SB851,16,19 (b) A business or its service provider is not required to delete a consumer's personal information if it is necessary for the business or its service provider to maintain the consumer's personal information for any of the following purposes:

SB851,16,24 1. To complete the transaction for which the personal information was collected, to provide a good or service requested by the consumer or reasonably anticipated to be requested by the consumer within the context of the business's ongoing relationship with the consumer, or to otherwise perform a contract between the business and the consumer.

SB851,17,2 2. To detect security incidents, to protect against malicious, deceptive, fraudulent, or illegal activity, or to prosecute a person responsible for that activity.

SB851,17,4 3. To debug to identify and repair errors that impair existing or intended functionality.

SB851,17,6 4. To exercise free speech, to ensure the right of another consumer to exercise free speech, or to exercise another right provided by law.

SB851,17,11 5. If the consumer provides informed consent, to engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, if the business's deletion of the personal information is likely to render impossible or seriously impair the achievement of that research.

SB851,17,14 6. To enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer's relationship with the business.

SB851,17,15 7. To comply with a legal obligation.

SB851,17,18 8. To otherwise use the consumer's personal information internally in a lawful manner that is compatible with the context in which the consumer provided the information.

SB851,17,23 (6) Discrimination prohibited. (a) 1. A business may not discriminate against a consumer because the consumer makes a verifiable consumer request under sub. (3) (a) or (c) or (5) or because under sub. (4) (c) the personal information of the consumer was not permitted to be sold by the business, including by doing any of the following:

SB851,17,24 a. Denying goods or services to the consumer.

SB851,18,2 b. Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.

SB851,18,3 c. Providing a different level or quality of goods or services to the consumer.

SB851,18,5 d. Suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services.

SB851,18,9 2. This paragraph does not prohibit a business from charging a consumer a different price or rate, or from providing a different level or quality of goods or services to the consumer, if the difference is reasonably related to the value provided to the consumer by the consumer's data.

SB851,18,15 (b) 1. A business may offer financial incentives, including payments to consumers as compensation, for the collection of a consumer's personal information, the sale of a consumer's personal information, or the deletion of a consumer's personal information. A business may also offer a different price, rate, level, or quality of goods or services to a consumer if that difference is directly related to the value provided to the consumer by the consumer's data.

SB851,18,19 2. A business may enter a consumer into a financial incentive program described in subd. 1. only if the consumer or the consumer's parent or guardian affirmatively authorizes entry into the program after receiving a notice that clearly describes the material terms of the program.

SB851,18,21 3. A consumer or a consumer's parent or guardian may revoke entry into a financial incentive program described in subd. 1. at any time.

SB851,18,24 4. If a business offers a financial incentive program described in subd. 1., the business shall include a description of the program on the Internet page described in sub. (4) (b) 1. a. and in the policies described in sub. (4) (b) 1. b.

SB851,19,2 5. A business may not use financial incentive practices that are unjust, unreasonable, coercive, or usurious in nature.

SB851,19,5 (7) Guidance; rules. (a) A business or 3rd party may request advice from the attorney general on how to comply with this section, and the attorney general shall respond to the request.

SB851,19,7 (b) The department of justice shall promulgate rules to implement this section, including the following:.

SB851,19,9 1. Rules that specify additional categories of personal information to those enumerated in sub. (1) (i) 1.

SB851,19,12 2. Rules that specify unique personal identifiers to address changes in technology, changes in data collection, obstacles to implementing this section, and privacy concerns.

SB851,19,14 3. Rules that specify additional methods for consumers to make requests and businesses to provide disclosures under this section.

SB851,19,17 4. Rules that establish any exceptions necessary to comply with other state or federal law, including exceptions relating to trade secrets and intellectual property rights.

SB851,19,18 5. Rules that establish procedures for the following:

SB851,19,19 a. The submission of a direction under sub. (4) (c) 1. a.

SB851,19,20 b. Business compliance with a direction submitted under sub. (4) (c) 1. a.