For further information see the state fiscal estimate, which will be printed as
an appendix to this bill.
The people of the state of Wisconsin, represented in senate and assembly, do
enact as follows:
SB851,1
1Section
1. 134.985 of the statutes is created to read:
SB851,3,2
2134.985 Consumer data. (1) Definitions. In this section:
SB851,4,23
(a) “Aggregate consumer information” means information that relates to a
4group or category of consumers, from which individual consumer identities have
1been removed, and that is not linked or reasonably linkable to any consumer or
2household.
SB851,4,93
(b) “Biometric information” means an individual's physiological, biological, or
4behavioral characteristics, including deoxyribonucleic acid, that can be used singly
5or in combination with each other or with other identifying data to establish
6individual identity. “Biometric information” includes imagery of the iris, retina,
7fingerprint, face, hand, palm, vein patterns, voice recordings, keystroke patterns or
8rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain
9identifying information.
SB851,4,1010
(c) “Business” means any of the following:
SB851,4,1611
1. A sole proprietorship, partnership, limited liability company, corporation,
12association, or other legal entity that is organized or operated for the profit or
13financial benefit of its shareholders or other owners, that collects consumers'
14personal information or, on the behalf of consumers, alone or jointly with others
15determines the purposes and means of the processing of consumers' personal
16information, that does business in this state, and that satisfies any of the following:
SB851,4,1717
a. Has annual gross revenues exceeding $25,000,000.
SB851,4,2018
b. Annually, alone or jointly with others buys, receives for commercial
19purposes, sells, or shares for commercial purposes the personal information of 50,000
20or more consumers, households, or devices.
SB851,4,2221
c. Derives 50 percent or more of its annual revenues from selling consumers'
22personal information.
SB851,4,2423
2. An entity that controls or is controlled by an entity described in subd. 1. and
24that shares a name, service mark, or trademark with that entity.
SB851,5,6
1(d) “Business purpose” means a use of personal information for a business's or
2a service provider's operational purposes or other notified purposes that is
3reasonably necessary and proportionate to achieving the operational purpose for
4which the personal information was collected or processed or for another operational
5purpose that is compatible with the context in which the personal information was
6collected.
SB851,5,97
(e) “Collect” means to gather, obtain, receive, buy, rent, or access personal
8information pertaining to a consumer by any means, including by receiving
9information from the consumer or by observing the consumer's behavior.
SB851,5,1010
(f) “Consumer” means an individual who is a resident of this state.
SB851,5,1111
(g) “Deidentified” means information to which all of the following apply:
SB851,5,1412
1. The information does not reasonably identify, relate to, or describe a
13consumer and is not capable of being associated with or linked to an individual
14consumer.
SB851,5,1715
2. Technical safeguards and business processes implemented by the person
16possessing the information prohibit identifying an individual consumer to whom the
17information pertains.
SB851,5,1918
(h) “Device” means an object that is capable of directly or indirectly connecting
19to the Internet or to another device.
SB851,5,2420
(i) 1. “Personal information” means information that identifies, relates to,
21describes, or is capable of being associated or linked with a particular consumer or
22household. “Personal information” includes all of the following that identify, relate
23to, describe, or are capable of being associated or linked with a particular individual
24consumer or household:
SB851,6,3
1a. Identifiers such as a real name, alias, postal address, unique personal
2identifier, online identifier, Internet Protocol address, e-mail address, account
3name, social security number, driver's license number, or passport number.
SB851,6,64
b. A signature, telephone number, state identification card number, insurance
5policy number, employment history, bank account number, credit card number, or
6debit card number or medical information or health insurance information.
SB851,6,77
c. Characteristics of protected classifications under state or federal law.
SB851,6,108
d. Commercial information such as records of personal property, records of
9products or services purchased, obtained, or considered, or other purchasing or
10consuming histories or tendencies.
SB851,6,1111
e. Biometric information.
SB851,6,1412
f. Internet or other electronic network activity information, including browsing
13history, search history, and information regarding a consumer's interaction with an
14Internet site, application, or advertisement.
SB851,6,1515
g. Geolocation data.
SB851,6,1616
h. Audio, electronic, visual, thermal, olfactory, or similar information.
SB851,6,1717
i. Professional or employment-related information.
SB851,6,2018
j. Education information that is not publicly available personally identifiable
19information under the federal Family Educational Rights and Privacy Act,
20 USC
201232g.
SB851,6,2321
k. Inferences drawn from personal information that create a profile about a
22consumer reflecting the consumer's preferences, characteristics, psychological
23trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
SB851,7,224
2. “Personal information” does not include information that is lawfully made
25available from federal, state, or local government records if the information is used
1for a purpose that is compatible with the purpose for which the information is
2maintained and made available.
SB851,7,43
(j) “Sell” means to transfer, disseminate, disclose, release, rent, make available,
4or otherwise communicate for monetary or other valuable consideration.
SB851,7,125
(k) “Service provider” means a sole proprietorship, partnership, limited
6liability company, corporation, association, or other legal entity that is organized or
7operated for the profit of its shareholders or other owners and that processes
8information on behalf of a business and to which the business discloses a consumer's
9personal information for a business purpose pursuant to a written contract that
10prohibits the recipient of the information from retaining, using, or disclosing the
11information for any purpose other than for the specific purpose of performing the
12services specified in the contract.
SB851,7,1313
(L) “Third party” means a person that is not any of the following:
SB851,7,1414
1. A business that collects personal information from consumers.
SB851,7,1915
2. A person to whom a business discloses a consumer's personal information
16for a business purpose pursuant to a written contract that prohibits the person
17receiving the personal information from selling, retaining, using, or disclosing the
18personal information for any purpose other than for the specific purpose of
19performing the services specified in the contract.
SB851,7,2420
(m) “Verifiable consumer request” means a request, received by a business that
21has collected personal information about a consumer, that the business can
22reasonably verify to be from the consumer or the consumer's authorized
23representative or, if the consumer is under 13 years of age, the consumer's parent or
24guardian.
SB851,8,4
1(2) Required notices. (a) If a business has an online privacy policy or a
2Wisconsin-specific description of consumers' privacy rights, the business shall
3disclose all of the following information in the policy or description in a form that is
4reasonably accessible to consumers:
SB851,8,65
1. The right of a consumer to request a disclosure under sub. (3) (a) and (c) and
6one or more methods that a consumer is able to use to make a request.
SB851,8,87
2. The categories of consumers' personal information collected in the preceding
812 months.
SB851,8,109
3. The categories of sources from which consumers' personal information was
10collected in the preceding 12 months.
SB851,8,1211
4. The business or commercial purposes for collecting consumers' personal
12information.
SB851,8,1413
5. If the business has sold consumers' personal information in the preceding
1412 months, the business or commercial purposes for selling the personal information.
SB851,8,1715
6. If the business has shared consumers' personal information with a 3rd party
16in the preceding 12 months, the categories of 3rd parties with whom the business has
17shared personal information.
SB851,8,2118
7. A list of the categories of consumers' personal information sold, if the
19business has sold consumers' personal information in the preceding 12 months, or
20if the business has not sold consumers' personal information in the preceding 12
21months, a disclosure of that fact.
SB851,9,222
8. A list of the categories of consumers' personal information disclosed for a
23business purpose, if the business has disclosed consumers' personal information for
24a business purpose in the preceding 12 months, or if the business has not disclosed
1consumers' personal information for a business purpose in the preceding 12 months,
2a disclosure of that fact.
SB851,9,63
(b) If a business does not have an online privacy policy or a Wisconsin-specific
4description of consumers' privacy rights under par. (a) and the business has an
5Internet site, the business shall disclose the information listed in par. (a) 1. to 8. on
6its Internet site in a form that is reasonably accessible to consumers.
SB851,9,87
(c) A business that makes a disclosure under par. (a) or (b) shall update the
8information in the disclosure at least once every 12 months.
SB851,9,12
9(3) Disclosure of information collected. (a) 1. Upon receiving a verifiable
10consumer request from a consumer, a business that has collected personal
11information about that consumer shall promptly disclose and deliver free of charge
12to the consumer all of the following:
SB851,9,1413
a. The categories of personal information it has collected about the consumer
14in the preceding 12 months.
SB851,9,1615
b. The categories of sources from which the consumer's personal information
16was collected in the preceding 12 months.
SB851,9,1817
c. The business or commercial purposes for collecting the consumer's personal
18information.
SB851,9,2019
d. If the business has sold the consumer's personal information in the preceding
2012 months, the business or commercial purposes for selling the personal information.
SB851,9,2321
e. If the business has shared the consumer's personal information with 3rd
22parties in the preceding 12 months, the categories of 3rd parties with whom the
23business has shared personal information.
SB851,9,2524
f. The specific pieces of personal information that the business has collected
25about the consumer in the preceding 12 months.
SB851,10,3
12. A business may disclose and deliver personal information to a consumer
2under this paragraph only after receiving a verifiable consumer request from the
3consumer.
SB851,10,74
3. A business shall make available to consumers 2 or more methods for
5submitting verifiable consumer requests for a disclosure under this paragraph
6including, at a minimum, a toll-free telephone number and, if the business
7maintains an Internet site, an Internet address.
SB851,10,138
4. a. Except as provided in subd. 4. b., a business shall deliver the disclosure
9required under this paragraph within 45 days of receiving a verifiable consumer
10request from a consumer. A business shall promptly take steps to determine whether
11a request received is a verifiable consumer request. The time that a business spends
12determining whether a request is a verifiable consumer request is included in the
1345-day deadline under this subd. 4. a.
SB851,10,1714
b. A business may deliver the disclosure required under this paragraph within
1590 days after receiving a verifiable consumer request if reasonably necessary and if
16the business notifies the consumer of the delayed delivery before the time period
17under subd. 4. a. expires.
SB851,11,218
5. A business shall deliver personal information under this paragraph in
19writing and through the consumer's account with the business, if the consumer
20maintains an account with the business. If the consumer does not maintain an
21account with the business, the business shall deliver personal information under this
22paragraph by mail or electronically, at the choice of the consumer. If the business
23provides personal information under this paragraph electronically, the business
24shall provide the information in a portable and, to the extent technically feasible, a
1readily useable format that allows the consumer to transmit the information to
2another entity without hindrance.
SB851,11,53
6. A business may not require a consumer to create an account in order to
4submit a verifiable consumer request for a disclosure of personal information
5required under this paragraph.
SB851,11,76
7. A business is not required to provide personal information to a consumer
7under this paragraph more than 2 times in a 12-month period.
SB851,11,88
(b) Paragraph (a) does not require any of the following:
SB851,11,119
1. That a business retain any personal information collected for a single,
10onetime transaction, if the personal information is not sold or retained by the
11business.
SB851,11,1312
2. That a business reidentify or otherwise link information that is not
13maintained in a manner that would be considered personal information.
SB851,11,1614
(c) 1. Upon receiving a verifiable consumer request from a consumer, a business
15that has sold or disclosed for a business purpose personal information about that
16consumer shall disclose to the consumer the following information:
SB851,11,1917
a. If the business has collected personal information in the preceding 12
18months, the categories of personal information that the business collected about the
19consumer.
SB851,11,2120
b. If the business sold the consumer's personal information in the preceding 12
21months, the categories of the personal information that the business sold.
SB851,11,2422
c. If the business sold the consumer's personal information in the preceding 12
23months, for each 3rd party to whom the business sold the personal information, the
24categories of personal information that the business sold to the 3rd party.
SB851,12,3
1d. If the business disclosed the consumer's personal information for a business
2purpose in the preceding 12 months, the categories of the personal information that
3the business disclosed.
SB851,12,54
2. A business shall identify the information required to be disclosed under
5subd. 1. c. separately from the information required to be disclosed under subd. 1. d.
SB851,12,96
3. A business shall make available to consumers 2 or more methods for
7submitting verifiable consumer requests for a disclosure under this paragraph
8including, at a minimum, a toll-free telephone number and, if the business
9maintains an Internet site, an Internet address.
SB851,12,1510
4. a. Except as provided in subd. 4. b., a business shall deliver the disclosure
11required under this paragraph within 45 days of receiving a verifiable consumer
12request from a consumer. A business shall promptly take steps to determine whether
13a request received is a verifiable consumer request. The time that a business spends
14determining whether a request received is a verifiable consumer request is included
15in the 45-day deadline under this subd. 4. a.
SB851,12,1916
b. A business may deliver the disclosure required under this paragraph within
1790 days after receiving a verifiable consumer request if reasonably necessary and if
18the business notifies the consumer of the delayed delivery before the time period
19under subd. 4. a. expires.
SB851,13,320
5. A business shall deliver personal information under this paragraph in
21writing and through the consumer's account with the business, if the consumer
22maintains an account with the business. If the consumer does not maintain an
23account with the business, the business shall deliver personal information under this
24paragraph by mail or electronically, at the choice of the consumer. If the business
25provides information under this paragraph electronically, the business shall provide
1the information in a portable and, to the extent technically feasible, a readily useable
2format that allows the consumer to transmit the information to another entity
3without hindrance.
SB851,13,64
6. A business may not require a consumer to create an account in order to
5submit a verifiable consumer request for a disclosure of personal information
6required under this paragraph.
SB851,13,10
7(4) Selling or collecting information. (a) A business may not collect a
8consumer's personal information or use the personal information for a particular
9purpose unless the business informs the consumer, at or before the point of collecting
10the information, about all of the following:
SB851,13,1211
1. That the business will collect that category of personal information about the
12consumer.
SB851,13,1413
2. The purpose for which the business will use the category of personal
14information collected.
SB851,13,1615
(b) 1. A business may not sell a consumer's personal information to 3rd parties
16unless the business satisfies all of the following:
SB851,13,2117
a. If the business has an Internet site, the business provides a clear and
18conspicuous link on the homepage of the Internet site, titled “Do Not Sell My
19Personal Information,” to an Internet page that enables a consumer or person
20authorized by the consumer to object to the sale of the consumer's personal
21information.
SB851,14,222
b. The business includes a statement explaining that a consumer may object
23to the sale of the consumer's personal information and a link to the Internet page
24required under subd. 1. a. in its online privacy policy or policies, if the business has
1an online privacy policy or policies, and any Wisconsin-specific description of
2consumers' privacy rights.
SB851,14,63
c. The business ensures that each individual responsible for handling
4consumer inquiries about the business's privacy practices or compliance with this
5section is informed of the requirements in this subdivision and par. (c) and of how to
6direct consumers to object to the sale of their personal information under par. (c).
SB851,14,97
2. Subdivision 1. does not require a business to provide the link described in
8subd. 1. a. on the homepage of an Internet site that the business makes available to
9the public generally, if all of the following apply:
SB851,14,1110
a. The business maintains a separate and additional Internet site that the
11business dedicates to consumers.
SB851,14,1312
b. The Internet site under subd. 2. a. satisfies the requirements under subd.
131. a.