AB872: Bill Text

AB872,3,25 (g) “Process,” when used in reference to personal data, means to perform an operation or set of operations on personal data, including to collect, record, organize, store, alter, retrieve, use, disclose, disseminate, make available, combine, delete, or destroy the personal data.

AB872,4,3 (h) “Processor” means a person who processes personal data on behalf of a controller, but does not include a law enforcement agency or a unit or instrumentality of the federal government, the state, or a local government.

AB872,4,4 (i) “Recipient” means a person to which personal data is disclosed.

AB872,4,7 (2) Requirements for processing personal data. Subject to sub. (4), no controller or processor may process a consumer's personal data unless any of the following applies:

AB872,4,8 (a) All of the following applies:

AB872,4,11 1. The processing is conducted for a purpose to which the consumer, or if the consumer is less than 16 years of age, the consumer's parent or guardian, consents by a statement or clear affirmative action.

AB872,4,13 2. The consent under par. (a) 1. is freely given, specific, informed, and unambiguous.

AB872,4,15 3. The consumer is able to withdraw any consent provided under par. (a) 1. at any time, and before giving consent is informed that consent may be withdrawn.

AB872,4,17 4. The consent provided under par. (a) 1. is as easy for the consumer to withdraw as to give.

AB872,4,21 5. If the consumer grants consent as part of a written declaration that also concerns other matters, the request for consent is clearly distinguishable from the other matters in an intelligible and easily accessible form using clear and plain language.

AB872,4,23 6. The controller or processor is able to demonstrate that the consumer provided consent under par. (a) 1.

AB872,5,2 7. The controller or processor does not require as a condition of using the controller's or processor's service that the consumer consent to processing of personal data, unless processing the consumer's personal data is necessary to perform the service.

AB872,5,5 (b) The processing is necessary to perform a contract to which the consumer is party or in order to take steps at the request of the consumer before entering a contract.

AB872,5,6 (c) The processing is necessary for complying with a legal obligation.

AB872,5,8 (d) The processing is necessary to protect the vital interests of the consumer or another person.

AB872,5,10 (e) The processing is necessary to perform a task carried out in the public interest or to exercise official authority vested in the controller.

AB872,5,13 (f) The processing is conducted to detect security incidents; to protect against malicious, deceptive, fraudulent, or illegal activity; or to prosecute a person responsible for that activity.

AB872,5,15 (g) The controller or a 3rd party has a legitimate ground to process the personal data.

AB872,5,17 (3) Processing of certain types of personal data. (a) Except as provided in par. (b), a controller or processor may not process any of the following:

AB872,5,19 1. Personal data revealing a consumer's racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership.

AB872,5,21 2. Genetic data, data concerning health, or personal data concerning a consumer's sex life or sexual orientation.

AB872,5,23 3. Biometric data, if the purpose of the processing is to uniquely identify a consumer.

AB872,5,25 (b) A controller or processor may process information described in par. (a) if any of the following applies:

AB872,6,2 1. The processing is conducted for a purpose to which the consumer explicitly consents.

AB872,6,3 2. The processing is necessary for complying with a legal obligation.

AB872,6,6 3. The consumer is physically or legally incapable of giving consent and the processing is necessary to protect the vital interests of the consumer or another individual.

AB872,6,8 4. The processing is conducted by a nonprofit organization having a political, philosophical, or religious purpose and all of the following applies:

AB872,6,11 a. The processing relates only to members or former members of the organization or to persons who have regular contact with the organization related to the organization's purposes.

AB872,6,12 b. The personal data processed is not disclosed outside the organization.

AB872,6,13 5. The processing relates to personal data that the consumer makes public.

AB872,6,15 6. The processing is necessary for establishing, exercising, or defending a legal claim or a court authorizes the processing.

AB872,6,16 7. The processing is necessary for reasons of substantial public interest.

AB872,6,20 8. The processing is necessary for reasons of public interest in the area of public health, if the personal data is processed by or under the responsibility of a professional subject to confidentiality obligations under federal, state, or local law and any of the following applies:

AB872,6,22 a. Processing the personal data is necessary to provide health care or treatment to a person in a medical emergency.

AB872,6,25 b. Processing the personal data is necessary to protect against serious threats to health or for ensuring the quality and safety of health care, medical products, or medical devices.

AB872,7,2 9. The processing is necessary for archiving purposes that are in the public interest, scientific or historic research purposes, or statistical purposes.

AB872,7,5 (4) Request to restrict processing of personal data. (a) Except as provided in par. (c) 1., upon a consumer's request, a controller may store but may not otherwise process the consumer's personal data if any of the following applies:

AB872,7,6 1. Processing the personal data is unlawful.

AB872,7,8 2. Storing the personal data is necessary for the consumer to establish, exercise, or defend a legal claim.

AB872,7,10 3. The controller has no legitimate ground to process the personal data that overrides the consumer's request.

AB872,7,17 (b) If a controller is required under par. (a) to not process, other than by storing, a consumer's personal data and the controller has disclosed the personal data to other controllers, the controller shall notify each recipient to whom the controller disclosed the personal data about the consumer's request under par. (a), unless notification is impossible or involves unreasonable effort. Except as provided in par. (c) 1., upon receiving the notice, a controller may store but may not otherwise process the consumer's personal data if any of the conditions of par. (a) applies.

AB872,7,19 (c) 1. Paragraphs (a) and (b) do not prohibit a controller from processing, other than by storing, a consumer's personal data if any of the following apply:

AB872,7,20 a. The consumer consents to the processing.

AB872,7,22 b. The controller processes the personal data for establishing, exercising, or defending a legal claim.

AB872,7,24 c. The controller processes the personal data to protect the rights of another person.

AB872,8,2 d. The controller processes the personal data for important public interest reasons under federal, state, or local law.

AB872,8,4 2. A controller may not process, other than by storing, personal data under this paragraph unless the controller first notifies the consumer.

AB872,8,7 (d) A controller is not required to restrict processing of a consumer's personal data under this subsection if the controller is unable to verify, using commercially reasonable efforts, the identity of the consumer making the request.

AB872,8,10 (5) Records of processing activities. (a) A controller shall maintain records of processing of personal data conducted by the controller that contain all of the following information:

AB872,8,11 1. The controller's name and contact information.

AB872,8,12 2. The purpose of the processing.

AB872,8,14 3. An identification of the categories of personal data involved in the processing.

AB872,8,16 4. An identification of the categories of consumers whose personal data is involved in the processing.

AB872,8,18 5. If consent is provided for the processing, documentation of consent from consumers for the consumers' personal data to be processed.

AB872,8,20 6. The name and contact information of a person to whom the controller discloses personal data, and the purpose for the disclosure.

AB872,8,22 (b) A processor shall maintain records of processing of personal data conducted by the processor that contain all of the following:

AB872,8,24 1. The processor's name and contact information, and the name and contact information of the controller on behalf of which the processor is acting.

AB872,8,25 2. The categories of processing conducted on behalf of each controller.

AB872,9,2 (c) A controller or processor shall make records required under this subsection available to the department upon request.

AB872,9,4 (6) Applicability. (a) A controller or processor is not prohibited under this section from processing any of the following types of information:

AB872,9,6 1. Health information protected by the federal Health Insurance Portability and Accountability Act of 1996.

AB872,9,7 2. Information identifying a patient covered by 42 USC 290dd-2.

AB872,9,9 3. Information collected as part of research subject to the Federal Policy for the Protection of Human Subjects, 45 CFR part 46, or subject to 21 CFR parts 50 and 56.

AB872,9,11 4. Information and documents created specifically for and collected and maintained by a hospital.

AB872,9,13 5. Information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986, 42 USC 11101 et seq.

AB872,9,15 6. Patient safety work product information for purposes of 42 USC 299b-21 to 299b-26.

AB872,9,18 7. Information maintained by a health care provider, a health care facility, or an entity covered by the federal Health Insurance Portability and Accountability Act of 1996.

AB872,9,21 8. Personal information provided to or from or held by a consumer reporting agency, as defined in s. 422.501 (1m), if the use of the information complies with the federal Fair Credit Reporting Act, 15 USC 1681 et seq.

AB872,9,23 9. Personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act, P.L. 106-102.

AB872,9,25 10. Personal information collected, processed, sold, or disclosed pursuant to the federal Driver's Privacy Protection Act, 18 USC 2721 et seq.

AB872,10,1 11. Information maintained for employment records.

AB872,10,3 (b) This section does not apply to a consumer processing personal data in connection with a purely personal or household activity.

AB872,10,5 (c) This section does not apply to a controller that processes a consumer's personal data for literary or artistic purposes.

AB872,10,8 (d) This section does not apply to a controller that processes a consumer's personal data, that intends to publish the personal data, and that believes that publication of the personal data is in the public interest.

AB872,10,10 (7) Enforcement; penalties. (a) The attorney general may investigate violations of this section and may bring actions for enforcement of this section.

AB872,10,13 (b) 1. A controller or processor who violates sub. (5) shall be fined not more than $10,000,000 or not more than 2 percent of the controller's total annual revenue during the preceding financial year, whichever is greater.

AB872,10,16 2. A controller or processor who violates sub. (2), (3), or (4) shall be fined not more than $20,000,000 or not more than 4 percent of the controller's total annual revenue during the preceding financial year, whichever is greater.

AB872,10,20 3. A court may not impose in the same action more than one fine on a controller or processor under this paragraph unless the additional fine is imposed for a violation that does not involve the same or linked processing activities by the controller or processor.

AB872,2 Section 2. Effective date.

AB872,10,22 (1) This act takes effect on July 31, 2022.

AB872,10,23 (End)