AB824: Bill Text

AB824,,1 2023 ASSEMBLY BILL 824

December 22, 2023 - Introduced by Representatives Zimmerman, Gustafson, Michalski, Binsfeld and Maxey. Referred to Committee on State Affairs.

AB824,,2 An Act to create 100.75 of the statutes; relating to: establishing standards for the sharing of sensitive information between separate legal entities.

AB824,,3 Analysis by the Legislative Reference Bureau

This bill establishes requirements, standards, and collaborative requirements for entities that own, control, and share personal data. The bill governs three types of data controllers: 1) data owners, meaning any person that generates, collects, or uses data for its own purposes; 2) data custodians, meaning any person that provides data security and storage on behalf of a data owner; and 3) data stewards, meaning any person that uses or facilitates the use of data on behalf of a data owner.

Data is defined in the bill as including “sensitive information,” which is defined as information that, if disclosed or accessed by unauthorized parties, could result in harm, privacy violations, or negative consequences for individuals or entities. “Sensitive information” includes “personally identifiable information,” meaning information that is or can reasonably be linked to an identified person, identifiable person, or device linked to a person, and “nonpublic or privately held information,” meaning information that is not publicly available or accessible to the general public; is restricted to a specific group of individuals or entities; is considered confidential or proprietary; is protected by privacy regulations; and requires appropriate safeguards to prevent unauthorized access, use, or disclosure. The requirements of the bill apply to data controllers who use or facilitate the use of sensitive information.

Under the bill, a data owner must limit the access to, sharing of, and use of its data to what is adequate, relevant, and reasonably necessary for the purposes for which the data is collected or generated. A data owner must also establish and ensure compliance with relevant regulatory requirements and with internal policies related to the review of data sharing and data use requests; data handling best practices; and the handling of data agreement breaches, security incidents, and related disputes.

Under the bill, a data custodian must provide a secure environment for the storage of a data owner’s data that is designed and configured in a manner that reflects best practices in data security on subjects including identity and access management controls, role-based permissions, data encryption, cyber security threat monitoring, and recovery capabilities in the event of a disaster. A data custodian must also establish and ensure compliance with internal policies and procedures related to data access control, data retention and data destruction, auditing capabilities and the performance of audits, the periodic review of new and changing business and regulatory requirements that may impact data solution organization, and any other requirements established in a data agreement. A data custodian must also establish and ensure compliance with internal policies and procedures related to security incidents and auditing.

Under the bill, a data steward must establish and ensure compliance with internal policies and procedures related to various data handling practices.

If a data owner enters into an agreement with a data custodian or a data steward, the agreement must meet the requirements described in the bill. Such an agreement must identify all relevant parties, data sets, permitted uses and restrictions of data, confidentiality requirements, law governing the data, and law governing the agreement. Such an agreement must also include statements regarding the response to security incidents, the term of the agreement, the terms for terminating the agreement, and the authorization for or prohibition of the collection and analysis of metadata, or data that describes other data. Such an agreement between a data owner and a data custodian must include statements regarding auditing capabilities and requirements.

AB824,,4 The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

AB824,1 Section 1. 100.75 of the statutes is created to read:

AB824,,6 100.75 Requirements and standards for the sharing of sensitive information between separate legal entities. (1) Definitions. In this section:

AB824,,7 (a) “Data” includes sensitive information, such as personally identifiable information and nonpublic or privately held information, and nonsensitive information, such as public information or deidentified personal information.

AB824,,8 (b) “Data agreement” means a written data contract entered into between data controllers. “Data agreement” includes any of the following:

AB824,,9 1. Data sharing agreements establishing terms for a data custodian providing storage of data owned by a data owner.

AB824,,10 2. Data use agreements establishing terms for a data steward using data owned by a data owner for a specific mutually agreed-upon purpose.

AB824,,11 3. Data access agreements establishing terms for a data steward using data owned by a data owner and housed within a data custodian’s data storage environment.

AB824,,12 (c) “Data controller” means any entity, public or private, that determines the purposes and means of processing data, and that is responsible for complying with applicable data protection laws and ensuring that data is handled in a lawful and responsible manner. “Data controller” includes data custodians, data owners, and data stewards.

AB824,,13 (d) “Data custodian” means any person that provides data storage on behalf of a data owner.

AB824,,14 (e) “Data owner” means any person that generates, collects, or uses data for its own purposes.

AB824,,15 (f) “Data steward” means any person that uses or facilitates the use of data on behalf of a data owner.

AB824,,16 (g) “Deidentified personal information” means information that cannot reasonably be linked to an identified person, identifiable person, or device linked to a person. “Deidentified personal information” includes aggregated information, generalized information, and randomized information.

AB824,,17 (h) “Enhanced data” means data that has been standardized, derived, aggregated, organized, corrected, verified, augmented, merged with other data, or otherwise prepared for further analysis or use. “Enhanced data” may be based on data from more than one data owner.

AB824,,18 (i) “Metadata” means data that describes other data.

AB824,,19 (j) “Nonpublic or privately held information” means information that is not publicly available or accessible to the general public; is restricted to a specific group of individuals or entities; is considered confidential or proprietary; is protected by privacy regulations; and requires appropriate safeguards to prevent unauthorized access, use, or disclosure. “Nonpublic or privately held information” includes intellectual property, financial information, confidential business agreements, and regulatory information.

AB824,,20 (k) “Nonsensitive information” means information that is not subject to legal protections due to its nature or potential impact on individuals’ privacy, security, or other rights. “Nonsensitive information” includes public information and deidentified personal information.

AB824,,21 (L) “Personally identifiable information” means information that is or can reasonably be linked to an identified person, identifiable person, or device linked to a person. “Personally identifiable information” includes identifying attributes, contact information, personal characteristics, financial information, biometric data, health and medical information, online identifiers, and education and employment information.

AB824,,22 (m) “Public information” means information that is lawfully made available through federal, state, or local government records, or information that is reasonably believed to be lawfully made available to the general public through widely distributed media by the consumer or by a person to whom the consumer has disclosed the information, unless the consumer has restricted the information to a specific audience.

AB824,,23 (n) “Sensitive information” means any type of information that, if disclosed or accessed by unauthorized parties, could result in harm, privacy violations, or negative consequences for individuals or entities. “Sensitive information” includes information that requires special protection due to its nature and includes personally identifiable information and nonpublic or privately held information. “Sensitive information” includes nonsensitive information that is mingled with sensitive information.

AB824,,24 (2) Requirements for data controllers. (a) A data owner that generates, collects, or uses sensitive information shall do all of the following:

AB824,,25 1. Limit the access to, sharing of, and use of its data to what is adequate, relevant, and reasonably necessary for the purposes for which the data is collected or generated.

AB824,,26 2. Establish and ensure compliance with internal policies and procedures governing the review of data sharing and data use requests. Such policies and procedures shall include all of the following:

AB824,,27 a. A schedule indicating how often the data owner will review requests.

AB824,,28 b. Assessment criteria for the approval or rejection of requests.

AB824,,29 c. Documentation of the rationale for the rejection of a request.

AB824,,30 d. Notice of the rejection to the requesting entity.

AB824,,31 3. Establish and ensure compliance with internal policies and with any relevant regulatory requirements on the sharing of sensitive information with another legal entity.

AB824,,32 4. Establish and ensure compliance with internal policies and procedures that reflect best practices of data handling on all of the following subjects:

AB824,,33 a. Identity and access management controls, including limiting the access to any data subject to a data agreement.

AB824,,34 b. Data retention and data destruction.

AB824,,35 c. The periodic review of new and changing business and regulatory requirements that may impact data sharing.

AB824,,36 5. Establish and ensure compliance with internal policies and procedures regarding the handling of data agreement breaches; security incidents, in compliance with s. 134.98; and related disputes.

AB824,,37 (b) A data custodian that provides storage for sensitive information shall do all of the following:

AB824,,38 1. Provide a secure environment for the storage of a data owner’s data. The environment shall be designed and configured in a manner that reflects best practices of data security on subjects including all of the following:

AB824,,39 a. Identity and access management controls, including limiting the access to any data subject to a data agreement.

AB824,,40 b. Role-based permissions, including limiting the access to data subject to a data agreement to only authorized users.

AB824,,41 c. Data encryption at rest and in transit.

AB824,,42 d. Cyber security monitoring and threat detection.

AB824,,43 e. Recovery capabilities in the event of a disaster, such as fail-over, backup, and restore capabilities.

AB824,,44 2. Establish and ensure compliance with internal policies and procedures that reflect best practices on all of the following subjects:

AB824,,45 a. Data access control.

AB824,,46 b. Data retention and data destruction.

AB824,,47 c. Auditing capabilities and the performance of audits.

AB824,,48 d. The periodic review of new and changing business and regulatory requirements that may impact data solution organization.

AB824,,49 e. Any other requirements established in a data agreement.

AB824,,50 3. Establish and ensure compliance with internal policies and procedures related to security incidents that include all of the following:

AB824,,51 a. A description of the severity levels by which security incidents are classified with descriptions and relevant examples for each severity classification.

AB824,,52 b. The number of hours after a security incident is detected when a data custodian must notify the data owner and data steward of the incident and the timing of subsequent updates, based on the nature or severity of the incident.

AB824,,53 c. A policy and process to designate a specific member of the data custodian’s team to provide security incident communications to the data owner and data steward.

AB824,,54 d. A policy to inform the data owner and data steward of the time the incident occurred, if known; the time the incident was detected; the nature of the incident, including which data sets were known to have been impacted; the severity of the incident; the remediation steps that have been or will be taken; the estimated timeline to resolve the incident; and a way for the data owner or data steward to contact the data custodian to seek further information about the incident.

AB824,,55 e. A policy to provide a follow-up notification after the resolution of an incident that includes the time the incident was resolved, the nature of the resolution, any changes to the data custodian’s systems or protocols to prevent subsequent incidents, and any recommended changes to the data owner’s or data steward’s systems protocols to prevent subsequent incidents.

AB824,,56 f. A record retention policy that requires the data custodian to maintain records detailing its response to security incidents for a reasonable time after the resolution of the security incident.

AB824,,57 4. Establish and ensure compliance with internal policies and procedures related to auditing capabilities that require the data custodian to perform an audit of its systems at the request of the data owner.

AB824,,58 (c) A data steward that uses or facilitates the use of sensitive information shall do all of the following:

AB824,,59 1. Establish and ensure compliance with internal policies and procedures that reflect best practices of data handling on subjects including all of the following:

AB824,,60 a. Standards, policies, procedures, and requirements for requesting, accessing, interpreting, and using data.

AB824,,61 b. Identity and access management controls, including limiting the access to any data subject to a data agreement.

AB824,,62 c. Verification of data outputs to meet quality, accuracy, and reliability specifications.