SB851: Bill Text

LRB-3381/2

KP:amn&cjs

2019 - 2020 LEGISLATURE

2019 Senate BILL 851

February 20, 2020 - Introduced by Senators Larson, Carpenter and L. Taylor, cosponsored by Representatives Brostoff, Anderson, Cabrera, Sinicki, Stubbs and Shankland. Referred to Committee on Government Operations, Technology and Consumer Protection.

SB851,1,2 An Act to create 134.985 of the statutes; relating to: the privacy of consumer data, granting rule-making authority, and providing a penalty.

Analysis by the Legislative Reference Bureau

Generally, this bill establishes requirements for businesses related to personal information collected about consumers. The bill's requirements apply to “businesses,” which is defined in the bill to mean a sole proprietorship, limited liability company, corporation, association, or other entity operated for profit that satisfies all of the following: 1) collects consumers' personal information or alone or jointly with others determines the purposes and means of the processing of personal information; 2) does business in this state; and 3) either has annual gross revenues exceeding $25,000,000; buys, receives, sells, or shares the personal information of 50,000 or more consumers annually; or derives 50 percent or more of its annual revenues from selling consumers' personal information. The bill defines “ personal information” as information that identifies, relates to, describes, or is capable of being associated or linked with a particular consumer or household other than certain information that is lawfully made available from federal, state, or local government records.

The bill requires a business to disclose certain information to consumers if the business has an online privacy policy or a Wisconsin-specific description of consumers' privacy rights, including the following: 1) information about how a consumer can make a request for a copy of the personal information collected about the consumer; 2) the categories of personal information collected by the business in the past twelve months; 3) the categories of sources from which the business collected personal information in the past twelve months; 4) the business's purposes for collecting consumers' personal information; and 5) if the business sells consumers' personal information, the purpose for selling the personal information. If the business has an Internet site but not an online privacy policy or a Wisconsin-specific description of consumers' privacy rights, the business must disclose the above information on the Internet site.

Under the bill, a consumer may request a business to disclose certain information if the business collects personal information about the consumer, including the following: 1) the categories of personal information about the consumer collected by the business in the past twelve months; 2) the categories of sources from which the business collected personal information about the consumer in the past twelve months; 3) the purposes for collecting the personal information about the consumer; 4) if the business has sold the consumer's personal information in the past twelve months, the purpose for selling the personal information; and 5) the specific pieces of personal information about the consumer that the business collected in the past twelve months. In addition, the business must deliver this information within 45 days or within 90 days if the longer duration is reasonably necessary and the business notifies the consumer about the delay within 45 days. The business must disclose the information in a portable and readily useable format. A consumer may request this information twice in a twelve-month period.

A consumer may request a business that sells the consumer's personal information to disclose certain information, including the categories of personal information collected about the consumer in the past twelve months, the categories of personal information about the consumer that the business sold in the past twelve months, and the categories of personal information about the consumer sold to each third party in the past twelve months. The business must disclose the information in a portable and readily useable format and within 45 days or within 90 days if the longer duration is reasonably necessary.

The bill also requires a business, before collecting a consumer's personal information, to inform the consumer about the categories of personal information that the business will collect and the purpose for which the business will use the personal information collected. Under the bill, in order for a business to sell a consumer's personal information, certain requirements apply, including the following: 1) if the business has an Internet site, it must provide a link titled “Do Not Sell My Personal Information” that enables consumers to object to the selling of the consumer's personal information; 2) if the business has an online privacy policy, the business must include the link described above in that policy; 3) a business may not sell the personal information if a consumer is 16 or older and the consumer directs the business not to sell the consumer's personal information; 4) a business may sell the personal information of a consumer aged 13 to 16 only if the consumer affirmatively authorizes selling the personal information; 5) a business may sell the personal information of a consumer under the age of 13 only if the consumer's parent or guardian affirmatively authorizes it; and 6) a third party must notify a consumer before selling the consumer's personal information. A business must also implement reasonable security procedures to protect the personal information of consumers.

The bill also requires that if a consumer requests that a business delete the personal information that the business has collected about the consumer, the business must delete that personal information. The bill provides certain exceptions to that requirement, including the cases in which it is necessary for the business to maintain the personal information to do any of the following: 1) complete a transaction or contract with a consumer; 2) detect security incidents; 3) identify errors; 4) exercise free speech or ensure the right of another consumer to exercise free speech; 5) comply with a legal obligation; or 6) otherwise use the personal information internally in a lawful manner.

The bill provides that a business may not discriminate against a consumer because the consumer requests information about the business's collection or sale of personal information, requests the business not to sell the consumer's personal information, or requests that the business delete the consumer's personal information. Under the bill, a business is allowed to charge a consumer a different price or provide a different level of services if the difference is reasonably related to the value provided to the consumer by the consumer's personal data, and a business may offer financial incentives to a consumer for collecting the consumer's personal information, subject to certain requirements described in the bill.

The bill requires the Department of Justice to promulgate various rules to implement the bill's requirements. The bill also authorizes businesses to request advice from the attorney general on how to comply with the bill's requirements and requires the attorney general to respond to those requests.

Additionally, a provision in a contract is void and unenforceable if it would waive or limit one or more of the bill's requirements. The bill also provides a consumer with a private cause of action against a business if the business does not implement reasonable security procedures to protect the consumer's personal information and the personal information is subject to unauthorized access. A business, service provider, or person that violates the bill is subject to a forfeiture of up to $2,500 for each violation and a forfeiture of up to $7,500 for each intentional violation.

For further information see the state fiscal estimate, which will be printed as an appendix to this bill.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

SB851,1 Section 1. 134.985 of the statutes is created to read:

SB851,3,2 134.985 Consumer data. (1) Definitions. In this section:

SB851,4,2 (a) “Aggregate consumer information” means information that relates to a group or category of consumers, from which individual consumer identities have been removed, and that is not linked or reasonably linkable to any consumer or household.

SB851,4,9 (b) “Biometric information” means an individual's physiological, biological, or behavioral characteristics, including deoxyribonucleic acid, that can be used singly or in combination with each other or with other identifying data to establish individual identity. “Biometric information” includes imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, voice recordings, keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.

SB851,4,10 (c) “Business” means any of the following:

SB851,4,16 1. A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers' personal information or, on the behalf of consumers, alone or jointly with others determines the purposes and means of the processing of consumers' personal information, that does business in this state, and that satisfies any of the following:

SB851,4,17 a. Has annual gross revenues exceeding $25,000,000.

SB851,4,20 b. Annually, alone or jointly with others buys, receives for commercial purposes, sells, or shares for commercial purposes the personal information of 50,000 or more consumers, households, or devices.

SB851,4,22 c. Derives 50 percent or more of its annual revenues from selling consumers' personal information.

SB851,4,24 2. An entity that controls or is controlled by an entity described in subd. 1. and that shares a name, service mark, or trademark with that entity.

SB851,5,6 (d) “Business purpose” means a use of personal information for a business's or a service provider's operational purposes or other notified purposes that is reasonably necessary and proportionate to achieving the operational purpose for which the personal information was collected or processed or for another operational purpose that is compatible with the context in which the personal information was collected.

SB851,5,9 (e) “Collect” means to gather, obtain, receive, buy, rent, or access personal information pertaining to a consumer by any means, including by receiving information from the consumer or by observing the consumer's behavior.

SB851,5,10 (f) “Consumer” means an individual who is a resident of this state.

SB851,5,11 (g) “Deidentified” means information to which all of the following apply:

SB851,5,14 1. The information does not reasonably identify, relate to, or describe a consumer and is not capable of being associated with or linked to an individual consumer.

SB851,5,17 2. Technical safeguards and business processes implemented by the person possessing the information prohibit identifying an individual consumer to whom the information pertains.

SB851,5,19 (h) “Device” means an object that is capable of directly or indirectly connecting to the Internet or to another device.

SB851,5,24 (i) 1. “Personal information” means information that identifies, relates to, describes, or is capable of being associated or linked with a particular consumer or household. “Personal information” includes all of the following that identify, relate to, describe, or are capable of being associated or linked with a particular individual consumer or household:

SB851,6,3 a. Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, e-mail address, account name, social security number, driver's license number, or passport number.

SB851,6,6 b. A signature, telephone number, state identification card number, insurance policy number, employment history, bank account number, credit card number, or debit card number or medical information or health insurance information.

SB851,6,7 c. Characteristics of protected classifications under state or federal law.

SB851,6,10 d. Commercial information such as records of personal property, records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

SB851,6,11 e. Biometric information.

SB851,6,14 f. Internet or other electronic network activity information, including browsing history, search history, and information regarding a consumer's interaction with an Internet site, application, or advertisement.

SB851,6,15 g. Geolocation data.

SB851,6,16 h. Audio, electronic, visual, thermal, olfactory, or similar information.

SB851,6,17 i. Professional or employment-related information.

SB851,6,20 j. Education information that is not publicly available personally identifiable information under the federal Family Educational Rights and Privacy Act, 20 USC 1232g.

SB851,6,23 k. Inferences drawn from personal information that create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

SB851,7,2 2. “Personal information” does not include information that is lawfully made available from federal, state, or local government records if the information is used for a purpose that is compatible with the purpose for which the information is maintained and made available.

SB851,7,4 (j) “Sell” means to transfer, disseminate, disclose, release, rent, make available, or otherwise communicate for monetary or other valuable consideration.

SB851,7,12 (k) “Service provider” means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit of its shareholders or other owners and that processes information on behalf of a business and to which the business discloses a consumer's personal information for a business purpose pursuant to a written contract that prohibits the recipient of the information from retaining, using, or disclosing the information for any purpose other than for the specific purpose of performing the services specified in the contract.

SB851,7,13 (L) “Third party” means a person that is not any of the following:

SB851,7,14 1. A business that collects personal information from consumers.

SB851,7,19 2. A person to whom a business discloses a consumer's personal information for a business purpose pursuant to a written contract that prohibits the person receiving the personal information from selling, retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract.

SB851,7,24 (m) “Verifiable consumer request” means a request, received by a business that has collected personal information about a consumer, that the business can reasonably verify to be from the consumer or the consumer's authorized representative or, if the consumer is under 13 years of age, the consumer's parent or guardian.

SB851,8,4 (2) Required notices. (a) If a business has an online privacy policy or a Wisconsin-specific description of consumers' privacy rights, the business shall disclose all of the following information in the policy or description in a form that is reasonably accessible to consumers:

SB851,8,6 1. The right of a consumer to request a disclosure under sub. (3) (a) and (c) and one or more methods that a consumer is able to use to make a request.

SB851,8,8 2. The categories of consumers' personal information collected in the preceding 12 months.

SB851,8,10 3. The categories of sources from which consumers' personal information was collected in the preceding 12 months.

SB851,8,12 4. The business or commercial purposes for collecting consumers' personal information.

SB851,8,14 5. If the business has sold consumers' personal information in the preceding 12 months, the business or commercial purposes for selling the personal information.

SB851,8,17 6. If the business has shared consumers' personal information with a 3rd party in the preceding 12 months, the categories of 3rd parties with whom the business has shared personal information.

SB851,8,21 7. A list of the categories of consumers' personal information sold, if the business has sold consumers' personal information in the preceding 12 months, or if the business has not sold consumers' personal information in the preceding 12 months, a disclosure of that fact.

SB851,9,2 8. A list of the categories of consumers' personal information disclosed for a business purpose, if the business has disclosed consumers' personal information for a business purpose in the preceding 12 months, or if the business has not disclosed consumers' personal information for a business purpose in the preceding 12 months, a disclosure of that fact.

SB851,9,6 (b) If a business does not have an online privacy policy or a Wisconsin-specific description of consumers' privacy rights under par. (a) and the business has an Internet site, the business shall disclose the information listed in par. (a) 1. to 8. on its Internet site in a form that is reasonably accessible to consumers.

SB851,9,8 (c) A business that makes a disclosure under par. (a) or (b) shall update the information in the disclosure at least once every 12 months.

SB851,9,12 (3) Disclosure of information collected. (a) 1. Upon receiving a verifiable consumer request from a consumer, a business that has collected personal information about that consumer shall promptly disclose and deliver free of charge to the consumer all of the following:

SB851,9,14 a. The categories of personal information it has collected about the consumer in the preceding 12 months.

SB851,9,16 b. The categories of sources from which the consumer's personal information was collected in the preceding 12 months.

SB851,9,18 c. The business or commercial purposes for collecting the consumer's personal information.

SB851,9,20 d. If the business has sold the consumer's personal information in the preceding 12 months, the business or commercial purposes for selling the personal information.

SB851,9,23 e. If the business has shared the consumer's personal information with 3rd parties in the preceding 12 months, the categories of 3rd parties with whom the business has shared personal information.

SB851,9,25 f. The specific pieces of personal information that the business has collected about the consumer in the preceding 12 months.

SB851,10,3 2. A business may disclose and deliver personal information to a consumer under this paragraph only after receiving a verifiable consumer request from the consumer.

SB851,10,7 3. A business shall make available to consumers 2 or more methods for submitting verifiable consumer requests for a disclosure under this paragraph including, at a minimum, a toll-free telephone number and, if the business maintains an Internet site, an Internet address.

SB851,10,13 4. a. Except as provided in subd. 4. b., a business shall deliver the disclosure required under this paragraph within 45 days of receiving a verifiable consumer request from a consumer. A business shall promptly take steps to determine whether a request received is a verifiable consumer request. The time that a business spends determining whether a request is a verifiable consumer request is included in the 45-day deadline under this subd. 4. a.