SF0020

Requires Wyoming government entities to adopt policies for the collection, access, security, and use of personal data, and restricts their ability to purchase, sell, trade, or transfer personal data without consent.

• Defines key terms including deidentified data, government entity (excluding judicial branch and law enforcement), identified or identifiable natural person, personal data, and personal digital identity. (W.S. 9-21-201, Sec. 1)
• Prohibits government entities from purchasing, selling, trading, or transferring personal data without express written consent, with exceptions for transfers between government entities complying with the article, transfers to contracted nongovernment entities providing government services, and case-by-case exceptions approved by the elected governing body. (W.S. 9-21-202(a), Sec. 1)
• Allows current or former Wyoming residents or their authorized representatives to request copies of their personal data from government entities, with fees charged consistent with Wyoming Public Records Act provisions. (W.S. 9-21-202(b), Sec. 1)
• Establishes a process for residents to object to accuracy, completeness, timeliness, or dissemination of their personal data, requiring government entities to investigate within 60 days and either correct the data, delete it, grant access, or allow the resident to file a statement of disagreement. (W.S. 9-21-202(c), Sec. 1)
• Requires each government entity collecting or retaining personal data to adopt and maintain a policy regarding collection, access, retention, security, and use of personal data consistent with federal and state law. (W.S. 9-21-203(a), Sec. 2)
• Prohibits government entities from collecting or maintaining more personal data than reasonably necessary for lawful functions, and requires all collected data to serve a specific identified purpose. (W.S. 9-21-203(b), Sec. 2)
• Requires government entities to maintain personal data for no longer than three years without a written policy identifying the extended retention period and providing reasonable justification, except for statutory retention requirements. (W.S. 9-21-203(c), Sec. 2)