AB872,5,13 (f) The processing is conducted to detect security incidents; to protect against malicious, deceptive, fraudulent, or illegal activity; or to prosecute a person responsible for that activity.

AB872,5,15 (g) The controller or a 3rd party has a legitimate ground to process the personal data.

AB872,5,17 (3) Processing of certain types of personal data. (a) Except as provided in par. (b), a controller or processor may not process any of the following:

AB872,5,19 1. Personal data revealing a consumer's racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership.

AB872,5,21 2. Genetic data, data concerning health, or personal data concerning a consumer's sex life or sexual orientation.

AB872,5,23 3. Biometric data, if the purpose of the processing is to uniquely identify a consumer.

AB872,5,25 (b) A controller or processor may process information described in par. (a) if any of the following applies:

AB872,6,2 1. The processing is conducted for a purpose to which the consumer explicitly consents.

AB872,6,3 2. The processing is necessary for complying with a legal obligation.

AB872,6,6 3. The consumer is physically or legally incapable of giving consent and the processing is necessary to protect the vital interests of the consumer or another individual.

AB872,6,8 4. The processing is conducted by a nonprofit organization having a political, philosophical, or religious purpose and all of the following applies:

AB872,6,11 a. The processing relates only to members or former members of the organization or to persons who have regular contact with the organization related to the organization's purposes.

AB872,6,12 b. The personal data processed is not disclosed outside the organization.

AB872,6,13 5. The processing relates to personal data that the consumer makes public.

AB872,6,15 6. The processing is necessary for establishing, exercising, or defending a legal claim or a court authorizes the processing.

AB872,6,16 7. The processing is necessary for reasons of substantial public interest.

AB872,6,20 8. The processing is necessary for reasons of public interest in the area of public health, if the personal data is processed by or under the responsibility of a professional subject to confidentiality obligations under federal, state, or local law and any of the following applies:

AB872,6,22 a. Processing the personal data is necessary to provide health care or treatment to a person in a medical emergency.

AB872,6,25 b. Processing the personal data is necessary to protect against serious threats to health or for ensuring the quality and safety of health care, medical products, or medical devices.

AB872,7,2 9. The processing is necessary for archiving purposes that are in the public interest, scientific or historic research purposes, or statistical purposes.

AB872,7,5 (4) Request to restrict processing of personal data. (a) Except as provided in par. (c) 1., upon a consumer's request, a controller may store but may not otherwise process the consumer's personal data if any of the following applies:

AB872,7,6 1. Processing the personal data is unlawful.

AB872,7,8 2. Storing the personal data is necessary for the consumer to establish, exercise, or defend a legal claim.

AB872,7,10 3. The controller has no legitimate ground to process the personal data that overrides the consumer's request.

AB872,7,17 (b) If a controller is required under par. (a) to not process, other than by storing, a consumer's personal data and the controller has disclosed the personal data to other controllers, the controller shall notify each recipient to whom the controller disclosed the personal data about the consumer's request under par. (a), unless notification is impossible or involves unreasonable effort. Except as provided in par. (c) 1., upon receiving the notice, a controller may store but may not otherwise process the consumer's personal data if any of the conditions of par. (a) applies.

AB872,7,19 (c) 1. Paragraphs (a) and (b) do not prohibit a controller from processing, other than by storing, a consumer's personal data if any of the following apply:

AB872,7,20 a. The consumer consents to the processing.

AB872,7,22 b. The controller processes the personal data for establishing, exercising, or defending a legal claim.

AB872,7,24 c. The controller processes the personal data to protect the rights of another person.