SB851: Bill Text

SB851,10,17 b. A business may deliver the disclosure required under this paragraph within 90 days after receiving a verifiable consumer request if reasonably necessary and if the business notifies the consumer of the delayed delivery before the time period under subd. 4. a. expires.

SB851,11,2 5. A business shall deliver personal information under this paragraph in writing and through the consumer's account with the business, if the consumer maintains an account with the business. If the consumer does not maintain an account with the business, the business shall deliver personal information under this paragraph by mail or electronically, at the choice of the consumer. If the business provides personal information under this paragraph electronically, the business shall provide the information in a portable and, to the extent technically feasible, a readily useable format that allows the consumer to transmit the information to another entity without hindrance.

SB851,11,5 6. A business may not require a consumer to create an account in order to submit a verifiable consumer request for a disclosure of personal information required under this paragraph.

SB851,11,7 7. A business is not required to provide personal information to a consumer under this paragraph more than 2 times in a 12-month period.

SB851,11,8 (b) Paragraph (a) does not require any of the following:

SB851,11,11 1. That a business retain any personal information collected for a single, onetime transaction, if the personal information is not sold or retained by the business.

SB851,11,13 2. That a business reidentify or otherwise link information that is not maintained in a manner that would be considered personal information.

SB851,11,16 (c) 1. Upon receiving a verifiable consumer request from a consumer, a business that has sold or disclosed for a business purpose personal information about that consumer shall disclose to the consumer the following information:

SB851,11,19 a. If the business has collected personal information in the preceding 12 months, the categories of personal information that the business collected about the consumer.

SB851,11,21 b. If the business sold the consumer's personal information in the preceding 12 months, the categories of the personal information that the business sold.

SB851,11,24 c. If the business sold the consumer's personal information in the preceding 12 months, for each 3rd party to whom the business sold the personal information, the categories of personal information that the business sold to the 3rd party.

SB851,12,3 d. If the business disclosed the consumer's personal information for a business purpose in the preceding 12 months, the categories of the personal information that the business disclosed.

SB851,12,5 2. A business shall identify the information required to be disclosed under subd. 1. c. separately from the information required to be disclosed under subd. 1. d.

SB851,12,9 3. A business shall make available to consumers 2 or more methods for submitting verifiable consumer requests for a disclosure under this paragraph including, at a minimum, a toll-free telephone number and, if the business maintains an Internet site, an Internet address.

SB851,12,15 4. a. Except as provided in subd. 4. b., a business shall deliver the disclosure required under this paragraph within 45 days of receiving a verifiable consumer request from a consumer. A business shall promptly take steps to determine whether a request received is a verifiable consumer request. The time that a business spends determining whether a request received is a verifiable consumer request is included in the 45-day deadline under this subd. 4. a.

SB851,12,19 b. A business may deliver the disclosure required under this paragraph within 90 days after receiving a verifiable consumer request if reasonably necessary and if the business notifies the consumer of the delayed delivery before the time period under subd. 4. a. expires.

SB851,13,3 5. A business shall deliver personal information under this paragraph in writing and through the consumer's account with the business, if the consumer maintains an account with the business. If the consumer does not maintain an account with the business, the business shall deliver personal information under this paragraph by mail or electronically, at the choice of the consumer. If the business provides information under this paragraph electronically, the business shall provide the information in a portable and, to the extent technically feasible, a readily useable format that allows the consumer to transmit the information to another entity without hindrance.

SB851,13,6 6. A business may not require a consumer to create an account in order to submit a verifiable consumer request for a disclosure of personal information required under this paragraph.

SB851,13,10 (4) Selling or collecting information. (a) A business may not collect a consumer's personal information or use the personal information for a particular purpose unless the business informs the consumer, at or before the point of collecting the information, about all of the following:

SB851,13,12 1. That the business will collect that category of personal information about the consumer.

SB851,13,14 2. The purpose for which the business will use the category of personal information collected.

SB851,13,16 (b) 1. A business may not sell a consumer's personal information to 3rd parties unless the business satisfies all of the following:

SB851,13,21 a. If the business has an Internet site, the business provides a clear and conspicuous link on the homepage of the Internet site, titled “Do Not Sell My Personal Information,” to an Internet page that enables a consumer or person authorized by the consumer to object to the sale of the consumer's personal information.

SB851,14,2 b. The business includes a statement explaining that a consumer may object to the sale of the consumer's personal information and a link to the Internet page required under subd. 1. a. in its online privacy policy or policies, if the business has an online privacy policy or policies, and any Wisconsin-specific description of consumers' privacy rights.

SB851,14,6 c. The business ensures that each individual responsible for handling consumer inquiries about the business's privacy practices or compliance with this section is informed of the requirements in this subdivision and par. (c) and of how to direct consumers to object to the sale of their personal information under par. (c).

SB851,14,9 2. Subdivision 1. does not require a business to provide the link described in subd. 1. a. on the homepage of an Internet site that the business makes available to the public generally, if all of the following apply:

SB851,14,11 a. The business maintains a separate and additional Internet site that the business dedicates to consumers.

SB851,14,13 b. The Internet site under subd. 2. a. satisfies the requirements under subd. 1. a.

SB851,14,16 c. The business takes reasonable steps to ensure that consumers in this state are directed to the Internet site under subd. 2. a. and not the homepage of the Internet site made available to the public generally.

SB851,14,21 (c) 1. a. A business may not sell personal information that the business collects about a consumer to a 3rd party if the consumer is 16 years of age or older and the consumer directs the business not to sell the consumer's personal information, unless the consumer subsequently provides express authorization for the business to sell the personal information.

SB851,15,2 b. A consumer may authorize another person to, as provided in subd. 1. a., direct a business not to sell the consumer's personal information. A representative authorized under this subd. 1. b. may not subsequently provide express authorization on behalf of the consumer for the business to sell the consumer's personal information.

SB851,15,5 2. A business may not sell personal information that the business collects about a consumer to a 3rd party if the business has actual knowledge that the consumer is under 16 years of age unless any of the following applies:

SB851,15,8 a. The consumer is at least 13 years of age and under 16 years of age and the consumer affirmatively authorizes the business to sell the consumer's personal information.

SB851,15,10 b. The consumer is under 13 years of age and the consumer's parent or guardian affirmatively authorizes the business to sell the consumer's personal information.

SB851,15,12 3. A business that willfully disregards the age of a consumer is considered to have actual knowledge of the consumer's age.

SB851,15,17 4. A business may not request authorization from a consumer or the consumer's parent or guardian to sell the consumer's personal information within 12 months of the most recent occasion that the consumer, parent, or guardian directed the business not to sell the personal information or denied the business's request for authorization to sell the personal information.

SB851,15,21 5. A business that collects the personal information of a consumer in connection with receiving a direction under subd. 1. to not sell the consumer's personal information may use the personal information only for the purposes of implementing the consumer's direction not to sell the personal information.

SB851,16,2 (d) 1. A 3rd party may not sell personal information about a consumer that has been sold to the 3rd party by a business unless the 3rd party provides explicit notice to the consumer that the consumer's personal information has been sold to the 3rd party and that the 3rd party intends to sell the information and the 3rd party satisfies par. (b) 1. a. to c.

SB851,16,6 2. A 3rd party may not sell information about a consumer that has been sold to the 3rd party by a business if the consumer directs the 3rd party not to sell the consumer's personal information, unless the consumer subsequently provides express authorization for the 3rd party to sell the personal information.

SB851,16,8 (e) A business may not require a consumer to create an account in order to direct the business not to sell the consumer's personal information under par. (c).

SB851,16,11 (f) A business shall, to protect the personal information of consumers, implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information.

SB851,16,16 (5) Deletion of information. (a) Except as provided in par. (b), a business that receives a verifiable consumer request from a consumer to delete the consumer's personal information shall delete the personal information that the business has collected from the consumer from its records and direct any of the business's service providers to delete the consumer's personal information from their records.

SB851,16,19 (b) A business or its service provider is not required to delete a consumer's personal information if it is necessary for the business or its service provider to maintain the consumer's personal information for any of the following purposes:

SB851,16,24 1. To complete the transaction for which the personal information was collected, to provide a good or service requested by the consumer or reasonably anticipated to be requested by the consumer within the context of the business's ongoing relationship with the consumer, or to otherwise perform a contract between the business and the consumer.

SB851,17,2 2. To detect security incidents, to protect against malicious, deceptive, fraudulent, or illegal activity, or to prosecute a person responsible for that activity.

SB851,17,4 3. To debug to identify and repair errors that impair existing or intended functionality.

SB851,17,6 4. To exercise free speech, to ensure the right of another consumer to exercise free speech, or to exercise another right provided by law.

SB851,17,11 5. If the consumer provides informed consent, to engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, if the business's deletion of the personal information is likely to render impossible or seriously impair the achievement of that research.

SB851,17,14 6. To enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer's relationship with the business.

SB851,17,15 7. To comply with a legal obligation.

SB851,17,18 8. To otherwise use the consumer's personal information internally in a lawful manner that is compatible with the context in which the consumer provided the information.

SB851,17,23 (6) Discrimination prohibited. (a) 1. A business may not discriminate against a consumer because the consumer makes a verifiable consumer request under sub. (3) (a) or (c) or (5) or because under sub. (4) (c) the personal information of the consumer was not permitted to be sold by the business, including by doing any of the following:

SB851,17,24 a. Denying goods or services to the consumer.

SB851,18,2 b. Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.

SB851,18,3 c. Providing a different level or quality of goods or services to the consumer.

SB851,18,5 d. Suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services.

SB851,18,9 2. This paragraph does not prohibit a business from charging a consumer a different price or rate, or from providing a different level or quality of goods or services to the consumer, if the difference is reasonably related to the value provided to the consumer by the consumer's data.

SB851,18,15 (b) 1. A business may offer financial incentives, including payments to consumers as compensation, for the collection of a consumer's personal information, the sale of a consumer's personal information, or the deletion of a consumer's personal information. A business may also offer a different price, rate, level, or quality of goods or services to a consumer if that difference is directly related to the value provided to the consumer by the consumer's data.

SB851,18,19 2. A business may enter a consumer into a financial incentive program described in subd. 1. only if the consumer or the consumer's parent or guardian affirmatively authorizes entry into the program after receiving a notice that clearly describes the material terms of the program.

SB851,18,21 3. A consumer or a consumer's parent or guardian may revoke entry into a financial incentive program described in subd. 1. at any time.

SB851,18,24 4. If a business offers a financial incentive program described in subd. 1., the business shall include a description of the program on the Internet page described in sub. (4) (b) 1. a. and in the policies described in sub. (4) (b) 1. b.

SB851,19,2 5. A business may not use financial incentive practices that are unjust, unreasonable, coercive, or usurious in nature.

SB851,19,5 (7) Guidance; rules. (a) A business or 3rd party may request advice from the attorney general on how to comply with this section, and the attorney general shall respond to the request.

SB851,19,7 (b) The department of justice shall promulgate rules to implement this section, including the following:.

SB851,19,9 1. Rules that specify additional categories of personal information to those enumerated in sub. (1) (i) 1.

SB851,19,12 2. Rules that specify unique personal identifiers to address changes in technology, changes in data collection, obstacles to implementing this section, and privacy concerns.

SB851,19,14 3. Rules that specify additional methods for consumers to make requests and businesses to provide disclosures under this section.

SB851,19,17 4. Rules that establish any exceptions necessary to comply with other state or federal law, including exceptions relating to trade secrets and intellectual property rights.

SB851,19,18 5. Rules that establish procedures for the following:

SB851,19,19 a. The submission of a direction under sub. (4) (c) 1. a.

SB851,19,20 b. Business compliance with a direction submitted under sub. (4) (c) 1. a.

SB851,19,23 c. The use of a recognizable and uniform logo or button by all businesses to promote consumer awareness of the option to make a direction under sub. (4) (c) 1. a.

SB851,20,2 6. Rules that ensure that the notices and information that business are required to provide under this section are provided in a manner that may be easily understood by the average consumer, are accessible to consumers with disabilities, and are available in the language primarily used to interact with the consumer.

SB851,20,12 7. Rules that facilitate a consumer's or, under sub. (4) (c) 1. b., a representative's ability to make a request or submit a direction under this section, with the goal of minimizing the administrative burden on consumers, taking into account available technology, security concerns, and the burden on the business, to govern a business's determination that a request by a consumer is a verifiable consumer request, including by treating a request submitted through a password-protected account maintained by the consumer with the business while the consumer is logged into the account as a verifiable consumer request and providing a mechanism for a business to authenticate the identity of a consumer who does not maintain an account with the business and requests information or submits a direction under this section.

SB851,20,17 (c) The department of justice shall adjust the monetary threshold amount in sub. (1) (c) 1. a. in January of every odd-numbered year by the percentage change in the U.S. consumer price index for all urban consumers, U.S. city average, as determined by the federal department of labor for the period since the last adjustment under this paragraph.

SB851,20,20 (8) Contracts in violation. A provision in a contract or agreement that purports to waive or limit a requirement under this section is void and unenforceable.

SB851,20,25 (9) Private cause of action. (a) 1. A consumer may initiate an action against a business to enforce a written statement under subd. 2. and may pursue injunctive or declaratory relief, damages in an amount not less than $100 and not more than $750 per consumer per incident or actual damages, whichever is greater, or any other relief the court deems proper if all of the following apply:

SB851,21,4 a. The consumer, on an individual or class-wide basis, provides the business with written notice identifying that the consumer's nonencrypted or nonredacted personal information is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business's violation of sub. (4) (f).

SB851,21,6 b. The business continues to violate sub. (4) (f) more than 30 days after receiving the written notice under subd. 1. a.

SB851,21,10 2. No action may be brought under subd. 1. if within 30 days of receiving a written notice under subd. 1. a., a business cures the noticed violation of sub. (4) (f) and provides the consumer that provided the written notice with an express written statement that the violation has been cured.

SB851,21,16 3. In assessing the amount of damages under subd. 1., a court shall consider the relevant circumstances presented by any of the parties to the case, including the nature and seriousness of the misconduct, the number of violations, the persistence of the misconduct, the length of time over which the misconduct occurred, the willfulness of the defendant's misconduct, and the defendant's assets, liabilities, and net worth.

SB851,21,18 (b) A consumer may initiate an action against a business solely for actual pecuniary damages suffered as a result of the business's violation of sub. (4) (f).

SB851,21,19 (10) Inapplicability. (a) This section does not do any of the following:

SB851,21,21 1. Restrict a business from complying with federal or state laws or local ordinances.

SB851,21,23 2. Restrict a business from complying with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities.

SB851,22,2 3. Restrict a business, service provider, or 3rd party from cooperating with law enforcement agencies concerning conduct or activity that the business, service provider, or 3rd party reasonably and in good faith believes might violate federal, state, or local law.

SB851,22,3 4. Restrict a business from exercising or defending legal claims.

SB851,22,5 5. Restrict the collection, use, retention, sale, or disclosure of consumer information that is deidentified or aggregate consumer information.

SB851,22,9 6. Restrict the collection or sale of a consumer's personal information if the information is collected while the consumer was outside of this state, no part of any sale of the consumer's personal information occurs in this state, and no personal information collected from a consumer while the consumer is in this state is sold.