AB872: Bill Text

2019 Assembly BILL 872

February 10, 2020 - Introduced by Representatives Zimmerman, Steffen, Quinn, Duchow, Wichgers, Wittke, Plumer, Sortwell, Kulp, Dittrich, Thiesfeldt, Knodl, Gundrum, Brostoff and Macco, cosponsored by Senator Risser. Referred to Committee on Science and Technology.

AB872,1,2 An Act to create 134.985 of the statutes; relating to: restricting controllers from using consumer personal data and providing a penalty.

Analysis by the Legislative Reference Bureau

This bill establishes various requirements on controllers that process consumers' personal data. Under the bill, a “controller” is a person that alone or jointly with others determines the purposes and means of the processing of personal data. The bill defines “personal data” as information relating to a consumer that allows the consumer to be identified other than information lawfully made available from federal, state, or local government records.

Under the bill, a controller may not process a consumer's personal data unless certain conditions apply, such as if the consumer consents, if processing is necessary to perform a contract the controller has with a consumer, if processing is necessary to comply with a legal obligation, or if processing is conducted to detect a security incident or to protect against fraudulent or illegal activity. The bill requires that consent to process personal data must be obtained from a consumer by a statement or clear affirmative action; that the consumer be able to withdraw consent at any time; and that consent to process a consumer's personal data may not be required as a condition of using a service provided by the controller. Additionally, the bill limits the processing of personal data that reveals a consumer's racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data; biometric data; personal data concerning a consumer's health; and personal data concerning a consumer's sex life or sexual orientation. Under the bill, a controller may process those types of personal data only if certain conditions apply, including 1) if the processing is conducted for a purpose to which the consumer consents; 2) if the processing is necessary to comply with a legal obligation; 3) if the processing is conducted by a political, philosophical, or religious nonprofit organization that processes only personal data of members, former members, or persons who have regular contact with the organization; or 4) if the processing is necessary for certain public interest reasons.

The bill also allows consumers to request that a controller restrict the processing of the consumer's personal data, and the controller may store but not otherwise process the personal data if certain conditions apply, such as the following: 1) if the controller has no legitimate ground to process the personal data that overrides the consumer's request; or 2) if processing the personal data is unlawful. The controller generally must notify other controllers to which the controller discloses the consumer's personal data, unless notification is impossible or involves unreasonable effort, and those controllers generally must not process, other than by storing, the personal data. A controller may continue processing a consumer's personal data under the bill under certain conditions, including 1) if the consumer consents; 2) if processing occurs for important public interest reasons under federal, state, or local law; or 3) if processing occurs to protect the rights of another person.

Also, under the bill, controllers and processors must maintain records of processing of personal data that contain certain information including the purpose of the processing, the categories of personal data involved in the processing, and the categories of consumers whose personal data is involved in the processing. The bill also requires a controller or processor to make the records available to the Department of Justice upon request.

Under the bill, the attorney general may investigate violations and bring actions for enforcement. A controller or processor who violates the bill's record-keeping requirements is subject to a fine of up to $10,000,000 or of up to 2 percent of the controller's total annual revenue, whichever is greater. For violating the bill's requirements related to processing a consumer's personal data, a controller or processor may be fined up to $20,000,000 or up to 4 percent of the controller's total annual revenue, whichever is greater.

Because this bill creates a new crime or revises a penalty for an existing crime, the Joint Review Committee on Criminal Penalties may be requested to prepare a report.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

AB872,1 Section 1. 134.985 of the statutes is created to read:

AB872,2,3 134.985 Processing personal data; restrictions. (1) Definitions. In this section:

AB872,3,3 (a) “Biometric data” means personal data resulting from specific technical processing relating to the physical, physiological, or behavioral characteristics of a consumer that uniquely identify the consumer.

AB872,3,4 (b) “Consumer” means an individual who is a resident of this state.

AB872,3,8 (c) “Controller” means a person that alone or jointly with others determines the purposes and means of the processing of personal data but does not include a law enforcement agency or a unit or instrumentality of the federal government, the state, or a local government.

AB872,3,10 (d) “Data concerning health” means personal data related to the physical or mental health of a consumer.

AB872,3,14 (e) “Genetic data” means personal data resulting from an analysis of a biological sample from a consumer that relates to the consumer's inherited or acquired genetic characteristics that provide unique information about the consumer's physiology or health.

AB872,3,21 (f) “Personal data” means information relating to a consumer that allows the consumer to be identified, either directly or indirectly, including by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors related to the physical, physiological, genetic, mental, economic, cultural, or social identity of the consumer, but does not include any information lawfully made available from federal, state, or local government records.

AB872,3,25 (g) “Process,” when used in reference to personal data, means to perform an operation or set of operations on personal data, including to collect, record, organize, store, alter, retrieve, use, disclose, disseminate, make available, combine, delete, or destroy the personal data.

AB872,4,3 (h) “Processor” means a person who processes personal data on behalf of a controller, but does not include a law enforcement agency or a unit or instrumentality of the federal government, the state, or a local government.

AB872,4,4 (i) “Recipient” means a person to which personal data is disclosed.

AB872,4,7 (2) Requirements for processing personal data. Subject to sub. (4), no controller or processor may process a consumer's personal data unless any of the following applies:

AB872,4,8 (a) All of the following applies:

AB872,4,11 1. The processing is conducted for a purpose to which the consumer, or if the consumer is less than 16 years of age, the consumer's parent or guardian, consents by a statement or clear affirmative action.

AB872,4,13 2. The consent under par. (a) 1. is freely given, specific, informed, and unambiguous.

AB872,4,15 3. The consumer is able to withdraw any consent provided under par. (a) 1. at any time, and before giving consent is informed that consent may be withdrawn.

AB872,4,17 4. The consent provided under par. (a) 1. is as easy for the consumer to withdraw as to give.

AB872,4,21 5. If the consumer grants consent as part of a written declaration that also concerns other matters, the request for consent is clearly distinguishable from the other matters in an intelligible and easily accessible form using clear and plain language.

AB872,4,23 6. The controller or processor is able to demonstrate that the consumer provided consent under par. (a) 1.

AB872,5,2 7. The controller or processor does not require as a condition of using the controller's or processor's service that the consumer consent to processing of personal data, unless processing the consumer's personal data is necessary to perform the service.

AB872,5,5 (b) The processing is necessary to perform a contract to which the consumer is party or in order to take steps at the request of the consumer before entering a contract.

AB872,5,6 (c) The processing is necessary for complying with a legal obligation.

AB872,5,8 (d) The processing is necessary to protect the vital interests of the consumer or another person.

AB872,5,10 (e) The processing is necessary to perform a task carried out in the public interest or to exercise official authority vested in the controller.

AB872,5,13 (f) The processing is conducted to detect security incidents; to protect against malicious, deceptive, fraudulent, or illegal activity; or to prosecute a person responsible for that activity.

AB872,5,15 (g) The controller or a 3rd party has a legitimate ground to process the personal data.

AB872,5,17 (3) Processing of certain types of personal data. (a) Except as provided in par. (b), a controller or processor may not process any of the following:

AB872,5,19 1. Personal data revealing a consumer's racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership.

AB872,5,21 2. Genetic data, data concerning health, or personal data concerning a consumer's sex life or sexual orientation.

AB872,5,23 3. Biometric data, if the purpose of the processing is to uniquely identify a consumer.

AB872,5,25 (b) A controller or processor may process information described in par. (a) if any of the following applies:

AB872,6,2 1. The processing is conducted for a purpose to which the consumer explicitly consents.

AB872,6,3 2. The processing is necessary for complying with a legal obligation.

AB872,6,6 3. The consumer is physically or legally incapable of giving consent and the processing is necessary to protect the vital interests of the consumer or another individual.

AB872,6,8 4. The processing is conducted by a nonprofit organization having a political, philosophical, or religious purpose and all of the following applies:

AB872,6,11 a. The processing relates only to members or former members of the organization or to persons who have regular contact with the organization related to the organization's purposes.

AB872,6,12 b. The personal data processed is not disclosed outside the organization.

AB872,6,13 5. The processing relates to personal data that the consumer makes public.

AB872,6,15 6. The processing is necessary for establishing, exercising, or defending a legal claim or a court authorizes the processing.

AB872,6,16 7. The processing is necessary for reasons of substantial public interest.

AB872,6,20 8. The processing is necessary for reasons of public interest in the area of public health, if the personal data is processed by or under the responsibility of a professional subject to confidentiality obligations under federal, state, or local law and any of the following applies:

AB872,6,22 a. Processing the personal data is necessary to provide health care or treatment to a person in a medical emergency.

AB872,6,25 b. Processing the personal data is necessary to protect against serious threats to health or for ensuring the quality and safety of health care, medical products, or medical devices.

AB872,7,2 9. The processing is necessary for archiving purposes that are in the public interest, scientific or historic research purposes, or statistical purposes.

AB872,7,5 (4) Request to restrict processing of personal data. (a) Except as provided in par. (c) 1., upon a consumer's request, a controller may store but may not otherwise process the consumer's personal data if any of the following applies:

AB872,7,6 1. Processing the personal data is unlawful.

AB872,7,8 2. Storing the personal data is necessary for the consumer to establish, exercise, or defend a legal claim.

AB872,7,10 3. The controller has no legitimate ground to process the personal data that overrides the consumer's request.

AB872,7,17 (b) If a controller is required under par. (a) to not process, other than by storing, a consumer's personal data and the controller has disclosed the personal data to other controllers, the controller shall notify each recipient to whom the controller disclosed the personal data about the consumer's request under par. (a), unless notification is impossible or involves unreasonable effort. Except as provided in par. (c) 1., upon receiving the notice, a controller may store but may not otherwise process the consumer's personal data if any of the conditions of par. (a) applies.

AB872,7,19 (c) 1. Paragraphs (a) and (b) do not prohibit a controller from processing, other than by storing, a consumer's personal data if any of the following apply:

AB872,7,20 a. The consumer consents to the processing.

AB872,7,22 b. The controller processes the personal data for establishing, exercising, or defending a legal claim.

AB872,7,24 c. The controller processes the personal data to protect the rights of another person.

AB872,8,2 d. The controller processes the personal data for important public interest reasons under federal, state, or local law.

AB872,8,4 2. A controller may not process, other than by storing, personal data under this paragraph unless the controller first notifies the consumer.

AB872,8,7 (d) A controller is not required to restrict processing of a consumer's personal data under this subsection if the controller is unable to verify, using commercially reasonable efforts, the identity of the consumer making the request.

AB872,8,10 (5) Records of processing activities. (a) A controller shall maintain records of processing of personal data conducted by the controller that contain all of the following information:

AB872,8,11 1. The controller's name and contact information.

AB872,8,12 2. The purpose of the processing.

AB872,8,14 3. An identification of the categories of personal data involved in the processing.

AB872,8,16 4. An identification of the categories of consumers whose personal data is involved in the processing.

AB872,8,18 5. If consent is provided for the processing, documentation of consent from consumers for the consumers' personal data to be processed.

AB872,8,20 6. The name and contact information of a person to whom the controller discloses personal data, and the purpose for the disclosure.

AB872,8,22 (b) A processor shall maintain records of processing of personal data conducted by the processor that contain all of the following:

AB872,8,24 1. The processor's name and contact information, and the name and contact information of the controller on behalf of which the processor is acting.

AB872,8,25 2. The categories of processing conducted on behalf of each controller.

AB872,9,2 (c) A controller or processor shall make records required under this subsection available to the department upon request.

AB872,9,4 (6) Applicability. (a) A controller or processor is not prohibited under this section from processing any of the following types of information:

AB872,9,6 1. Health information protected by the federal Health Insurance Portability and Accountability Act of 1996.

AB872,9,7 2. Information identifying a patient covered by 42 USC 290dd-2.

AB872,9,9 3. Information collected as part of research subject to the Federal Policy for the Protection of Human Subjects, 45 CFR part 46, or subject to 21 CFR parts 50 and 56.

AB872,9,11 4. Information and documents created specifically for and collected and maintained by a hospital.

AB872,9,13 5. Information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986, 42 USC 11101 et seq.

AB872,9,15 6. Patient safety work product information for purposes of 42 USC 299b-21 to 299b-26.