AB871: Bill Text

AB871,4,18 2. Detecting or stopping a security incident; protecting against malicious, deceptive, fraudulent, or illegal activity; or prosecuting a person responsible for that activity.

AB871,4,19 3. Exercising the right of free expression and information.

AB871,4,20 4. Complying with a legal obligation under federal, state, or local law.

AB871,4,22 5. Performing a task carried out in the public interest or in the exercise of official authority vested in the controller.

AB871,4,25 6. Reasons of public interest in the area of public health, if the personal data is processed by or under the responsibility of a professional subject to confidentiality obligations under federal, state, or local law and any of the following applies:

AB871,5,3 a. Processing the personal data is necessary for purposes of preventive or occupational medicine, for assessing the working capacity of an employee, for medical diagnosis, or for providing health care or treatment.

AB871,5,6 b. Processing the personal data is necessary to protect against serious threats to health or for ensuring the quality and safety of health care, medical products, or medical devices.

AB871,5,9 7. Archiving purposes that are in the public interest, scientific or historical research purposes, or statistical purposes, if deleting the personal data is likely to render impossible or seriously impair achieving the objectives of the processing.

AB871,5,10 8. Establishing, exercising, or defending a legal claim.

AB871,5,12 (c) 1. This subsection does not require a controller to delete the following types of information:

AB871,5,14 a. Health information protected by the federal Health Insurance Portability and Accountability Act of 1996.

AB871,5,15 b. Information identifying a patient covered by 42 USC 290dd-2.

AB871,5,17 c. Information collected as part of research subject to the Federal Policy for the Protection of Human Subjects, 45 CFR part 46, or subject to 21 CFR parts 50 and 56.

AB871,5,19 d. Information and documents created specifically for and collected and maintained by a hospital.

AB871,5,21 e. Information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986, 42 USC 11101 et seq.

AB871,5,23 f. Patient safety work product information for purposes of 42 USC 299b-21 to 299b-26.

AB871,6,3 g. Information maintained by a health care provider, a health care facility, or an entity covered by the federal Health Insurance Portability and Accountability Act of 1996.

AB871,6,6 h. Personal information provided to or from or held by a consumer reporting agency, as defined in s. 422.501 (1m), if the use of the information complies with the federal Fair Credit Reporting Act, 15 USC 1681 et seq.

AB871,6,8 i. Personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act, P.L. 106-102.

AB871,6,10 j. Personal information collected, processed, sold, or disclosed pursuant to the federal Driver's Privacy Protection Act, 18 USC 2721 et seq.

AB871,6,11 k. Information maintained for employment records.

AB871,6,13 2. This subsection does not require a consumer processing personal data in connection with a purely personal or household activity to delete that personal data.

AB871,6,15 3. This subsection does not require a controller that processes a consumer's personal data for literary or artistic purposes to delete that personal data.

AB871,6,18 4. This subsection does not require a controller that processes a consumer's personal data, that intends to publish the personal data, and that believes that publication of the personal data is in the public interest to delete that personal data.

AB871,6,21 5. This subsection does not require a nonprofit organization having a political, philosophical, or religious purpose that processes a consumer's personal data to delete that personal data if all of the following apply:

AB871,6,24 a. The processing relates only to members or former members of the organization or to persons who have regular contact with the organization related the organization's purposes.

AB871,6,25 b. The personal data processed is not disclosed outside the organization.

AB871,7,2 (3) Enforcement; penalty. (a) The attorney general may investigate violations of this section and may bring actions for enforcement of this section.

AB871,7,5 (b) 1. A controller who violates sub. (2) shall be fined not more than $20,000,000 or not more than 4 percent of the controller's total annual revenue during the preceding financial year, whichever is greater.

AB871,7,8 2. A court may not impose in the same action more than one fine on a controller under this paragraph unless the additional fine is imposed for a violation that does not involve the same or linked processing activities by the controller.

AB871,2 Section 2. Effective date.

AB871,7,10 (1) This act takes effect on July 31, 2022.

AB871,7,11 (End)