Wisconsin Assembly Passes Data Privacy Bill

On February 23, 2022, the Wisconsin Assembly passed Assembly Bill 957 (“AB957” or the “Bill”), which establishes requirements for controllers and processors who collect, maintain, or utilize consumer “personal data.”   

Provisions of the Bill

Under the Bill, personal data is defined as that information, which is reasonably linkable to a specific individual, which is not publicly available.

AB 957 defines a "controller" as a person who “alone or jointly with others, determines the purpose and means of processing personal data.”  The bill applies to controllers who:

• control or process the personal data of 100,000 consumers or more; or

• control or process the personal data of 25,000 consumers or more and derive more than 50% of their gross revenue from the sale of that data to third parties.

The primary consumer rights outlined under the Bill are as follows:

• to confirm whether a controller is processing the consumer's personal data;

• to access the consumer's personal data that is being collected by the controller;

• to correct or modify any inaccuracies in the consumer’s personal data;

• to request that a controller delete any of the consumer's  personal data improperly retained; and

• to opt-out of the controller’s processing of the personal data for the purposes of targeted advertisement, the sale of their data to third parties, as well as some automated data processing.

Additionally, the Bill requires controllers to enter and maintain contracts with third party data processors that mandate the third-party to manage consumer’s personal data in the same manner. If a controller declines to take action on a consumer's request, the controller is required to inform the consumer of its justification without undue delay.

Enforcement of the Bill

Under the bill, enforcement actions can be initiated exclusively by the Wisconsin Attorney General (“AG”). Prior to exercising its enforcement power, the AG is required to give the controller or processor written notice of an alleged violating action and provide such party 30 days to cure the alleged violation. If the party fails to cure the alleged violation during cure period, the AG may file suit and seek penalties of $7,500 per violation. There is no private right of action under the Bill. 

The Bill must still be approved by the Wisconsin senate prior to its enactment. Organizations who would be subject to this Bill should continue to monitor the Bill's progress. If enacted, the Bill would take effect on January 1, 2024.