SF0065

Failed

Data privacy-government entities.

Require Wyoming government entities to adopt policies governing collection, access, security, and use of personal data.

Full legal title

AN ACT relating to the administration of the government; requiring government entities to adopt policies for the collection, access, security and use of personal data as specified; requiring specific personal data policies; providing definitions; specifying applicability; and providing for effective dates.

Government

Sponsor:

View on wyoleg.gov Introduced Text (PDF)Digest (PDF)Engrossed (PDF)Fiscal Note (PDF)

What does this bill do?

Requires government entities to adopt policies for collecting, accessing, securing, and using personal data, and establishes restrictions on the purchase, sale, and transfer of personal data.

Defines key terms including 'deidentified data,' 'government entity' (excluding judicial branch and law enforcement agencies), 'identified or identifiable natural person,' 'personal data,' and 'personal digital identity.' (W.S. 9-21-201)
Prohibits government entities from purchasing, selling, trading, or transferring personal data without express written consent, with exceptions for transfers between government entities, case-by-case petitions to elected governing bodies (approved for up to two years), and data covered by HIPAA or FERPA. (W.S. 9-21-202(a))
Grants Wyoming residents the right to request a copy of their personal data from any government entity, with fees allowed consistent with the Wyoming Public Records Act. (W.S. 9-21-202(b))
Establishes a process allowing residents to object to the accuracy, completeness, timeliness, and other aspects of their personal data, requiring government entities to investigate within 60 days and either correct the data or allow the resident to file a statement of disagreement. (W.S. 9-21-202(c))
Requires each government entity that collects or retains personal data to adopt and maintain a policy regarding collection, access, retention, security, and use of personal data consistent with federal and state laws. (W.S. 9-21-203(a))
Limits government entities to collecting and maintaining only the personal data reasonably necessary for lawful functions, with all data collected tied to specific pre-defined purposes. (W.S. 9-21-203(b))
Prohibits government entities from retaining personal data longer than three years without a written policy justifying the extended retention period, with statutory retention requirements under W.S. 9-2-405 through 9-2-413 qualifying as reasonable justification. (W.S. 9-21-203(c))
Directs the state chief information officer and state archivist to develop sample policies for use by state agencies, counties, cities, towns, and other political subdivisions by January 1, 2026.