SB851: Bill Text

SB851,19,18 5. Rules that establish procedures for the following:

SB851,19,19 a. The submission of a direction under sub. (4) (c) 1. a.

SB851,19,20 b. Business compliance with a direction submitted under sub. (4) (c) 1. a.

SB851,19,23 c. The use of a recognizable and uniform logo or button by all businesses to promote consumer awareness of the option to make a direction under sub. (4) (c) 1. a.

SB851,20,2 6. Rules that ensure that the notices and information that business are required to provide under this section are provided in a manner that may be easily understood by the average consumer, are accessible to consumers with disabilities, and are available in the language primarily used to interact with the consumer.

SB851,20,12 7. Rules that facilitate a consumer's or, under sub. (4) (c) 1. b., a representative's ability to make a request or submit a direction under this section, with the goal of minimizing the administrative burden on consumers, taking into account available technology, security concerns, and the burden on the business, to govern a business's determination that a request by a consumer is a verifiable consumer request, including by treating a request submitted through a password-protected account maintained by the consumer with the business while the consumer is logged into the account as a verifiable consumer request and providing a mechanism for a business to authenticate the identity of a consumer who does not maintain an account with the business and requests information or submits a direction under this section.

SB851,20,17 (c) The department of justice shall adjust the monetary threshold amount in sub. (1) (c) 1. a. in January of every odd-numbered year by the percentage change in the U.S. consumer price index for all urban consumers, U.S. city average, as determined by the federal department of labor for the period since the last adjustment under this paragraph.

SB851,20,20 (8) Contracts in violation. A provision in a contract or agreement that purports to waive or limit a requirement under this section is void and unenforceable.

SB851,20,25 (9) Private cause of action. (a) 1. A consumer may initiate an action against a business to enforce a written statement under subd. 2. and may pursue injunctive or declaratory relief, damages in an amount not less than $100 and not more than $750 per consumer per incident or actual damages, whichever is greater, or any other relief the court deems proper if all of the following apply:

SB851,21,4 a. The consumer, on an individual or class-wide basis, provides the business with written notice identifying that the consumer's nonencrypted or nonredacted personal information is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business's violation of sub. (4) (f).

SB851,21,6 b. The business continues to violate sub. (4) (f) more than 30 days after receiving the written notice under subd. 1. a.

SB851,21,10 2. No action may be brought under subd. 1. if within 30 days of receiving a written notice under subd. 1. a., a business cures the noticed violation of sub. (4) (f) and provides the consumer that provided the written notice with an express written statement that the violation has been cured.

SB851,21,16 3. In assessing the amount of damages under subd. 1., a court shall consider the relevant circumstances presented by any of the parties to the case, including the nature and seriousness of the misconduct, the number of violations, the persistence of the misconduct, the length of time over which the misconduct occurred, the willfulness of the defendant's misconduct, and the defendant's assets, liabilities, and net worth.

SB851,21,18 (b) A consumer may initiate an action against a business solely for actual pecuniary damages suffered as a result of the business's violation of sub. (4) (f).

SB851,21,19 (10) Inapplicability. (a) This section does not do any of the following:

SB851,21,21 1. Restrict a business from complying with federal or state laws or local ordinances.

SB851,21,23 2. Restrict a business from complying with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities.

SB851,22,2 3. Restrict a business, service provider, or 3rd party from cooperating with law enforcement agencies concerning conduct or activity that the business, service provider, or 3rd party reasonably and in good faith believes might violate federal, state, or local law.

SB851,22,3 4. Restrict a business from exercising or defending legal claims.

SB851,22,5 5. Restrict the collection, use, retention, sale, or disclosure of consumer information that is deidentified or aggregate consumer information.

SB851,22,9 6. Restrict the collection or sale of a consumer's personal information if the information is collected while the consumer was outside of this state, no part of any sale of the consumer's personal information occurs in this state, and no personal information collected from a consumer while the consumer is in this state is sold.

SB851,22,10 (b) This section does not apply to any of the following:

SB851,22,12 1. Medical information that is collected by a health care provider or entity and covered by federal law.

SB851,22,15 2. Information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects while following standards developed by international organizations of federal agencies.

SB851,22,19 3. Personal information sold to or from a consumer reporting agency, as defined in s. 422.501 (1m), if the information is reported in or used to generate a consumer report, as defined in s. 100.54 (1) (b), and the use of the information complies with the federal Fair Credit Reporting Act, 15 USC 1681 et seq.

SB851,22,21 4. Personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act, Public Law 106-102.

SB851,22,23 5. Personal information collected, processed, sold, or disclosed pursuant to the the federal Driver's Privacy Protection Act, 18 USC 2721 et seq.

SB851,23,3 (11) Violations; penalty. (a) If a series of steps or transactions are component parts of a single transaction intended from the beginning to be taken with the intention of avoiding the requirements of this section, including the disclosure of information by a business to a 3rd party in order to avoid constituting a sale, a court shall disregard the intermediate steps or transactions for purposes of this section.

SB851,23,9 (b) The department of justice may, if a business, service provider, or person violates this section more than 30 days after receiving notification of the violation from the department of justice, commence an action in the name of the state against the business, service provider, or other person to recover a forfeiture to the state of not more than $2,500 for each violation or a forfeiture of not more than $7,500 for each intentional violation.

SB851,2 Section 2 . Initial applicability.

SB851,23,12 (1) This act first applies to a contract that is entered into, renewed, or modified on the effective date of this subsection.

SB851,3 Section 3 . Effective date.

SB851,23,15 (1) This act takes effect on the first day of the 7th month beginning after publication.

SB851,23,16 (End)