Read the full stored bill text
24LSO-0107
2024
STATE OF WYOMING
24LSO-0107
Numbered
2.0
HOUSE BILL NO. HB0163
Data privacy-government entities.
Sponsored by: Select Committee on Blockchain, Financial Technology and Digital Innovation Technology
A BILL
for
AN ACT relating to the administration of government; requiring government entities to adopt policies for the collection, access, security and use of personal data as specified; requiring specific personal data policies; providing definitions; and providing for effective dates.
Be It Enacted by the Legislature of the State of Wyoming:
Section 1
.
W.S. 9
‑
21
‑
201 and 9
‑
21
‑
202 are created to read:
ARTICLE 2
DATA PRIVACY
‑
GOVERNMENT ENTITIES
9
‑
21
‑
201.
Definitions.
(a)
As used in this article:
(i)
"Deidentified data" means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable natural person or personal digital identity, or a device linked to a natural person or personal digital identity, if the government entity that possesses the data takes reasonable measures to ensure the data cannot be associated with a natural person or personal digital identity;
(ii)
"Government entity" means the state and all its political subdivisions, agencies, instrumentalities and institutions and any local government entity.
"Government entity" shall not include the judicial branch of government or any law enforcement agency in Wyoming;
(iii)
"Identified or identifiable natural person" means a natural person who can be readily identified, directly or indirectly, by reference to an identifier such as a name, an identification number, specific geolocation data or an online identifier;
(iv)
"Law enforcement agency" means a county, municipal, college or university police force, Wyoming highway patrol, the division of criminal investigation, the department of corrections or any state or local agency or political subdivision or part of an agency or political subdivision to the extent that the primary purpose of the agency or political subdivision, or part thereof, is the prevention or investigation of crime and the enforcement of penal, traffic, regulatory or criminal laws. "Law enforcement agency" shall not include the office of any city, county or district attorney or other division of the attorney general;
(v)
"Personal data" means information that is linked or reasonably linkable to an identified or identifiable natural person or personal digital identity and does not include deidentified data or publicly available information. As used in this paragraph, "publicly available information" means information that is lawfully made available from federal, state or local government records;
(vi)
"Personal digital identity" means as defined in W.S. 8
‑
1
‑
102(a)(xviii).
9
‑
21
‑
202.
Limitations on personal data by government entities; conflict of laws.
(a)
No government entity shall purchase, sell, trade or transfer personal data without the express written consent of the natural person except as otherwise expressly provided by law and except that a government entity may transfer personal data to another government entity provided that the other government entity complies with this article.
(b)
Any Wyoming resident may request a copy of their personal data from any government entity maintaining it.
The government entity may charge a fee for production of the requested personal data consistent with fees authorized to be charged under the Public Records Act.
(c)
A Wyoming resident who objects to the accuracy, completeness, pertinence, timeliness, relevance, retention, dissemination or denial of access to the resident's own personal data that is maintained by a government entity may, individually or through a duly authorized representative, file an objection with the government entity that maintains the data. The government entity maintaining the personal data shall, within thirty (30) days of the receipt of an objection:
(i)
Investigate the validity of the objection;
(ii)
If the objection is found to be meritorious after investigation, alter the contents of, or the methods for holding, or the dissemination or use of the personal data, or delete or grant access to it;
(iii)
If the objection is found to lack merit after investigation, provide the resident the opportunity to have a statement reflecting the resident's views maintained and disseminated with the data in question;
(iv)
Notify the resident in writing of any decision regarding the resident's objection.
(d)
To the extent that a provision of this article conflicts with another provision of state or federal law, the other provision shall control.
Section 2.
W.S. 9-21-203 is created to read:
9
‑
21
‑
203.
Personal data collection and retention by government entities.
(a)
In addition to the policies required under W.S. 9-21-101, if applicable, each government entity that collects or retains personal data shall adopt, enforce and maintain a policy regarding the collection, access, retention, security and use of personal data consistent with all applicable federal and state laws, including this article.
(b)
No government entity shall collect or maintain more personal data than is reasonably necessary for the performance of the government entity's lawful functions. All personal data collected and maintained by government entities shall be necessary for a specific pre
‑
defined purpose.
(c)
No government entity shall maintain personal data for longer than three (3) years without an express written policy identifying the extended retention period and providing a reasonable justification for the extended retention period.
Section 3.
Not later than January 1, 2025, the state chief information officer shall develop sample policies for use by state agencies, counties, cities, towns and other political subdivisions consistent with the requirements of this act.
Section 4.
Not later than July 1, 2025 each state agency shall adopt any necessary policies and procedures to meet the requirements of this act.
Section 5.
Not later than July 1, 2026 each county, city or town shall adopt any necessary policies and procedures to meet the requirements of this act.
Section 6.
Not later than July 1, 2027 each political subdivision of the state other than state agencies, counties, cities or towns, shall adopt any necessary policies and procedures to meet the requirements of this act.
Section 7
.
(a)
Section 2 of this act is effective July 1, 2025
.
(b)
Sections 1 and 3 through 7 of this act are effective immediately upon completion of all acts necessary for a bill to become law as provided by Article 4, Section 8 of the Wyoming Constitution.
(END)
1
HB0163