SB160,3,15 (2) “Consumer” means an individual who is a resident of this state and whose nonpublic information is in the possession, custody, or control of a licensee.

SB160,4,2 (3) “Cybersecurity event” means an event resulting in the unauthorized access to, or disruption or misuse of, an information system or the nonpublic information stored on an information system, except that a “cybersecurity event” does not include any of the following:

SB160,4,5 (a) The unauthorized acquisition of encrypted nonpublic information if the encryption process or key is not also acquired, released, or used without authorization.

SB160,4,8 (b) The unauthorized acquisition of nonpublic information if the licensee determines that the nonpublic information has not been used or released and has been returned to the licensee or destroyed.

SB160,4,10 (4) “Encrypted” means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key.

SB160,4,13 (5) “Information security program” means the administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information.

SB160,4,18 (6) “Information system” means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of nonpublic information, as well as any specialized system, including an industrial or process controls system, telephone switching and private branch exchange system, and environmental control system.

SB160,4,23 (7) “Licensee” means a person licensed, authorized, or registered, or a person required to be licensed, authorized, or registered, under chs. 600 to 655, other than a purchasing or risk retention group that is chartered and licensed in another state or a person acting as an assuming insurer that is domiciled in another state or jurisdiction.

SB160,4,25 (8) “Multifactor authentication” means authentication through verification of at least 2 of the following types of authentication factors:

SB160,5,1 (a) Knowledge factor, including a password.

SB160,5,2 (b) Possession factor, including a token or text message on a mobile phone.

SB160,5,3 (c) Inherence factor, including a biometric characteristic.

SB160,5,6 (9) “Nonpublic information” means electronic information in the possession, custody, or control of a licensee that is not publicly available information and is any of the following:

SB160,5,8 (a) Information concerning a consumer that can be used to identify the consumer, in combination with at least one of the following data elements:

SB160,5,9 1. Social security number.

SB160,5,10 2. Driver's license number or nondriver identification card number.

SB160,5,11 3. Financial account number or credit or debit card number.

SB160,5,13 4. Security code, access code, or password that permits access to a financial account.

SB160,5,14 5. Biometric records.

SB160,5,18 (b) Information or data, other than information or data regarding age or gender, in any form or medium created by or derived from a health care provider or a consumer that can be used to identify the consumer and that relates to any of the following:

SB160,5,20 1. The physical, mental, or behavioral health or condition of the consumer or a member of the consumer's family.

SB160,5,21 2. The provision of health care to the consumer.

SB160,5,22 3. Payment for the provision of health care to the consumer.

SB160,6,2 (10) “Publicly available information” means information that a licensee has a reasonable basis to believe is lawfully made available to the general public from federal, state, or local government records, widely distributed media, or disclosures required by federal, state, or local law.

SB160,6,6 (11) “Third-party service provider” means a person other than a licensee who contracts with a licensee to maintain, process, or store nonpublic information or is otherwise permitted access to nonpublic information through its provision of services to the licensee.

SB160,4 Section 4. 601.951 of the statutes is created to read:

SB160,6,11 601.951 General provisions. (1) Exclusive state standards. This subchapter establishes the exclusive state standards applicable to licensees for data security, the investigation of a cybersecurity event, and notification of a cybersecurity event to the commissioner.

SB160,6,16 (2) Exceptions to applicability. (a) This subchapter does not apply to a person who is an employee, agent, representative, or designee of a licensee and who is also a licensee to the extent that the person is covered by the information security program of the other licensee and the other licensee has complied with this subchapter on behalf of the person.

SB160,6,24 (b) A licensee affiliated with a depository institution that maintains an information security program in compliance with the interagency guidelines establishing information security standards as set forth pursuant to 15 USC 6801 and 6805 shall be considered to meet the requirements of this subchapter, provided that the licensee produces, upon request of the commissioner, documentation satisfactory to the commissioner that independently validates the adoption by the affiliated depository institution of an information security program that satisfies the interagency guidelines.