AB824: Bill Text

Data is defined in the bill as including “sensitive information,” which is defined as information that, if disclosed or accessed by unauthorized parties, could result in harm, privacy violations, or negative consequences for individuals or entities. “Sensitive information” includes “personally identifiable information,” meaning information that is or can reasonably be linked to an identified person, identifiable person, or device linked to a person, and “nonpublic or privately held information,” meaning information that is not publicly available or accessible to the general public; is restricted to a specific group of individuals or entities; is considered confidential or proprietary; is protected by privacy regulations; and requires appropriate safeguards to prevent unauthorized access, use, or disclosure. The requirements of the bill apply to data controllers who use or facilitate the use of sensitive information.

Under the bill, a data owner must limit the access to, sharing of, and use of its data to what is adequate, relevant, and reasonably necessary for the purposes for which the data is collected or generated. A data owner must also establish and ensure compliance with relevant regulatory requirements and with internal policies related to the review of data sharing and data use requests; data handling best practices; and the handling of data agreement breaches, security incidents, and related disputes.

Under the bill, a data custodian must provide a secure environment for the storage of a data owner's data that is designed and configured in a manner that reflects best practices in data security on subjects including identity and access management controls, role-based permissions, data encryption, cyber security threat monitoring, and recovery capabilities in the event of a disaster. A data custodian must also establish and ensure compliance with internal policies and procedures related to data access control, data retention and data destruction, auditing capabilities and the performance of audits, the periodic review of new and changing business and regulatory requirements that may impact data solution organization, and any other requirements established in a data agreement. A data custodian must also establish and ensure compliance with internal policies and procedures related to security incidents and auditing.

Under the bill, a data steward must establish and ensure compliance with internal policies and procedures related to various data handling practices.

If a data owner enters into an agreement with a data custodian or a data steward, the agreement must meet the requirements described in the bill. Such an agreement must identify all relevant parties, data sets, permitted uses and restrictions of data, confidentiality requirements, law governing the data, and law governing the agreement. Such an agreement must also include statements regarding the response to security incidents, the term of the agreement, the terms for terminating the agreement, and the authorization for or prohibition of the collection and analysis of metadata, or data that describes other data. Such an agreement between a data owner and a data custodian must include statements regarding auditing capabilities and requirements.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

AB824,1 Section 1. 100.75 of the statutes is created to read:

AB824,2,3 100.75 Requirements and standards for the sharing of sensitive information between separate legal entities. (1) Definitions. In this section:

AB824,2,6 (a) “Data” includes sensitive information, such as personally identifiable information and nonpublic or privately held information, and nonsensitive information, such as public information or deidentified personal information.

AB824,3,2 (b) “Data agreement” means a written data contract entered into between data controllers. “Data agreement” includes any of the following:

AB824,3,4 1. Data sharing agreements establishing terms for a data custodian providing storage of data owned by a data owner.

AB824,3,6 2. Data use agreements establishing terms for a data steward using data owned by a data owner for a specific mutually agreed-upon purpose.

AB824,3,9 3. Data access agreements establishing terms for a data steward using data owned by a data owner and housed within a data custodian's data storage environment.

AB824,3,14 (c) “Data controller” means any entity, public or private, that determines the purposes and means of processing data, and that is responsible for complying with applicable data protection laws and ensuring that data is handled in a lawful and responsible manner. “Data controller” includes data custodians, data owners, and data stewards.

AB824,3,16 (d) “Data custodian” means any person that provides data storage on behalf of a data owner.

AB824,3,18 (e) “Data owner” means any person that generates, collects, or uses data for its own purposes.

AB824,3,20 (f) “Data steward” means any person that uses or facilitates the use of data on behalf of a data owner.

AB824,3,24 (g) “Deidentified personal information” means information that cannot reasonably be linked to an identified person, identifiable person, or device linked to a person. “Deidentified personal information” includes aggregated information, generalized information, and randomized information.

AB824,4,4 (h) “Enhanced data” means data that has been standardized, derived, aggregated, organized, corrected, verified, augmented, merged with other data, or otherwise prepared for further analysis or use. “Enhanced data” may be based on data from more than one data owner.

AB824,4,5 (i) “Metadata” means data that describes other data.

AB824,4,12 (j) “Nonpublic or privately held information” means information that is not publicly available or accessible to the general public; is restricted to a specific group of individuals or entities; is considered confidential or proprietary; is protected by privacy regulations; and requires appropriate safeguards to prevent unauthorized access, use, or disclosure. “Nonpublic or privately held information” includes intellectual property, financial information, confidential business agreements, and regulatory information.

AB824,4,16 (k) “Nonsensitive information” means information that is not subject to legal protections due to its nature or potential impact on individuals' privacy, security, or other rights. “Nonsensitive information” includes public information and deidentified personal information.

AB824,4,22 (L) “Personally identifiable information” means information that is or can reasonably be linked to an identified person, identifiable person, or device linked to a person. “Personally identifiable information” includes identifying attributes, contact information, personal characteristics, financial information, biometric data, health and medical information, online identifiers, and education and employment information.

AB824,5,3 (m) “Public information” means information that is lawfully made available through federal, state, or local government records, or information that is reasonably believed to be lawfully made available to the general public through widely distributed media by the consumer or by a person to whom the consumer has disclosed the information, unless the consumer has restricted the information to a specific audience.

AB824,5,10 (n) “Sensitive information” means any type of information that, if disclosed or accessed by unauthorized parties, could result in harm, privacy violations, or negative consequences for individuals or entities. “Sensitive information” includes information that requires special protection due to its nature and includes personally identifiable information and nonpublic or privately held information. “Sensitive information” includes nonsensitive information that is mingled with sensitive information.

AB824,5,12 (2) Requirements for data controllers. (a) A data owner that generates, collects, or uses sensitive information shall do all of the following:

AB824,5,15 1. Limit the access to, sharing of, and use of its data to what is adequate, relevant, and reasonably necessary for the purposes for which the data is collected or generated.

AB824,5,18 2. Establish and ensure compliance with internal policies and procedures governing the review of data sharing and data use requests. Such policies and procedures shall include all of the following:

AB824,5,19 a. A schedule indicating how often the data owner will review requests.

AB824,5,20 b. Assessment criteria for the approval or rejection of requests.

AB824,5,21 c. Documentation of the rationale for the rejection of a request.

AB824,5,22 d. Notice of the rejection to the requesting entity.

AB824,5,25 3. Establish and ensure compliance with internal policies and with any relevant regulatory requirements on the sharing of sensitive information with another legal entity.

AB824,6,2 4. Establish and ensure compliance with internal policies and procedures that reflect best practices of data handling on all of the following subjects:

AB824,6,4 a. Identity and access management controls, including limiting the access to any data subject to a data agreement.

AB824,6,5 b. Data retention and data destruction.

AB824,6,7 c. The periodic review of new and changing business and regulatory requirements that may impact data sharing.

AB824,6,10 5. Establish and ensure compliance with internal policies and procedures regarding the handling of data agreement breaches; security incidents, in compliance with s. 134.98; and related disputes.

AB824,6,12 (b) A data custodian that provides storage for sensitive information shall do all of the following:

AB824,6,15 1. Provide a secure environment for the storage of a data owner's data. The environment shall be designed and configured in a manner that reflects best practices of data security on subjects including all of the following:

AB824,6,17 a. Identity and access management controls, including limiting the access to any data subject to a data agreement.

AB824,6,19 b. Role-based permissions, including limiting the access to data subject to a data agreement to only authorized users.

AB824,6,20 c. Data encryption at rest and in transit.

AB824,6,21 d. Cyber security monitoring and threat detection.

AB824,6,23 e. Recovery capabilities in the event of a disaster, such as fail-over, backup, and restore capabilities.

AB824,6,25 2. Establish and ensure compliance with internal policies and procedures that reflect best practices on all of the following subjects:

AB824,7,1 a. Data access control.

AB824,7,2 b. Data retention and data destruction.

AB824,7,3 c. Auditing capabilities and the performance of audits.

AB824,7,5 d. The periodic review of new and changing business and regulatory requirements that may impact data solution organization.

AB824,7,6 e. Any other requirements established in a data agreement.

AB824,7,8 3. Establish and ensure compliance with internal policies and procedures related to security incidents that include all of the following:

AB824,7,10 a. A description of the severity levels by which security incidents are classified with descriptions and relevant examples for each severity classification.

AB824,7,13 b. The number of hours after a security incident is detected when a data custodian must notify the data owner and data steward of the incident and the timing of subsequent updates, based on the nature or severity of the incident.

AB824,7,16 c. A policy and process to designate a specific member of the data custodian's team to provide security incident communications to the data owner and data steward.

AB824,7,22 d. A policy to inform the data owner and data steward of the time the incident occurred, if known; the time the incident was detected; the nature of the incident, including which data sets were known to have been impacted; the severity of the incident; the remediation steps that have been or will be taken; the estimated timeline to resolve the incident; and a way for the data owner or data steward to contact the data custodian to seek further information about the incident.

AB824,8,2 e. A policy to provide a follow-up notification after the resolution of an incident that includes the time the incident was resolved, the nature of the resolution, any changes to the data custodian's systems or protocols to prevent subsequent incidents, and any recommended changes to the data owner's or data steward's systems protocols to prevent subsequent incidents.

AB824,8,5 f. A record retention policy that requires the data custodian to maintain records detailing its response to security incidents for a reasonable time after the resolution of the security incident.

AB824,8,8 4. Establish and ensure compliance with internal policies and procedures related to auditing capabilities that require the data custodian to perform an audit of its systems at the request of the data owner.

AB824,8,10 (c) A data steward that uses or facilitates the use of sensitive information shall do all of the following:

AB824,8,12 1. Establish and ensure compliance with internal policies and procedures that reflect best practices of data handling on subjects including all of the following:

AB824,8,14 a. Standards, policies, procedures, and requirements for requesting, accessing, interpreting, and using data.

AB824,8,16 b. Identity and access management controls, including limiting the access to any data subject to a data agreement.

AB824,8,18 c. Verification of data outputs to meet quality, accuracy, and reliability specifications.

AB824,8,19 d. Establishment of data element definitions and lineage.

AB824,8,21 e. Establishment and maintenance of auditing policies, procedures, and reporting.

AB824,8,22 f. Policies and procedures regarding data retention and destruction.

AB824,8,24 g. Interpretation of new and changing business and regulatory requirements that may impact data solution organization.

AB824,8,25 h. Any other requirements established in a data agreement.

AB824,9,3 2. Establish and ensure compliance with policies and procedures regarding the handling of data agreement breaches, security incidents, in compliance with s. 134.98, and related disputes.

AB824,9,7 (3) Agreements between data controllers. Data agreements are required when sensitive information controlled by one data controller is to be shared with, accessed by, or used by another data controller. A data agreement shall contain all of the following provisions:

AB824,9,8 (a) Identification of the parties to the agreement.

AB824,9,9 (b) Identification of the data subject to the agreement.

AB824,9,13 (c) Identification of the permitted uses and restrictions of the data subject to the agreement, including whether the data owner permits the data controller to share with another entity any enhanced data that was based on the data owner's original data.

AB824,9,15 (d) Identification of any confidentiality requirements for the data subject to the agreement.

AB824,9,21 (e) Identification of the law governing the data subject to the agreement, such as the federal Family Educational Rights and Privacy Act, the federal Health Insurance Portability and Accountability Act, the federal Health Information Technology for Economic and Clinical Health Act, the federal Criminal Justice Information Services Security Policy, or the federal Children's Online Privacy Protection Rule.

AB824,9,23 (f) Identification of the governing law and venue that shall govern the validity, construction, enforcement, and interpretation of the agreement.

AB824,9,25 (g) Provisions governing the response to security incidents, in compliance with s. 134.98, including all of the following:

AB824,10,3 1. The name and contact information of one or more individuals who are authorized to provide and receive security incident communications pertaining to the data subject to the agreement.

AB824,10,5 2. An attestation from a data custodian that it has established and agrees to comply with security incident policies and procedures under sub. (2) (b) 3.

AB824,10,9 (h) Definition of the term of the data agreement. A data agreement under this section shall remain in effect until a mutually agreed upon termination date or until all data subject to the agreement is destroyed or returned to the data owner, whichever occurs first.

AB824,10,11 (i) Provisions regarding the right to terminate the agreement, including all of the following:

AB824,10,12 1. Conditions under which the agreement may be terminated.

AB824,10,13 2. The method of notification required before termination is effective.

AB824,10,14 3. The advance notice period required before termination is effective.

AB824,10,16 4. Any special circumstances under which immediate termination of the agreement may be pursued.

AB824,10,18 (j) Provisions regarding authorization for or prohibition of the collection and analysis of metadata.

AB824,10,25 (k) In a data sharing agreement between a data owner and a data custodian, provisions regarding auditing capabilities and the performance of audits. A data custodian shall attest that it has enabled appropriate capabilities to support compliance with the regulatory statutes identified in the agreement and shall agree, at the request of the data owner, to perform an audit of the data owner's data under its custodianship. Such an audit shall have a mutually agreed upon scope and shall be performed within a mutually agreed upon time frame.