AB872,4,3 (h) “Processor” means a person who processes personal data on behalf of a controller, but does not include a law enforcement agency or a unit or instrumentality of the federal government, the state, or a local government.

AB872,4,4 (i) “Recipient” means a person to which personal data is disclosed.

AB872,4,7 (2) Requirements for processing personal data. Subject to sub. (4), no controller or processor may process a consumer's personal data unless any of the following applies:

AB872,4,8 (a) All of the following applies:

AB872,4,11 1. The processing is conducted for a purpose to which the consumer, or if the consumer is less than 16 years of age, the consumer's parent or guardian, consents by a statement or clear affirmative action.

AB872,4,13 2. The consent under par. (a) 1. is freely given, specific, informed, and unambiguous.

AB872,4,15 3. The consumer is able to withdraw any consent provided under par. (a) 1. at any time, and before giving consent is informed that consent may be withdrawn.

AB872,4,17 4. The consent provided under par. (a) 1. is as easy for the consumer to withdraw as to give.

AB872,4,21 5. If the consumer grants consent as part of a written declaration that also concerns other matters, the request for consent is clearly distinguishable from the other matters in an intelligible and easily accessible form using clear and plain language.

AB872,4,23 6. The controller or processor is able to demonstrate that the consumer provided consent under par. (a) 1.

AB872,5,2 7. The controller or processor does not require as a condition of using the controller's or processor's service that the consumer consent to processing of personal data, unless processing the consumer's personal data is necessary to perform the service.

AB872,5,5 (b) The processing is necessary to perform a contract to which the consumer is party or in order to take steps at the request of the consumer before entering a contract.

AB872,5,6 (c) The processing is necessary for complying with a legal obligation.

AB872,5,8 (d) The processing is necessary to protect the vital interests of the consumer or another person.

AB872,5,10 (e) The processing is necessary to perform a task carried out in the public interest or to exercise official authority vested in the controller.

AB872,5,13 (f) The processing is conducted to detect security incidents; to protect against malicious, deceptive, fraudulent, or illegal activity; or to prosecute a person responsible for that activity.

AB872,5,15 (g) The controller or a 3rd party has a legitimate ground to process the personal data.

AB872,5,17 (3) Processing of certain types of personal data. (a) Except as provided in par. (b), a controller or processor may not process any of the following:

AB872,5,19 1. Personal data revealing a consumer's racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership.

AB872,5,21 2. Genetic data, data concerning health, or personal data concerning a consumer's sex life or sexual orientation.

AB872,5,23 3. Biometric data, if the purpose of the processing is to uniquely identify a consumer.

AB872,5,25 (b) A controller or processor may process information described in par. (a) if any of the following applies:

AB872,6,2 1. The processing is conducted for a purpose to which the consumer explicitly consents.

AB872,6,3 2. The processing is necessary for complying with a legal obligation.

AB872,6,6 3. The consumer is physically or legally incapable of giving consent and the processing is necessary to protect the vital interests of the consumer or another individual.

AB872,6,8 4. The processing is conducted by a nonprofit organization having a political, philosophical, or religious purpose and all of the following applies:

AB872,6,11 a. The processing relates only to members or former members of the organization or to persons who have regular contact with the organization related to the organization's purposes.

AB872,6,12 b. The personal data processed is not disclosed outside the organization.

AB872,6,13 5. The processing relates to personal data that the consumer makes public.