AB738: Bill Text

Requests by merchants for customers' social security numbers

Current law generally does not prohibit a seller from requesting that a customer disclose his or her social security number. This bill prohibits a seller of goods at retail from making such a request unless the seller is required to do so in issuing fish and game approvals as an agent of the Department of Natural Resources (DNR). Under current law, DNR is required to obtain the social security number from an applicant for a fish and game approval so that the state may determine whether the applicant is delinquent in the payment of certain state taxes or in the payment of child support or other court-ordered family support or birth expenses. If an applicant is delinquent or fails to provide his or her social security number, the agent must deny the application for the approval.

Posting of personal information in government records on the Internet

This bill provides that no state or local government officer or agency that maintains an Internet site may post on that site any public record containing the name of an individual together with any of the following information: 1) the individual's birth date; 2) the number of a driver's license issued to the individual by the Department of Transportation; 3) the telephone number at the individual's place of employment; and 4) the unpublished home telephone number of the individual. The prohibition does not apply to publication or electronic posting of a telephone number at an individual's place of employment by a governmental unit that is the employer of the individual. In addition, the prohibition does not apply to the posting of information that is required to be provided as a part of the sex offender registry program.

Currently, state and local government officers and agencies may post information in public records on the Internet unless access to that information is required to be withheld by law.

Access to certain public records containing social security numbers

Currently, the custodian of the records of any state or local governmental unit must provide access to any public record in his or her custody unless otherwise authorized or required by law or unless the custodian demonstrates that the public interest in withholding access to the record outweighs the strong public interest in providing access to that record. Federal law prohibits state and local governmental units from disclosing social security numbers under certain conditions.

This bill provides that, if a new record containing the social security number of an individual, together with information revealing the identity of that individual, is kept by a state or local governmental unit on or after January 1, 2007, or if a record in the custody of a state or local governmental unit is modified to insert the social security number of an individual on or after January 1, 2007, and the record contains information revealing the identity of that individual, the custodian of the record must delete the social security number before permitting access to the record by any person other than an officer or employee of the governmental unit, unless the person who requests access to the record is specifically authorized by federal or state law or by the subject individual to have access to the social security number.

The bill, however, permits the requester of a record to have access to the social security number of an individual, unless otherwise restricted by law, if:

1. The record pertains to that individual alone, to the marital or parental rights or responsibilities of that individual and his or her spouse or former spouse, to the property of that individual held jointly or in common with one or more other individuals, or to a civil lawsuit in which the individual is a specifically named party, and the individual provides appropriate identification; or

2. The requester is an authorized representative of an insurer or an organization that performs investigations for insurers and the social security number is relevant to an investigation of suspected, anticipated, or actual insurance fraud.

The bill provides that, if any person misrepresents his or her identity for the purpose of obtaining access to the social security number of another individual, the person is subject to a forfeiture (civil penalty) of not more than $1,000 for each social security number obtained by means of misrepresentation. In addition, under the bill, if any insurer or other person obtains a social security number and uses that number for purposes other than an investigation of suspected, anticipated, or actual insurance fraud, the person is subject to a forfeiture of not more than $1,000 for each social security number used by the person for unauthorized purposes.

The bill also provides that no state or local governmental unit may provide access to any record to which access is restricted that contains the social security number of an individual, together with information revealing the identity of that individual, to any officer or employee of the unit other than the custodian of the record or an employee working under the immediate supervision of the custodian unless the officer's or employee's official responsibilities require the officer or employee to have access to the number or the officer or employee is authorized by the subject individual to have access to the number.

Access to employer records containing social security numbers

In addition, the bill prohibits an employer from providing access to any record that contains the social security number of an employee of the employer, together with information revealing the identity of that employee, to any person unless the number is redacted; the person is authorized by federal or state law or by the employee who is the subject of the record to have access to the number; or the person is an officer, employee, or agent of the employer and his or her official responsibilities require him or her to have access to the number.

Register of deeds; prohibition on recording certain documents; social security numbers

Generally, under current law, a register of deeds is required to record in his or her office any document that is authorized by law to be so recorded. Documents that are recorded in a register of deeds' office include deeds, mortgages, real estate conveyances, documents relating to certain security interests, and certain financial documents. In addition, a register of deeds is required under current law to make and deliver on demand, to any person who pays the required fees, a copy of any record, paper, or file in the register's office.

Under this bill, a register of deeds may not record any instrument offered for recording if the instrument contains more than the last four characters of the social security number of an individual. If a register of deeds is presented with an instrument that contains more than the last four characters of the social security number of an individual, and if the register of deeds records the instrument but does not discover the error until after the instrument is recorded, the register of deeds may not be held liable for the instrument drafter's placement of the social security number on the instrument and may remove or obscure enough of the social security number so that no more than the last four characters of the number are discernable on the instrument.

Also under this bill, if a register of deeds records an instrument that contains an entire social security number, the instrument drafter is liable to the individual whose social security number appears in the instrument for damages of not more than $5,000, plus actual damages.

The changes to current law made in the bill do not apply to federal tax liens.

The bill also prohibits credit reporting agencies from using the number of creditor inquiries as a factor in any credit scoring methodology used in preparing credit reports.

Because this bill creates a new crime or revises a penalty for an existing crime, the Joint Review Committee on Criminal Penalties may be requested to prepare a report concerning the proposed penalty and the costs or savings that are likely to result if the bill is enacted.

For further information see the state and local fiscal estimate, which will be printed as an appendix to this bill.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

AB738, s. 1 Section 1. 19.36 (13) of the statutes is created to read:

AB738,5,5 19.36 (13) Access to certain records on Internet sites. (a) Except as provided in par. (b), no authority that maintains an Internet site may post on that site any record containing the name of an individual, together with any of the following information pertaining to that individual:

AB738,5,6 1. The individual's birth date.

AB738,5,7 2. The number of an operator's license issued to the individual under ch. 343.

AB738,5,9 3. Except as provided in par. (b), the telephone number at the individual's place of employment.

AB738,5,10 4. The unpublished home telephone number of the individual.

AB738,5,11 (b) This subsection does not apply to any of the following:

AB738,6,3 1. The publication or electronic posting of the telephone number at an individual's place of employment by an authority that is the employer of the individual.

AB738,6,5 2. The posting of any information that is required to be provided under s. 301.45 (2).

AB738, s. 2 Section 2. 19.36 (14) of the statutes is created to read:

AB738,6,8 19.36 (14) Social security numbers. (a) In this subsection, "employee" includes an individual holding a local public office or a state public office.

AB738,6,17 (b) Except as provided in par. (c), if a new record containing a social security number of an individual, together with information revealing the identity of that individual, is kept by an authority on or after January 1, 2007, or if a record in the custody of an authority is modified to insert the social security number of an individual on or after January 1, 2007, and the record contains information revealing the identity of that individual, the authority shall delete the social security number before permitting access to the record to any person other than an officer or employee of the authority, unless the requester is specifically authorized by federal or state law or by the record subject to have access to the number.

AB738,6,20 (c) Unless otherwise provided by federal or state law, including common law principles, a requester may have access to a record containing the social security number of an individual if any of the following applies:

AB738,7,2 1. The record pertains to that individual alone, to the marital or parental rights or responsibilities of that individual and his or her spouse or former spouse, to property of that individual held jointly or in common tenancy with one or more other individuals, or to a civil legal action or proceeding in which the individual is a specifically named party, and the individual provides appropriate identification to the custodian.

AB738,7,6 2. The requester is an authorized representative of an insurer or an organization that performs investigations for insurers and the social security number is relevant to an investigation of suspected, anticipated, or actual insurance fraud.

AB738,7,14 (d) No authority may provide access under s. 19.35 (1) to any record to which access is restricted under par. (b) that contains the social security number of an individual, together with information revealing the identity of that individual, to any officer or employee of the authority other than the legal custodian or an employee working under the immediate supervision of the custodian unless the number is redacted, the officer's or employee's official responsibilities require the officer or employee to have access to the number, or the officer or employee is authorized by the record subject to have access to the number.

AB738, s. 3 Section 3. 19.37 (4) of the statutes is renumbered 19.37 (4) (a).

AB738, s. 4 Section 4. 19.37 (4) (b) and (c) of the statutes are created to read:

AB738,7,20 19.37 (4) (b) If any person misrepresents his or her identity for the purpose of obtaining access to the social security number of another individual under s. 19.36 (14) (c), the person may be required to forfeit not more than $1,000 for each social security number obtained by the person by means of such misrepresentation.

AB738,7,24 (c) If an insurer or other person obtains a social security number under s. 19.36 (14) (c) and uses that number for purposes other than an investigation as provided in that paragraph, the person may be required to forfeit not more than $1,000 for each social security number used by the person for such unauthorized purposes.

AB738, s. 5 Section 5. 59.20 (3) (d) of the statutes is amended to read:

AB738,8,4 59.20 (3) (d) Any register of deeds who in good faith makes an erroneous determination as to the accessibility of a portion of a record, to members of the public under s. 19.36 (6), is not subject to any penalty for denial of access to the record under s. 19.37 (4) (a).

AB738, s. 6 Section 6. 59.43 (1) (intro.) of the statutes is amended to read:

AB738,8,7 59.43 (1) Register of deeds; duties. (intro.) The Subject to sub. (1m), the register of deeds shall:

AB738, s. 7 Section 7. 59.43 (1m) of the statutes is created to read:

AB738,8,12 59.43 (1m) Restrictions on recording instruments with social security numbers. (a) Except as otherwise provided in this subsection, a register of deeds may not record any instrument offered for recording if the instrument contains more than the last 4 characters of the social security number of an individual.

AB738,8,21 (b) If a register of deeds is presented with an instrument for recording that contains more than the last 4 numbers of an individual's social security number, and if the register of deeds records the instrument but does not discover that the instrument contains more than the last 4 numbers of an individual's social security number until after the instrument is recorded, the register of deeds may not be held liable for the instrument drafter's placement of more than the last 4 numbers of an individual's social security number on the instrument and the register of deeds may remove or obscure characters from the social security number such that no more than the last 4 characters of the social security number are discernable on the instrument.

AB738,9,3 (c) If a register of deeds records an instrument that contains the complete social security number of an individual, the instrument drafter is liable to the individual whose social security number appears in the recorded public document for damages of not more than $5,000, plus any actual damages resulting from the instrument being recorded. A person may not be held liable for actual damages under this paragraph unless the individual harmed paid or incurred any costs as a result of the instrument being recorded.

AB738,9,4 (d) Paragraphs (a) to (c) do not apply to a federal income tax lien.

AB738, s. 8 Section 8. 100.53 of the statutes is created to read:

AB738,9,7 100.53 Notice of unauthorized disclosure of computerized personal information. (1) Definitions. In this section:

AB738,9,9 (a) "Computerized personal information" means personal information that is stored on a computer or on an optical, electromagnetic, or other electronic medium.

AB738,9,13 (b) "Major credit reporting agencies" means firms, as determined by the department, most actively engaged in the business of collecting and dispensing financial information regarding individuals, including information regarding creditworthiness.

AB738,9,16 (c) "Personal information" means an individual's social security number and any of the information specified in s. 895.505 (1) (e), except that it does not include information that is available to the public.

AB738,9,22 (2) Notification of unauthorized acquisition. (a) If a person that owns computerized personal information or licenses computerized personal information from another knows or has reason to know that the computerized personal information has been acquired by a person who is not authorized to do so by the individual who is the subject of the computerized personal information, the person shall, as soon as practicable, do all of the following:

AB738,9,24 1. Provide written notice under sub. (3) (a) to the individual who is the subject of the computerized personal information that has been acquired.

AB738,10,2 2. Provide notice under sub. (3) (b) to not less than 3 major credit reporting agencies.

AB738,10,8 (b) If a person that maintains computerized personal information owned or licensed by another knows or has reason to know that the computerized personal information has been acquired by a person who has not been authorized to do so by the owner or licensee of the computerized personal information, the person shall notify as soon as practicable the owner or licensee of the computerized personal information.

AB738,10,10 (3) Content and form of notice. (a) Notice under sub. (2) (a) 1. shall be given in writing and contain all of the following:

AB738,10,13 1. A statement that computerized personal information pertaining to the individual and owned or licensed by the person giving notice has been acquired by a person who is not authorized to do so by the individual.

AB738,10,15 2. A description of the personal information that has been acquired and the date when the acquisition occurred.

AB738,10,18 3. A warning that the unauthorized acquisition of personal information may adversely affect the individual's credit rating, and an advisory to monitor the individual's credit information.

AB738,10,20 4. Telephone numbers and mailing addresses for not less than 3 major credit reporting agencies.

AB738,10,22 (b) Notice under sub. (2) (a) 2. shall be given in writing and contain all of the following:

AB738,11,2 1. A statement that computerized personal information pertaining to an individual and owned or licensed by the person giving notice has been acquired by a person who is not authorized to do so by the individual who is the subject of the personal information.

AB738,11,3 2. The name of the individual who is the subject of the personal information.

AB738,11,5 3. A general identification of the type of personal information that has been acquired.

AB738,11,6 4. The date when the personal information was acquired.

AB738,11,10 (c) If a person is required give notice under sub. (2) (a) 1. to more than one individual as a result of a single acquisition of computerized personal information and the cost of giving written notice to all individuals would exceed $250,000, the person may give notice by doing all of the following:

AB738,11,12 1. Sending an electronic mail message to an individual's electronic mail address.

AB738,11,13 2. Conspicuously posting notice at the person's Internet Web site.

AB738,11,16 3. Notifying news media in this state in a manner reasonably calculated to provide media notice of the acquisition of personal information to all individuals who are the subject of the acquisition.

AB738,11,19 (4) Enforcement. (a) The department of justice or any district attorney may commence an action in circuit court in the name of the state to restrain by temporary or permanent injunction any violation of this section.

AB738,12,2 (b) Any person who is injured by a violation of this section may bring an action against the violator for damages, injunctive relief, or both. An action under this subsection may be brought against a county, town, city, or village, or against the state or any office, department, independent agency, authority, institution, association, society, or other body in state government created or authorized to be created by the constitution or any law, including the legislature and the courts. Notwithstanding s. 814.04 (1), in an action under this subsection, the court shall award a prevailing plaintiff reasonable attorney fees.

AB738, s. 9 Section 9. 103.135 of the statutes is created to read:

AB738,12,8 103.135 Records containing social security numbers of employees. (1) Definition. In this section, "officer" means an officer of a governmental body, an officer or director of a corporation, a member or manager of a limited liability company, a partner of a partnership or a joint venture, or an owner of a sole proprietorship.

AB738,12,12 (2) Access prohibited; exceptions. No employer may provide access to any record that contains the social security number of an employee of that employer, together with information revealing the identity of that employee, to any person unless any of the following applies:

AB738,12,13 (a) The number is redacted.

AB738,12,15 (b) The person is authorized by federal or state law or by the employee who is the subject of the record to have access to the number.

AB738,12,18 (c) The person is an officer, employee, or agent of the employer and the official responsibilities of the officer, employee, or agent require him or her to have access to the number.

AB738, s. 10 Section 10. 134.44 of the statutes is created to read:

AB738,12,22 134.44 Requests by retailers for social security numbers. (1) No seller of goods at retail may request that a customer disclose the customer's social security number.

AB738,13,2 (2) Subsection (1) does not apply to an agent of the department of natural resources appointed under s. 29.024 (6) (a) 3. who requests a customer's social security number if the customer is applying to the agent for an approval, as defined in s. 29.001 (12), and the customer's social security number is required under s. 29.024 (2g) or (2r).

AB738,13,3 (3) Any seller who violates sub. (1) shall be fined not more than $100.