AB872: Bill Text

AB872,8,7 (d) A controller is not required to restrict processing of a consumer's personal data under this subsection if the controller is unable to verify, using commercially reasonable efforts, the identity of the consumer making the request.

AB872,8,10 (5) Records of processing activities. (a) A controller shall maintain records of processing of personal data conducted by the controller that contain all of the following information:

AB872,8,11 1. The controller's name and contact information.

AB872,8,12 2. The purpose of the processing.

AB872,8,14 3. An identification of the categories of personal data involved in the processing.

AB872,8,16 4. An identification of the categories of consumers whose personal data is involved in the processing.

AB872,8,18 5. If consent is provided for the processing, documentation of consent from consumers for the consumers' personal data to be processed.

AB872,8,20 6. The name and contact information of a person to whom the controller discloses personal data, and the purpose for the disclosure.

AB872,8,22 (b) A processor shall maintain records of processing of personal data conducted by the processor that contain all of the following:

AB872,8,24 1. The processor's name and contact information, and the name and contact information of the controller on behalf of which the processor is acting.

AB872,8,25 2. The categories of processing conducted on behalf of each controller.

AB872,9,2 (c) A controller or processor shall make records required under this subsection available to the department upon request.

AB872,9,4 (6) Applicability. (a) A controller or processor is not prohibited under this section from processing any of the following types of information:

AB872,9,6 1. Health information protected by the federal Health Insurance Portability and Accountability Act of 1996.

AB872,9,7 2. Information identifying a patient covered by 42 USC 290dd-2.

AB872,9,9 3. Information collected as part of research subject to the Federal Policy for the Protection of Human Subjects, 45 CFR part 46, or subject to 21 CFR parts 50 and 56.

AB872,9,11 4. Information and documents created specifically for and collected and maintained by a hospital.

AB872,9,13 5. Information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986, 42 USC 11101 et seq.

AB872,9,15 6. Patient safety work product information for purposes of 42 USC 299b-21 to 299b-26.

AB872,9,18 7. Information maintained by a health care provider, a health care facility, or an entity covered by the federal Health Insurance Portability and Accountability Act of 1996.

AB872,9,21 8. Personal information provided to or from or held by a consumer reporting agency, as defined in s. 422.501 (1m), if the use of the information complies with the federal Fair Credit Reporting Act, 15 USC 1681 et seq.

AB872,9,23 9. Personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act, P.L. 106-102.

AB872,9,25 10. Personal information collected, processed, sold, or disclosed pursuant to the federal Driver's Privacy Protection Act, 18 USC 2721 et seq.

AB872,10,1 11. Information maintained for employment records.

AB872,10,3 (b) This section does not apply to a consumer processing personal data in connection with a purely personal or household activity.

AB872,10,5 (c) This section does not apply to a controller that processes a consumer's personal data for literary or artistic purposes.

AB872,10,8 (d) This section does not apply to a controller that processes a consumer's personal data, that intends to publish the personal data, and that believes that publication of the personal data is in the public interest.

AB872,10,10 (7) Enforcement; penalties. (a) The attorney general may investigate violations of this section and may bring actions for enforcement of this section.

AB872,10,13 (b) 1. A controller or processor who violates sub. (5) shall be fined not more than $10,000,000 or not more than 2 percent of the controller's total annual revenue during the preceding financial year, whichever is greater.

AB872,10,16 2. A controller or processor who violates sub. (2), (3), or (4) shall be fined not more than $20,000,000 or not more than 4 percent of the controller's total annual revenue during the preceding financial year, whichever is greater.

AB872,10,20 3. A court may not impose in the same action more than one fine on a controller or processor under this paragraph unless the additional fine is imposed for a violation that does not involve the same or linked processing activities by the controller or processor.

AB872,2 Section 2. Effective date.

AB872,10,22 (1) This act takes effect on July 31, 2022.

AB872,10,23 (End)