SB851,7,12 (k) “Service provider” means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit of its shareholders or other owners and that processes information on behalf of a business and to which the business discloses a consumer's personal information for a business purpose pursuant to a written contract that prohibits the recipient of the information from retaining, using, or disclosing the information for any purpose other than for the specific purpose of performing the services specified in the contract.

SB851,7,13 (L) “Third party” means a person that is not any of the following:

SB851,7,14 1. A business that collects personal information from consumers.

SB851,7,19 2. A person to whom a business discloses a consumer's personal information for a business purpose pursuant to a written contract that prohibits the person receiving the personal information from selling, retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract.

SB851,7,24 (m) “Verifiable consumer request” means a request, received by a business that has collected personal information about a consumer, that the business can reasonably verify to be from the consumer or the consumer's authorized representative or, if the consumer is under 13 years of age, the consumer's parent or guardian.

SB851,8,4 (2) Required notices. (a) If a business has an online privacy policy or a Wisconsin-specific description of consumers' privacy rights, the business shall disclose all of the following information in the policy or description in a form that is reasonably accessible to consumers:

SB851,8,6 1. The right of a consumer to request a disclosure under sub. (3) (a) and (c) and one or more methods that a consumer is able to use to make a request.

SB851,8,8 2. The categories of consumers' personal information collected in the preceding 12 months.

SB851,8,10 3. The categories of sources from which consumers' personal information was collected in the preceding 12 months.

SB851,8,12 4. The business or commercial purposes for collecting consumers' personal information.

SB851,8,14 5. If the business has sold consumers' personal information in the preceding 12 months, the business or commercial purposes for selling the personal information.

SB851,8,17 6. If the business has shared consumers' personal information with a 3rd party in the preceding 12 months, the categories of 3rd parties with whom the business has shared personal information.

SB851,8,21 7. A list of the categories of consumers' personal information sold, if the business has sold consumers' personal information in the preceding 12 months, or if the business has not sold consumers' personal information in the preceding 12 months, a disclosure of that fact.

SB851,9,2 8. A list of the categories of consumers' personal information disclosed for a business purpose, if the business has disclosed consumers' personal information for a business purpose in the preceding 12 months, or if the business has not disclosed consumers' personal information for a business purpose in the preceding 12 months, a disclosure of that fact.

SB851,9,6 (b) If a business does not have an online privacy policy or a Wisconsin-specific description of consumers' privacy rights under par. (a) and the business has an Internet site, the business shall disclose the information listed in par. (a) 1. to 8. on its Internet site in a form that is reasonably accessible to consumers.

SB851,9,8 (c) A business that makes a disclosure under par. (a) or (b) shall update the information in the disclosure at least once every 12 months.

SB851,9,12 (3) Disclosure of information collected. (a) 1. Upon receiving a verifiable consumer request from a consumer, a business that has collected personal information about that consumer shall promptly disclose and deliver free of charge to the consumer all of the following:

SB851,9,14 a. The categories of personal information it has collected about the consumer in the preceding 12 months.

SB851,9,16 b. The categories of sources from which the consumer's personal information was collected in the preceding 12 months.

SB851,9,18 c. The business or commercial purposes for collecting the consumer's personal information.

SB851,9,20 d. If the business has sold the consumer's personal information in the preceding 12 months, the business or commercial purposes for selling the personal information.

SB851,9,23 e. If the business has shared the consumer's personal information with 3rd parties in the preceding 12 months, the categories of 3rd parties with whom the business has shared personal information.

SB851,9,25 f. The specific pieces of personal information that the business has collected about the consumer in the preceding 12 months.

SB851,10,3 2. A business may disclose and deliver personal information to a consumer under this paragraph only after receiving a verifiable consumer request from the consumer.

SB851,10,7 3. A business shall make available to consumers 2 or more methods for submitting verifiable consumer requests for a disclosure under this paragraph including, at a minimum, a toll-free telephone number and, if the business maintains an Internet site, an Internet address.

SB851,10,13 4. a. Except as provided in subd. 4. b., a business shall deliver the disclosure required under this paragraph within 45 days of receiving a verifiable consumer request from a consumer. A business shall promptly take steps to determine whether a request received is a verifiable consumer request. The time that a business spends determining whether a request is a verifiable consumer request is included in the 45-day deadline under this subd. 4. a.

SB851,10,17 b. A business may deliver the disclosure required under this paragraph within 90 days after receiving a verifiable consumer request if reasonably necessary and if the business notifies the consumer of the delayed delivery before the time period under subd. 4. a. expires.

SB851,11,2 5. A business shall deliver personal information under this paragraph in writing and through the consumer's account with the business, if the consumer maintains an account with the business. If the consumer does not maintain an account with the business, the business shall deliver personal information under this paragraph by mail or electronically, at the choice of the consumer. If the business provides personal information under this paragraph electronically, the business shall provide the information in a portable and, to the extent technically feasible, a readily useable format that allows the consumer to transmit the information to another entity without hindrance.

SB851,11,5 6. A business may not require a consumer to create an account in order to submit a verifiable consumer request for a disclosure of personal information required under this paragraph.