This is the preview version of the Wisconsin State Legislature site.
Please see http://docs.legis.wisconsin.gov for the production version.
The bill provides consumers with the following rights regarding their personal data: 1) to confirm whether a controller is processing the consumers personal data and to access the personal data; 2) to correct inaccuracies in the consumers personal data; 3) to require a controller to delete personal data provided by or about the consumer; 4) to obtain a copy of the personal data that the consumer previously provided to the controller; and 5) to opt out of the processing of the consumers personal data for targeted advertising; the sale of the consumers personal data; and certain forms of automated processing of the consumers personal data. These rights are subject to certain exceptions specified in the bill. Controllers may not discriminate against a consumer for exercising rights under the bill, including by charging different prices for goods or providing a different level of quality of goods or services.
A controller must establish one or more secure and reliable means for consumers to submit a request to exercise their consumer rights under the bill. Such means must include a clear and conspicuous link on the controllers website to a webpage that enables a consumer or an agent of a consumer to opt out of the targeted advertising or sale of the consumers personal data and, on or after July 1, 2028, an opt-out preference signal sent, with a consumers intent, by a platform, technology, or mechanism to the controller indicating the consumers intent to opt out of any processing of the consumers personal data for the purpose of targeted advertising or sale of the consumers personal data.
The bill requires controllers to respond to consumers requests to invoke rights under the bill without undue delay. If a controller declines to take action regarding a consumers request, the controller must inform the consumer of its justification without undue delay. The bill also requires that information provided in response to a consumers request be provided free of charge once annually per consumer. Controllers must also establish processes for consumers to appeal a refusal to take action on a consumers request. Within 60 days of receiving an appeal, a controller must inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for its decisions. If the appeal is denied, the controller must provide the consumer with a method through which the consumer can contact the Department of Agriculture, Trade and Consumer Protection to submit a complaint.
Under the bill, a controller must provide consumers with a privacy notice that discloses the categories of personal data processed by the controller; the purpose of processing the personal data; the categories of third parties, if any, with whom the controller shares personal data; the categories of personal data that the controller shares with third parties; and information about how consumers may exercise their rights under the bill. Controllers may not collect or process personal data for purposes that are not relevant to or reasonably necessary for the purposes disclosed in the privacy notice. The bills requirements do not restrict a controllers ability to collect, use, or retain data for conducting internal research, effectuating a product recall, identifying and repairing technical errors, or performing internal operations that are reasonably aligned with consumer expectations or reasonably anticipated on the basis of a consumers relationship with the controller.
Persons that process personal data on behalf of a controller must adhere to a contract between the controller and the processor, and such contracts must satisfy certain requirements specified in the bill. The bill also requires controllers to conduct data protection assessments related to certain activities, including processing personal data for targeted advertising, selling personal data, processing personal data for profiling purposes, and processing sensitive data, as defined in the bill. DATCP may request that a controller disclose a data protection assessment that is relevant to an investigation being conducted by DATCP.
DATCP and the Department of Justice have exclusive authority to enforce violations of the bills requirements. A controller or processor that violates the bills requirements is subject to a forfeiture of up to $10,000 per violation, and DATCP or DOJ may recover reasonable investigation and litigation expenses incurred. During the time between the bills effective date and July 1, 2031, before bringing an action to enforce the bills requirements, DATCP or DOJ must first provide a controller or processor with a written notice identifying the violations. If within 30 days of receiving the notice the controller or processor cures the violation and provides DATCP or DOJ with an express written statement that the violation is cured and that no such further violations will occur, then DATCP or DOJ may not bring an action against the controller or processor.
The bill also prohibits cities, villages, towns, and counties from enacting or enforcing ordinances that regulate the collection, processing, or sale of personal data.
For further information see the state fiscal estimate, which will be printed as an appendix to this bill.
The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:
SB166,1
1Section 1. 100.80 of the statutes is created to read:
SB166,2,22100.80 Consumer data protection. (1) Definitions. In this section:
SB166,2,93(a) Affiliate means a legal entity that controls, is controlled by, or is under
4common control with another legal entity or shares common branding with another
5legal entity. For the purposes of this definition, control or controlled means
6ownership of, or the power to vote, more than 50 percent of the outstanding shares
7of any class of voting security of a company; control in any manner over the election
8of a majority of the directors or of individuals exercising similar functions; or the
9power to exercise controlling influence over the management of a company.
SB166,3,210(b) Authenticate means verifying through reasonable means that the
11consumer, entitled to exercise his or her consumer rights under sub. (2), is the same

1consumer exercising such consumer rights, or is an individual with authority to
2exercise such rights of a consumer, with respect to the personal data at issue.
SB166,3,103(c) Biometric data means data generated by automatic measurements of an
4individuals biological characteristics, such as a fingerprint, voiceprint, eye retinas,
5irises, or other unique biological patterns or characteristics that are used to identify
6a specific individual. Biometric data does not include a physical or digital
7photograph, a video or audio recording or data generated therefrom unless such
8data is generated to identify a specific individual, or information collected, used, or
9stored for health care treatment, payment, or operations under the federal Health
10Insurance Portability and Accountability Act of 1996.
SB166,3,1111(d) Business associate has the meaning given in 45 CFR 160.103.
SB166,3,1212(e) Child means an individual younger than 13 years of age.
SB166,3,1713(f) Consent means a clear affirmative act signifying a consumers freely
14given, specific, informed, and unambiguous agreement to process personal data
15relating to the consumer. Consent may include a written statement, including a
16statement written by electronic means, or any other unambiguous affirmative
17action. Consent does not include any of the following:
SB166,3,20181. Acceptance of a general terms-of-use document or similar document that
19contains descriptions of personal data processing along with other, unrelated
20information.
SB166,3,21212. Hovering over, muting, pausing, or closing a given piece of content.
SB166,3,22223. Agreements obtained by using dark patterns.
SB166,4,223(g) Consumer means an individual who is a resident of this state acting only

1in an individual or household context. Consumer does not include an individual
2acting in a commercial or employment context.
SB166,4,43(h) Controller means a person that, alone or jointly with others, determines
4the purpose and means of processing personal data.
SB166,4,55(i) Covered entity has the meaning given in 45 CFR 160.103.
SB166,4,76(ja) Cures Act means the federal 21st Century Cures Act and valid federal
7regulations enacted pursuant to such provisions.
SB166,4,108(jd) Dark pattern means a user interface designed or manipulated with the
9substantial effect of subverting or impairing user autonomy, decision making, or
10choice.
SB166,4,1511(jg) Decisions that produce legal or similarly significant effects concerning a
12consumer means a decision made by the controller that results in the provision or
13denial by the controller of financial and lending services, housing, insurance,
14education enrollment, criminal justice, employment opportunities, health care
15services, or access to basic necessities, such as food and water.
SB166,4,1716(ka) Deidentified data means data that cannot reasonably be linked to an
17identified or identifiable individual, or a device linked to such person.
SB166,4,2018(kb) Identified or identifiable individual means a person who can be readily
19identified, directly or indirectly, in particular by reference to an identifier such as a
20name, an identification number, specific geolocation data, or an online identifier.
SB166,4,2321(La) HIPAA means the federal Health Insurance Portability and
22Accountability Act and valid federal regulations enacted pursuant to the act,
23including 45 CFR 164.500 to 164.534.
SB166,5,3
1(Lg) HITECH means the federal Health Information Technology for
2Economic and Clinical Health Act and valid federal regulations enacted pursuant
3to the act.
SB166,5,44(m) Institution of higher education has the meaning given in s. 39.32 (1) (a).
SB166,5,75(n) Nonprofit organization means any corporation organized under ch. 181,
6any organization identified under s. 895.486 (2) (e), or any organization exempt
7from taxation under section 501 (c) (3), (6), or (12) of the Internal Revenue Code.
SB166,5,108(o) Personal data means any information that is linked or reasonably
9linkable to an identified or identifiable individual. Personal data does not include
10deidentified data or publicly available information.
SB166,5,1711(p) Precise geolocation data means information derived from technology,
12including global positioning system level latitude and longitude coordinates or other
13mechanisms, that directly identifies the specific location of an individual with
14precision and accuracy within a radius of 1,750 feet. Precise geolocation data
15does not include the content of communications or any data generated by or
16connected to advanced utility metering infrastructure systems or equipment for use
17by a utility.
SB166,5,2118(q) Process or processing means any operation or set of operations
19performed, whether by manual or automated means, on personal data or on sets of
20personal data, such as the collection, use, storage, disclosure, analysis, deletion, or
21modification of personal data.
SB166,5,2322(r) Processor means an individual or person that processes personal data on
23behalf of a controller.
SB166,6,4
1(s) Profiling means any form of automated processing performed on
2personal data to evaluate, analyze, or predict personal aspects related to an
3identified or identifiable individuals economic situation, health, personal
4preferences, interests, reliability, behavior, location, or movements.
SB166,6,95(t) Pseudonymous data means personal data that cannot be attributed to a
6specific individual without the use of additional information, provided that such
7additional information is kept separately and is subject to appropriate technical
8and organizational measures to ensure that the personal data is not attributed to
9an identified or identifiable individual.
SB166,6,1510(u) Publicly available information means information that is lawfully made
11available through federal, state, or local government records, or information that a
12business has a reasonable basis to believe is lawfully made available to the general
13public through widely distributed media, by the consumer, or by a person to whom
14the consumer has disclosed the information, unless the consumer has restricted the
15information to a specific audience.
SB166,6,1816(v) Sale of personal data means the exchange of personal data for monetary
17or other valuable consideration by the controller to a 3rd party. Sale of personal
18data does not include any of the following:
SB166,6,20191. The disclosure of personal data to a processor that processes the personal
20data on behalf of the controller.
SB166,6,22212. The disclosure of personal data to a 3rd party for purposes of providing a
22product or service requested by the consumer.
SB166,7,2233. The disclosure of personal data based on the consumer directing the

1controller to disclose the personal data or intentionally using the controller to
2interact with a 3rd party.
SB166,7,334. The disclosure or transfer of personal data to an affiliate of the controller.
SB166,7,645. The disclosure of information that a consumer intentionally made available
5to the general public via a channel of mass media and did not restrict to a specific
6audience.
SB166,7,976. The disclosure or transfer of personal data to a 3rd party as an asset that is
8part of a merger, acquisition, bankruptcy, or other transaction in which the 3rd
9party assumes control of all or part of the controllers assets.
SB166,7,1010(w) Sensitive data includes the following:
SB166,7,12111. Personal data revealing racial or ethnic origin, religious beliefs, mental or
12physical health diagnosis, sexual orientation, or citizenship or immigration status.
SB166,7,14132. The processing of genetic or biometric data for the purpose of uniquely
14identifying an individual.
SB166,7,15153. The personal data collected from a known child.
SB166,7,16164. Precise geolocation data.
SB166,7,2117(x) Targeted advertising means displaying advertisements to a consumer
18where the advertisement is selected based on personal data obtained or inferred
19from that consumers activities over time and across nonaffiliated websites or
20online applications to predict such consumers preferences or interests. Targeted
21advertising does not include any of the following:
SB166,7,23221. Advertisements based on activities within a controllers own websites or
23online applications.
SB166,8,2
12. Advertisements based on the context of a consumers current search query,
2visit to a website, or online application.
SB166,8,433. Advertisements directed to a consumer in response to the consumers
4request for information or feedback.
SB166,8,654. Processing personal data processed solely for measuring or reporting
6advertising performance, reach, or frequency.
SB166,8,117(y) Third party means a person or association, authority, board,
8department, commission, independent agency, institution, office, society, or other
9body in state or local government created or authorized to be created by the
10constitution or any law, other than a consumer, controller, processor, or an affiliate
11of the processor or the controller.
SB166,8,1212(z) Trade secret has the meaning given in s. 134.90.
SB166,8,1913(2) Personal data rights; consumers. (a) A consumer or a consumers
14authorized agent may invoke the consumer rights authorized under this subsection
15at any time by submitting a request to a controller specifying the consumer rights
16the consumer wishes to invoke. A known childs parent or legal guardian may
17invoke such consumer rights on behalf of the child regarding processing personal
18data belonging to the known child. A controller shall comply with an authenticated
19consumer request to exercise any of the following rights:
SB166,8,22201. To confirm whether or not a controller is processing the consumers
21personal data and to access such personal data, unless such confirmation or access
22would require the controller to reveal a trade secret.
SB166,9,2232. To correct inaccuracies in the consumers personal data, taking into

1account the nature of the personal data and the purposes of the processing of the
2consumers personal data.
SB166,9,333. To delete personal data provided by or obtained about the consumer.
SB166,9,944. To obtain a copy of the consumers personal data that the consumer
5previously provided to the controller in a portable and, to the extent technically
6feasible, readily usable format that allows the consumer to transmit the data to
7another controller without hindrance, where the processing is carried out by
8automated means, provided such controller shall not be required to reveal any trade
9secret.
SB166,9,16105. To opt out of the processing of the personal data for purposes of targeted
11advertising, the sale of personal data, or profiling in furtherance of decisions that
12produce legal or similarly significant effects concerning the consumer. A consumer
13may exercise the consumers rights through user-enabled global privacy controls,
14such as a browser plugin or privacy setting, device setting, or other mechanism, that
15communicate or signal the consumers choice to opt out of processing for the
16purpose of targeted advertising or sale of the consumers personal data.
SB166,9,1917(b) 1. Except as otherwise provided in this section, a controller shall comply
18with a request by a consumer to exercise the consumer rights authorized under par.
19(a).
SB166,9,23202. A controller shall respond to a consumer without undue delay, but in all
21cases within 45 days of receipt of a request submitted under par. (a). The response
22period may be extended once by 45 additional days when reasonably necessary,
23taking into account the complexity and number of the consumers requests, so long

1as the controller informs the consumer of any such extension within the initial 45-
2day response period, together with the reason for the extension.
SB166,10,633. If a controller declines to take action regarding a consumers request, the
4controller shall inform the consumer without undue delay, but in all cases and at
5the latest within 45 days of receipt of the request, of the justification for declining to
6take action and instructions for how to appeal the decision under par. (c).
SB166,10,1374. Information provided in response to a consumer request shall be provided
8by a controller free of charge, once annually per consumer. If requests from a
9consumer are manifestly unfounded, technically infeasible, excessive, or repetitive,
10the controller may charge the consumer a reasonable fee to cover the administrative
11costs of complying with the request or decline to act on the request. The controller
12bears the burden of demonstrating the manifestly unfounded, technically infeasible,
13excessive, or repetitive nature of the request.
SB166,10,18145. If a controller is unable to authenticate the request using commercially
15reasonable efforts, the controller may not be required to comply with a request to
16initiate an action under par. (a) and may request that the consumer provide
17additional information reasonably necessary to authenticate the consumer and the
18consumers request.
SB166,10,21196. A controller that has obtained personal data about a consumer from a
20source other than the consumer shall be deemed in compliance with a consumers
21request to delete the personal data under par. (a) 3. by doing any of the following:
SB166,11,222a. Deleting the personal data, retaining a record of the request and the

1minimum data necessary to ensure the consumers personal data remains deleted
2from the controllers records, and not using the retained data for any other purpose.
SB166,11,43b. Not processing the consumers personal data except as otherwise
4authorized under this section.
SB166,11,145(c) A controller shall establish a process for a consumer to appeal the
6controllers refusal to take action on a request within a reasonable period of time
7after the consumers receipt of the decision pursuant to par. (b) 3. The appeal
8process shall be conspicuously available and similar to the process for submitting
9requests to initiate action under par. (a). Within 60 days of receipt of an appeal, a
10controller shall inform the consumer in writing of any action taken or not taken in
11response to the appeal, including a written explanation of the reasons for the
12decisions. If the appeal is denied, the controller shall also provide the consumer
13with an online mechanism, if available, or other method through which the
14consumer may contact the department to submit a complaint.
SB166,11,1815(3) Data controller responsibilities; transparency. (a) 1. A controller
16shall limit the collection of personal data to what is adequate, relevant, and
17reasonably necessary in relation to the purposes for which such data is processed,
18as disclosed to the consumer.
SB166,11,22192. Except as otherwise provided in this section, a controller may not process
20personal data for purposes that are not reasonably necessary to and not compatible
21with the disclosed purposes for which such personal data is processed, as disclosed
22to the consumer, unless the controller obtains the consumers consent.
SB166,12,4233. A controller shall establish, implement, and maintain reasonable

1administrative, technical, and physical data security practices to protect the
2confidentiality, integrity, and accessibility of personal data. Such data security
3practices shall be appropriate to the volume and nature of the personal data at
4issue.
SB166,12,1654. A controller may not process personal data in violation of state and federal
6laws that prohibit unlawful discrimination against consumers. A controller may
7not discriminate against a consumer for exercising any of the consumer rights
8contained in this section, including denying goods or services, charging different
9prices or rates for goods or services, or providing a different level of quality of goods
10and services to the consumer. Nothing in this subdivision shall be construed to
11require a controller to provide a product or service that requires the personal data
12of a consumer that the controller does not collect or maintain, or to prohibit a
13controller from offering a different price, rate, level, quality, or selection of goods or
14services to a consumer, including offering goods or services for no fee, if the offer is
15related to a consumers voluntary participation in a bona fide loyalty, rewards,
16premium features, discounts, or club card program.
SB166,12,20175. A controller may not process sensitive data concerning a consumer without
18obtaining the consumers consent, or, in the case of the processing of sensitive data
19concerning a known child, without processing such data in accordance with the
20federal Childrens Online Privacy Protection Act, 15 USC 6501 et seq.
SB166,12,2221(b) Any provision of a contract or agreement that purports to waive or limit
22consumer rights under sub. (2) is void and unenforceable.
SB166,13,2
1(c) A controller shall provide consumers with a reasonably accessible, clear,
2and meaningful privacy notice that includes all of the following:
SB166,13,331. The categories of personal data processed by the controller.
SB166,13,442. The purpose of processing personal data.
SB166,13,753. How consumers may exercise their consumer rights under sub. (2),
6including how a consumer may appeal a controllers decision with regard to the
7consumers request.
SB166,13,984. The categories of 3rd parties, if any, with whom the controller shares
9personal data.
SB166,13,11105. The categories of personal data that the controller shares with 3rd parties,
11if any.
SB166,13,1512(d) If a controller sells personal data to 3rd parties or processes personal data
13for targeted advertising, the controller shall clearly and conspicuously disclose such
14processing, as well as the manner in which a consumer may exercise the right to opt
15out of such processing.
SB166,14,216(e) A controller shall establish, and shall describe in a privacy notice, one or
17more secure and reliable means for consumers to submit a request to exercise their
18consumer rights under this section. Such means shall take into account the ways in
19which consumers normally interact with the controller, the need for secure and
20reliable communication of such requests, and the ability of the controller to
21authenticate the identity of the consumer making the request. Controllers may not
22require a consumer to create a new account in order to exercise consumer rights
23under sub. (2) but may require a consumer to use an existing account. A controller

1that recognizes signals approved by other states shall be considered in compliance
2with this paragraph. Such means shall include all of the following:
SB166,14,531. A clear and conspicuous link on the controllers website to a webpage that
4enables a consumer or an agent of a consumer to opt out of the targeted advertising
5or sale of the consumers personal data.
Loading...
Loading...