AB870: Bill Text

LRB-4120/1

KP:ahe&amn

2019 - 2020 LEGISLATURE

2019 Assembly BILL 870

February 10, 2020 - Introduced by Representatives Zimmerman, Wittke, Quinn, Duchow, Wichgers, Plumer, Sortwell, Kulp, Thiesfeldt, Knodl, Gundrum, Brostoff, Macco and Steffen, cosponsored by Senator Risser. Referred to Committee on Science and Technology.

AB870,1,2 An Act to create 134.985 of the statutes; relating to: consumer access to personal data processed by a controller and providing a penalty.

Analysis by the Legislative Reference Bureau

This bill generally requires controllers of consumers' personal data to provide a consumer with copies of the consumer's personal data processed by the controller.

Under the bill, a “controller” is a person that alone or jointly with others determines the purposes and means of the processing of personal data. The bill defines “personal data” as information relating to a consumer that allows the consumer to be identified other than information lawfully made available from federal, state, or local government records.

The bill requires a controller, when collecting personal data from a consumer, to inform the consumer that it is collecting personal data and to provide the consumer with certain other information. Additionally, if a controller intends to process a consumer's personal data and the controller did not collect the personal data from the consumer, the controller must, within one month of obtaining the personal data, identify itself to the consumer and provide the consumer with certain information, such as the purposes for which the controller intends to process the personal data and where the controller obtained the personal data.

Also, under the bill, if a controller processes a consumer's personal data, the controller must provide a copy of the personal data to a consumer who requests a copy. The controller must also provide the consumer with certain other information, including the purposes for which the controller processes the personal data, the categories of the personal data that the controller processes, and the persons to whom the controller discloses the personal data. If a consumer requests a copy of personal data electronically, the controller must provide the copy and requested information in a commonly used electronic form, unless the consumer requests otherwise. A controller is not required to provide a consumer with a copy of the consumer's personal data 1) if providing the copy would adversely affect the rights of others; 2) if the controller processes a consumer's personal data out of necessity in performing a task for the public interest; or 3) if the personal data is certain health, financial, or other personal information, including information restricted by federal law.

The bill also requires a controller to notify the Department of Justice if the controller is aware of a personal data breach involving consumer personal data it maintains and the data breach is likely to result in a risk to the rights and freedoms of consumers. The notification must describe the nature of the personal data breach and provide certain additional information. Also, if the personal data breach is likely to result in a high risk to the rights and freedoms of consumers, a controller generally must notify the consumers whose personal data is involved in the personal data breach. The bill also requires a processor to notify a controller about a personal data breach of personal data that it maintains on behalf of the controller.

Under the bill, the attorney general may investigate violations and bring actions for enforcement. A controller who violates the bill's personal data breach notification requirements is subject to a fine of up to $10,000,000 or up to 2 percent of the controller's total annual revenue, whichever is greater. For violating the bill's requirements related to providing copies of a consumer's personal data, a controller may be fined up to $20,000,000 or up to 4 percent of the controller's total annual revenue, whichever is greater.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

AB870,1 Section 1. 134.985 of the statutes is created to read:

AB870,2,2 134.985 Access to personal data. (1) Definitions. In this section:

AB870,2,3 (a) “Consumer” means an individual who is a resident of this state.

AB870,2,7 (b) “Controller” means a person that alone or jointly with others determines the purposes and means of the processing of personal data, but does not include a law enforcement agency or a unit or instrumentality of the federal government, the state, or a local government.

AB870,3,6 (c) “Personal data” means information relating to an consumer that allows the consumer to be identified, either directly or indirectly, including by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors related to the physical, physiological, genetic, mental, economic, cultural, or social identity of the consumer, but does not include any information lawfully made available from federal, state, or local government records.

AB870,3,9 (d) “Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.

AB870,3,13 (e) “Process,” when used in reference to personal data, means to perform an operation or set of operations on personal data, including to collect, record, organize, store, alter, retrieve, use, disclose, disseminate, make available, combine, delete, or destroy the personal data.

AB870,3,16 (f) “Processor” means a person who processes personal data on behalf of a controller, but does not include a law enforcement agency or a unit or instrumentality of the federal government, the state, or a local government.

AB870,3,17 (g) “Recipient” means a person to which personal data is disclosed.

AB870,3,20 (2) Notice required. (a) Except as provided in par. (b), at the time when a controller collects personal data from a consumer, the controller shall provide the consumer with the following information:

AB870,3,21 1. The identity and contact information of the controller.

AB870,3,23 2. The purposes for which the controller intends to process the consumer's personal data and the legal authority for conducting the processing.

AB870,3,25 3. The recipients or categories of recipients to whom the consumer's personal data will be disclosed.

AB870,4,3 4. If known, the estimated period of time that the controller will store the consumer's personal data, or, if not known, the criteria the controller will use to determine the amount of time that the controller will store the personal data.

AB870,4,5 5. Information describing the consumer's ability to make requests under sub. (3).

AB870,4,9 6. Whether the controller will use the consumer's personal data to conduct automated decision-making related to the consumer, and, if so, the purpose for which automated decision-making will be used and meaningful information about the automated decision-making procedure.

AB870,4,12 (b) A controller is not required to provide a consumer with information under par. (a) if the consumer has previously been provided with the information required under par. (a).

AB870,4,16 (c) Except as provided in par. (d), if a controller intends to process a consumer's personal data and the controller did not collect the personal data from the consumer, within one month of obtaining the personal data, the controller shall provide the consumer with the following information:

AB870,4,17 1. The identity and contact information of the controller.

AB870,4,19 2. The purposes for which the controller intends to process the consumer's personal data and the legal authority for conducting the processing.

AB870,4,21 3. The categories of the consumer's personal data that the controller intends to process.

AB870,4,23 4. The recipients or categories of recipients to whom the consumer's personal data will be disclosed.

AB870,5,3 5. If known, the estimated period of time that the controller will store the consumer's personal data, or, if not known, the criteria the controller will use to determine the amount of time that the controller will store the personal data.

AB870,5,5 6. Information describing the consumer's ability to make requests under sub. (3).

AB870,5,7 7. The controller's source for the personal data, including whether the personal data was obtained from publicly accessible sources.

AB870,5,11 8. Whether the controller will use the consumer's personal data to conduct automated decision-making related to the consumer, and, if so, the purpose for which automated decision-making will be used and meaningful information about the automated decision-making procedure.

AB870,5,13 (d) A controller is not required to provide a consumer with information under par. (c) if any of the following applies:

AB870,5,15 1. The consumer has previously been provided with the information required under par. (c).

AB870,5,16 2. Providing the information is impossible or involves unreasonable effort.

AB870,5,17 3. Federal, state, or local law requires that the information not be disclosed.

AB870,5,20 (3) Access to personal data. (a) Upon a consumer's request, a controller shall inform the consumer as to whether or not the controller processes the consumer's personal data.

AB870,5,23 (b) 1. If a controller processes a consumer's personal data, upon the consumer's request, the controller shall provide the consumer with a copy of the consumer's personal data and all of the following information:

AB870,5,25 a. The purposes for which the controller processes the consumer's personal data.

AB870,6,1 b. The categories of the consumer's personal data that the controller processes.

AB870,6,3 c. The recipients or categories of recipients to whom the consumer's personal data have been or will be disclosed.

AB870,6,6 d. If known, the estimated period of time that the controller will store the consumer's personal data, or, if not known, the criteria the controller will use to determine the amount of time that the controller will store the personal data.

AB870,6,8 e. If the controller did not collect the personal data from the consumer, any available information on the controller's source for the personal data.