AB871: Bill Text

KP:amn

2019 - 2020 LEGISLATURE

2019 Assembly BILL 871

February 10, 2020 - Introduced by Representatives Zimmerman, Macco, Quinn, Duchow, Wichgers, Plumer, Sortwell, Kulp, Dittrich, Thiesfeldt, Knodl, Gundrum, Brostoff, Wittke and Steffen, cosponsored by Senator Risser. Referred to Committee on Science and Technology.

AB871,1,2 An Act to create 134.985 of the statutes; relating to: deletion of consumer personal data by controllers and providing a penalty.

Analysis by the Legislative Reference Bureau

This bill generally requires controllers of consumers' personal data to delete a consumer's personal data if the consumer requests deletion of that personal data.

Under the bill, a “controller” is a person that alone or jointly with others determines the purposes and means of the processing of personal data. The bill defines “personal data” as information relating to a consumer that allows the consumer to be identified other than information lawfully made available from federal, state, or local government records. The bill allows a consumer to request that a controller delete personal data relating to the consumer, and the controller must delete the personal data if certain conditions apply, such as the following: 1) it is no longer necessary for the controller to process the consumer's personal data to accomplish the purposes for which the personal data was collected or processed; or 2) the personal data is processed for direct marketing purposes. Under the bill, if a controller is required to delete a consumer's personal data and has disclosed the personal data, the controller must take reasonable steps based on the available technology and implementation cost to notify other controllers that are processing the personal data to delete the personal data, and other controllers so notified must also delete the personal data.

Various exceptions are provided under the bill, and under certain conditions, a controller is not required to delete personal data, such as if processing the personal data is necessary for performing a contract with the consumer, detecting or stopping a security incident, protecting against malicious, deceptive, fraudulent, or illegal activity or prosecuting a person responsible for that activity, exercising the right of free expression and information, complying with a legal obligation, or performing certain tasks carried out in the public interest, or if the personal data is processed by a political, philosophical, or religious nonprofit organization that processes only personal data of members, former members, or persons who have regular contact with the organization.

Also, under the bill, the attorney general may investigate violations and bring actions for enforcement. A controller who violates the bill's personal data deletion requirements is subject to a fine of up to $20,000,000 or of up to 4 percent of the controller's total annual revenue, whichever is greater.

Because this bill creates a new crime or revises a penalty for an existing crime, the Joint Review Committee on Criminal Penalties may be requested to prepare a report.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

AB871,1 Section 1. 134.985 of the statutes is created to read:

AB871,2,3 134.985 Deleting consumer personal data. (1) Definitions. In this section:

AB871,2,4 (a) “Consumer” means an individual who is a resident of this state.

AB871,2,8 (b) “Controller” means a person that alone or jointly with others determines the purposes and means of the processing of personal data but does not include a law enforcement agency or a unit or instrumentality of the federal government, the state, or a local government.

AB871,3,2 (c) “Personal data” means information relating to a consumer that allows the consumer to be identified, either directly or indirectly, including by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors related to the physical, physiological, genetic, mental, economic, cultural, or social identity of the consumer, but does not include any information lawfully made available from federal, state, or local government records.

AB871,3,6 (d) “Process,” when used in reference to personal data, means to perform an operation or set of operations on personal data, including to collect, record, organize, store, alter, retrieve, use, disclose, disseminate, make available, combine, delete, or destroy the personal data.

AB871,3,9 (2) Deleting consumer personal data. (a) 1. Except as provided in par. (b), upon a consumer's request, a controller shall delete without undue delay the personal data relating to the consumer if any of the following applies:

AB871,3,11 a. It is no longer necessary for the controller to process the personal data to accomplish the purposes for which the data was collected or processed.

AB871,3,12 b. The personal data is processed for direct marketing purposes.

AB871,3,13 c. The personal data has been unlawfully processed.

AB871,3,15 d. Deleting the personal data is necessary to comply with a legal obligation to which the controller is subject.

AB871,3,22 2. If a controller is required under this subsection to delete a consumer's personal data and the controller has disclosed the personal data, the controller shall take reasonable steps based on the available technology and implementation cost to notify other controllers that are processing the consumer's personal data that the consumer has requested that the controllers delete the consumer's personal data and any links to the personal data. Except as provided in par. (b), upon receiving the notice, the other controller shall delete the consumer's personal data.

AB871,4,2 3. a. Except as provided in subd. 3. b., if a controller is required under this subsection to delete a consumer's personal data, the controller shall delete the personal data and make any notification required under subd. 2. within one month of receiving the consumer's request.

AB871,4,9 b. A controller may delete a consumer's personal data and make a notification when required under this subsection within 3 months of receiving a consumer's request if necessary due to the complexity and number of requests received by the controller. If the controller does not delete the consumer's personal data and make a notification under subd. 2. within one month of the consumer's request, the controller shall within one month of the request inform the consumer about the delay and notify the consumer of the reason for the delay.

AB871,4,12 4. A controller is not required to delete personal data under this paragraph if the controller is unable to verify, using commercially reasonable efforts, the identity of the consumer making the request.

AB871,4,14 (b) A controller is not required to delete personal data under par. (a) if processing the personal data is necessary for any of the following:

AB871,4,15 1. Performing a contract to which the consumer has agreed.

AB871,4,18 2. Detecting or stopping a security incident; protecting against malicious, deceptive, fraudulent, or illegal activity; or prosecuting a person responsible for that activity.

AB871,4,19 3. Exercising the right of free expression and information.

AB871,4,20 4. Complying with a legal obligation under federal, state, or local law.

AB871,4,22 5. Performing a task carried out in the public interest or in the exercise of official authority vested in the controller.

AB871,4,25 6. Reasons of public interest in the area of public health, if the personal data is processed by or under the responsibility of a professional subject to confidentiality obligations under federal, state, or local law and any of the following applies:

AB871,5,3 a. Processing the personal data is necessary for purposes of preventive or occupational medicine, for assessing the working capacity of an employee, for medical diagnosis, or for providing health care or treatment.

AB871,5,6 b. Processing the personal data is necessary to protect against serious threats to health or for ensuring the quality and safety of health care, medical products, or medical devices.

AB871,5,9 7. Archiving purposes that are in the public interest, scientific or historical research purposes, or statistical purposes, if deleting the personal data is likely to render impossible or seriously impair achieving the objectives of the processing.

AB871,5,10 8. Establishing, exercising, or defending a legal claim.

AB871,5,12 (c) 1. This subsection does not require a controller to delete the following types of information:

AB871,5,14 a. Health information protected by the federal Health Insurance Portability and Accountability Act of 1996.

AB871,5,15 b. Information identifying a patient covered by 42 USC 290dd-2.

AB871,5,17 c. Information collected as part of research subject to the Federal Policy for the Protection of Human Subjects, 45 CFR part 46, or subject to 21 CFR parts 50 and 56.

AB871,5,19 d. Information and documents created specifically for and collected and maintained by a hospital.

AB871,5,21 e. Information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986, 42 USC 11101 et seq.

AB871,5,23 f. Patient safety work product information for purposes of 42 USC 299b-21 to 299b-26.

AB871,6,3 g. Information maintained by a health care provider, a health care facility, or an entity covered by the federal Health Insurance Portability and Accountability Act of 1996.

AB871,6,6 h. Personal information provided to or from or held by a consumer reporting agency, as defined in s. 422.501 (1m), if the use of the information complies with the federal Fair Credit Reporting Act, 15 USC 1681 et seq.

AB871,6,8 i. Personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act, P.L. 106-102.

AB871,6,10 j. Personal information collected, processed, sold, or disclosed pursuant to the federal Driver's Privacy Protection Act, 18 USC 2721 et seq.

AB871,6,11 k. Information maintained for employment records.

AB871,6,13 2. This subsection does not require a consumer processing personal data in connection with a purely personal or household activity to delete that personal data.

AB871,6,15 3. This subsection does not require a controller that processes a consumer's personal data for literary or artistic purposes to delete that personal data.

AB871,6,18 4. This subsection does not require a controller that processes a consumer's personal data, that intends to publish the personal data, and that believes that publication of the personal data is in the public interest to delete that personal data.

AB871,6,21 5. This subsection does not require a nonprofit organization having a political, philosophical, or religious purpose that processes a consumer's personal data to delete that personal data if all of the following apply:

AB871,6,24 a. The processing relates only to members or former members of the organization or to persons who have regular contact with the organization related the organization's purposes.

AB871,6,25 b. The personal data processed is not disclosed outside the organization.

AB871,7,2 (3) Enforcement; penalty. (a) The attorney general may investigate violations of this section and may bring actions for enforcement of this section.

AB871,7,5 (b) 1. A controller who violates sub. (2) shall be fined not more than $20,000,000 or not more than 4 percent of the controller's total annual revenue during the preceding financial year, whichever is greater.

AB871,7,8 2. A court may not impose in the same action more than one fine on a controller under this paragraph unless the additional fine is imposed for a violation that does not involve the same or linked processing activities by the controller.

AB871,2 Section 2. Effective date.

AB871,7,10 (1) This act takes effect on July 31, 2022.

AB871,7,11 (End)