SB164-SSA2,1,5 4895.507 Notice of unauthorized acquisition of personal information.
5(1) Definitions. In this section:

SB164-SSA2,1,76 (a) 1. "Entity" means a person, other than an individual, that does any of the
7following:

SB164-SSA2,1,98 a. Conducts business in this state and maintains personal information in the
9ordinary course of business.

SB164-SSA2,1,1010 b. Stores personal information in this state.

SB164-SSA2,1,1211 c. Maintains for a resident of this state a depository account as defined in s.
12815.18 (2) (e).

SB164-SSA2,2,1

---

1d. Lends money to a resident of this state.

SB164-SSA2,2,22 2. "Entity" includes all of the following:

SB164-SSA2,2,63 a. The state and any office, department, independent agency, authority,
4institution, association, society, or other body in state government created or
5authorized to be created by the constitution or any law, including the legislature and
6the courts.

SB164-SSA2,2,77 b. A city, village, town, or county.

SB164-SSA2,2,98 (am) "Name" means an individual's last name combined with the individual's
9first name or first initial.

SB164-SSA2,2,1110 (b) "Personal information" means any of the information specified in s. 943.201
11(1) (b) 4., 5., 9., 11., 12. a. and c., and 13. if all of the following apply:

SB164-SSA2,2,1312 1. The information is accompanied by the name of the individual to whom the
13information pertains.

SB164-SSA2,2,1414 2. The information is not publicly available.

SB164-SSA2,2,1515 3. The information is not encrypted.

SB164-SSA2,2,1716 (c) "Publicly available information" means any information that an entity
17reasonably believes is one of the following:

SB164-SSA2,2,1818 1. Lawfully made widely available through any media.

SB164-SSA2,2,2119 2. Lawfully made available to the general public from federal, state, or local
20government records or disclosures to the general public that are required to be made
21by federal, state, or local law.

SB164-SSA2,3,3 22(2) Notice required. (a) If an entity whose principal place of business is
23located in this state or an entity that stores personal information in this state knows
24that personal information in the entity's possession has been acquired by a person
25whom the entity has not authorized to acquire the personal information, the entity

---

1shall make reasonable efforts to notify each subject of the personal information. The
2notice shall indicate that the entity knows of the unauthorized acquisition of
3personal information pertaining to the subject of the personal information.

SB164-SSA2,3,104 (b) If an entity whose principal place of business is not located in this state
5knows that personal information pertaining to a resident of this state has been
6acquired by a person whom the entity has not authorized to acquire the personal
7information, the entity shall make reasonable efforts to notify each resident of this
8state who is the subject of the personal information. The notice shall indicate that
9the entity knows of the unauthorized acquisition of personal information pertaining
10to the resident of this state who is the subject of the personal information.

SB164-SSA2,3,1211 (cm) Notwithstanding pars. (a) and (b), an entity is not required to provide
12notice of the acquisition of personal information if any of the following apply:

SB164-SSA2,3,1413 1. The acquisition of personal information does not compromise the security,
14confidentiality, or integrity of personal information in the entity's possession.

SB164-SSA2,3,1615 2. The personal information was acquired in good faith by an employee or agent
16of the entity, if the personal information is used for a lawful purpose of the entity.

SB164-SSA2,3,22 17(3) Timing and manner of notice. (a) Subject to sub. (5), an entity shall provide
18the notice required under sub. (2) within a reasonable time, not to exceed 30 business
19days after the entity learns of the acquisition of personal information. A
20determination as to reasonableness under this paragraph shall include
21consideration of the number of notices that an entity must provide and the methods
22of communication available to the entity.

SB164-SSA2,4,423 (b) An entity shall provide the notice required under sub. (2) by mail or by a
24method the entity has previously employed to communicate with the subject of the
25personal information. If an entity cannot with reasonable diligence determine the

---

1mailing address of the subject of the personal information, and if the entity has not
2previously communicated with the subject of the personal information, the entity
3shall provide notice by a method reasonably calculated to provide actual notice to the
4subject of the personal information.

SB164-SSA2,4,6 5(3m) Regulated entities exempt. This section does not apply to any of the
6following:

SB164-SSA2,4,87 (a) An entity that is a financial institution, or any person under contract with
8such an entity, if either of the following apply:

SB164-SSA2,4,119 1. The entity is subject to, and in compliance with, the interagency guidance
10on response programs for unauthorized access to customer information and
11customer notice as published in the federal register on March 29, 2005.

SB164-SSA2,4,1412 2. The entity is subject to, and in compliance with, the guidance on response
13programs for unauthorized access to member information and member notice as
14published in the federal register on May 2, 2005.

SB164-SSA2,4,1615(b) An entity that is described in 45 CFR 164.104 (a), if the entity complies with
16the requirements of 45 CFR part 164.

SB164-SSA2,4,18 17(4) Effect on civil claims. Failure to comply with this section is not negligence
18or a breach of any duty, but may be evidence of negligence or a breach of a legal duty.

SB164-SSA2,5,2 19(5) Request by law enforcement not to notify. A law enforcement agency
20may, in order to protect an investigation or homeland security, ask an entity not to
21provide a notice that is otherwise required under sub. (2) for any period of time and
22the notification process required under sub. (2) shall begin at the end of that time
23period. Notwithstanding subs. (2) and (3), if an entity receives such a request, the
24entity may not provide notice of or publicize an unauthorized acquisition of personal

---

1information, except as authorized by the law enforcement agency that made the
2request.

SB164-SSA2,5,5 3(6m) Local ordinances or regulations prohibited. No city, village, town, or
4county may enact or enforce an ordinance or regulation that relates to notice or
5disclosure of the unauthorized acquisition of personal information.

SB164-SSA2,5,12 6(7m) Effect of federal legislation. If the joint committee on administrative
7rules determines that the federal government has enacted legislation that imposes
8notice requirements substantially similar to the requirements of this section and
9determines that the legislation does not preempt this section, the joint committee on
10administrative rules shall submit to the revisor of statutes for publication in the
11Wisconsin administrative register a notice of its determination. This section does not
12apply after publication of a notice under this subsection.