm) Notwithstanding pars. (a) and (b), an entity is not required to provide notice of the acquisition of personal information in good faith by an employee or agent of the entity, if the personal information is used for a lawful purpose of the entity.

SB164-SSA1,3,18 (3) Timing and manner of notice. (a) Subject to sub. (5), an entity shall provide the notice required under sub. (2) within a reasonable time, not to exceed 30 business days after the entity learns of the acquisition of personal information. A determination as to reasonableness under this paragraph shall include consideration of the number of notices that an entity must provide and the methods of communication available to the entity.

SB164-SSA1,3,25 (b) An entity shall provide the notice required under sub. (2) by mail or by a method the entity has previously employed to communicate with the subject of the personal information. If an entity cannot with reasonable diligence determine the mailing address of the subject of the personal information, and if the entity has not previously communicated with the subject of the personal information, the entity shall provide notice by a method reasonably calculated to provide actual notice to the subject of the personal information.

SB164-SSA1,4,2 (3m) Regulated entities exempt. This section does not apply to any of the following:

SB164-SSA1,4,4 (a) An entity that is a financial institution, or any person under contract with such an entity, that is all of the following:

SB164-SSA1,4,7 1. Subject to the interagency guidance on response programs for unauthorized access to customer information and customer notice as published in the federal register on March 29, 2005.

SB164-SSA1,4,8 2. In compliance with the interagency guidance specified in subd. 1.

SB164-SSA1,4,10 (b) An entity that is described in 45 CFR 164.104 (a), if the entity complies with the requirements of 45 CFR part 164.

SB164-SSA1,4,15 (4) Effect on civil claims. An entity that complies with this section is not liable for damages caused by the acquisition of personal information by a person whom the entity has not authorized to acquire the personal information. Failure to comply with this section is not negligence or a breach of any duty, but may be evidence of negligence or a breach of a legal duty.

SB164-SSA1,4,23 (5) Request by law enforcement not to notify. A law enforcement agency may, in order to protect an investigation or homeland security, ask an entity not to provide a notice that is otherwise required under sub. (2) for any period of time and the notification process required under sub. (2) shall begin at the end of that time period. Notwithstanding subs. (2) and (3), if an entity receives such a request, the entity may not provide notice of or publicize an unauthorized acquisition of personal information, except as authorized by the law enforcement agency that made the request.

SB164-SSA1,5,3 (6m) Local ordinances or regulations prohibited. No city, village, town, or county may enact or enforce an ordinance or regulation that relates to notice or disclosure of the unauthorized acquisition of personal information.

SB164-SSA1,5,10 (7m) Effect of federal legislation. If the joint committee on administrative rules determines that the federal government has enacted legislation that imposes notice requirements substantially identical to the requirements of this section and determines that the legislation does not preempt this section, the joint committee on administrative rules shall submit to the revisor of statutes for publication in the Wisconsin administrative register a notice of its determination. This section does not apply after publication of a notice under this subsection.

SB164-SSA1,5,11 (End)