Protection and privacy of online customer information.

20LSO-0126
2020
STATE OF WYOMING
20LSO-0126
Numbered
2.0

HOUSE BILL NO. HB0101

Protection and privacy of online customer information.

Sponsored by: Representative(s) Yin, Brown, Clem, Hunt, Western and Zwonitzer and Senator(s) Nethercott and Rothfuss

A BILL

for

AN ACT relating to consumer protection; providing for the protection of customer personal information for broadband internet access service; defining terms; providing for penalties and other enforcement; and providing for an effective date.

Be It Enacted by the Legislature of the State of Wyoming:

Section 1
.

W.S. 40
‑
12
‑
801 through 40
‑
12
‑
807 are created to read:

ARTICLE 8
BROADBAND INTERNET ACCESS SERVICE CUSTOMER PRIVACY

40
‑
12
‑
801.

Definitions.

(a)

As used in this article:

(i)

"Broadband internet access service" means a mass
‑
market retail service by wire or radio that provides the capability to transmit data to and receive data from all or substantially all internet endpoints, including any capabilities that are incidental to and enable the operation of the service. "Broadband internet access service" does not include internet access service provided by accessing the internet remotely via a telephone line;

(ii)

"Customer" means an applicant for or a current or former subscriber of a provider's broadband internet access service;

(iii)

"Customer personal information" means:

(A)

Personally identifying information about a customer, including the customer's name, billing information, social security number, billing address and demographic data;

(B)

Information from a customer's use of broadband internet access service, including:

(I)

The customer's web browsing history;

(II)

The customer's application usage history;

(III)

The customer's precise geolocation information;

(IV)

The customer's financial information;

(V)

The customer's health information;

(VI)

Information pertaining to the customer's children;

(VII)

The customer's device identifier, including a media control address, international mobile equipment identity or internet protocol address;

(VIII)

The content of the customer's communications;

(IX)

The origin and destination internet protocol addresses.

(iv)

"Provider" means a person who provides broadband internet access service.

40
‑
12
‑
802.

Privacy and security of customer personal information; prohibitions.

(a)

A provider shall not use, disclose, sell or permit access to customer personal information except as otherwise provided in this article, section 2703 of title 18 of the United States Code or as required by a duly issued search warrant.

(b)

A provider shall take reasonable security measures to protect customer personal information from unauthorized use, disclosure or access. A provider shall implement reasonable security measures that take into consideration the following:

(i)

The nature and scope of the provider's activities;

(ii)

The sensitivity of the data the provider collects;

(iii)

The size of the provider;

(iv)

The technical feasibility of any potential security measure.

(c)

A provider may employ any lawful security measure that allows the provider to comply with the requirements of this section.

40
‑
12
‑
803.

Privacy of customer personal information; customer consent for disclosure.

(a)

A provider may use, disclose, sell or permit access to customer personal information if the customer gives the provider express, written and affirmative consent to the use, disclosure, sale or access of his customer personal information. A customer may revoke his consent given under this subsection at any time.

(b)

A provider shall not:

(i)

Refuse to serve a customer who does not give consent as provided in subsection (a) of this section;

(ii)

Charge a customer a penalty or fee or offer a customer a discount based on the customer's decision regarding consent as provided in subsection (a) of this section.

(c)

A provider may use, disclose, sell or permit access to information the provider collects pertaining to a customer that is not customer personal information unless the customer notifies the provider in writing that the customer does not authorize the provider to use, disclose, sell or permit access to that information.

40
‑
12
‑
804.

Privacy of customer personal information; exceptions.

(a)

A provider may collect, retain, use, disclose, sell and permit access to customer personal information without customer consent:

(i)

For purposes of providing broadband internet access service from which the customer personal information is derived or for any other services necessary to provide the broadband internet access service to the customer;

(ii)

To advertise or market the provider's telecommunications, internet and television services to the customer;

(iii)

To comply with a lawful court order;

(iv)

To initiate, render, bill for and collect payment for broadband internet access service;

(v)

To protect users of the provider's or other providers' services from fraudulent, abusive or unlawful use of or subscription to those services;

(vi)

To provide geolocation information concerning the customer for purposes of responding to a customer's call for emergency services to:

(A)

A public safety answering point as defined in W.S. 16
‑
9
‑
102(a)(vii) for emergency services;

(B)

A provider of emergency medical or emergency dispatch services;

(C)

A public safety, fire service or law enforcement official;

(D)

A freestanding emergency center as defined in W.S. 35
‑
2
‑
901(a)(xxvi);

(E)

An information or database management services provider but only for the purpose of assisting in the delivery of emergency services in response to the customer's emergency.

40
‑
12
‑
805.

Notice; applicability.

(a)

A provider shall provide to each customer and potential customer a clear, conspicuous and nondeceptive notice at the point of sale and on the provider's publicly accessible website of the provider's obligations and the customer's rights under this article.

(b)

The requirements of this article shall apply to providers operating within the state of Wyoming when providing broadband internet access service to customers who are physically located and billed for service received in the state of Wyoming.

40
‑
12
‑
806.

Penalties; enforcement; private action.

(a)

Any person violating the provisions of this article is guilty of a misdemeanor punishable by a fine of not more than one thousand dollars ($1,000.00) for each violation.

(b)

The attorney general shall investigate violations of this article.

(c)

The attorney general or any district attorney may on behalf of the state bring an action:

(i)

For temporary or permanent injunctive or other relief in any court of competent jurisdiction for any violation of this article. The court may, upon entry of final judgment, award restitution when appropriate to any person suffering loss because of a violation of this article if proof of the loss is submitted to the satisfaction of the court;

(ii)

In any court of competent jurisdiction for the penalties authorized under subsection (a) of this section.

(d)

In addition to any other remedies, a person whose rights have been violated under the provisions of this article may bring a civil action to enjoin or restrain any violation of this article and may in the same action seek damages from the person violating this article. A prevailing party in an action brought under this subsection may recover all costs and expenses reasonably associated with the action, including but not limited to reasonable attorney fees.

40
‑
12
‑
807.

Effective date.

This article shall take effect July 1, 2021.

Section 2
.

This act is effective July 1, 2021
.

(END)

1
HB0101