Wyoming 2025 Regular Session

Wyoming Senate Bill SF0065 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New		Differences
1	1		2025
2	2		STATE OF WYOMING
3		-	25LSO-0088
4		-	ENGROSSED
5		-	1SF0065
	3	+	25LSO-00881SF0065
6	4		SENATE FILE NO. SF0065
7	5		Data privacy-government entities.
8	6		Sponsored by: Select Committee on Blockchain, Financial
9	7		Technology and Digital Innovation Technology
10	8		A BILL
11	9		for
12	10		1 AN ACT relating to the administration of the government;
13	11		2 requiring government entities to adopt policies for the
14	12		3 collection, access, security and use of personal data as
15	13		4 specified; requiring specific personal data policies;
16	14		5 providing definitions; specifying applicability; and
17	15		6 providing for effective dates.
18	16		7
19	17		8
20	18		9
21	19		10. W.S. 9-21-201 and 9-21-202 are created to
22	20		11 read:
23	21		12
24	22		13 ARTICLE 2
25	23		14 DATA PRIVACY-GOVERNMENT ENTITIES
26		-	15 2025STATE OF WYOMING25LSO-0088
27		-	ENGROSSED
28		-	2SF00651
	24	+	15 2025STATE OF WYOMING25LSO-00882SF00651
29	25		2
30	26		3 (a) As used in this article:
31	27		4
32	28		5 (i) "Deidentified data" means data that cannot
33	29		6 reasonably be used to infer information about, or otherwise
34	30		7 be linked to, an identified or identifiable natural person
35	31		8 or personal digital identity or a device linked to a
36	32		9 natural person or personal digital identity, if the
37	33		10 government entity that possesses the data takes reasonable
38	34		11 measures to ensure the data cannot be associated with a
39	35		12 natural person or personal digital identity;
40	36		13
41	37		14 (ii) "Government entity" means the state and all
42	38		15 its political subdivisions, agencies, instrumentalities and
43	39		16 institutions and any local government entity. "Government
44	40		17 entity" shall not include the judicial branch of government
45	41		18 or any law enforcement agency in Wyoming;
46	42		19
47	43		20 (iii) "Identified or identifiable natural
48	44		21 person" means a natural person who can be readily
49		-	22 identified, directly or indirectly, by reference to an 2025STATE OF WYOMING25LSO-0088
50		-	ENGROSSED
51		-	3SF0065
	45	+	22 identified, directly or indirectly, by reference to an 2025STATE OF WYOMING25LSO-00883SF0065
52	46		1 identifier such as a name, an identification number,
53	47		2 specific geolocation data or an online identifier;
54	48		3
55	49		4 (iv) "Law enforcement agency" means a county,
56	50		5 municipal, college or university police force, Wyoming
57	51		6 highway patrol, the division of criminal investigation, the
58	52		7 department of corrections or any state or local agency or
59	53		8 political subdivision or part of an agency or political
60	54		9 subdivision to the extent that the primary purpose of the
61	55		10 agency or political subdivision, or part thereof, is the
62	56		11 prevention or investigation of crime or the enforcement of
63	57		12 penal, traffic, regulatory or criminal laws. "Law
64	58		13 enforcement agency" shall not include the office of any
65	59		14 city, county or district attorney or other division of the
66	60		15 attorney general;
67	61		16
68	62		17 (v) "Personal data" means information that is
69	63		18 linked or reasonably linkable to an identified or
70	64		19 identifiable natural person or personal digital identity
71	65		20 and does not include deidentified data;
72	66		21
73	67		22 (vi) "Personal digital identity" means as
74		-	23 defined in W.S. 8-1-102(a)(xviii). 2025STATE OF WYOMING25LSO-0088
75		-	ENGROSSED
76		-	4SF00651
	68	+	23 defined in W.S. 8-1-102(a)(xviii). 2025STATE OF WYOMING25LSO-00884SF00651
77	69		2
78	70		3
79	71		4
80	72		5 (a) No government entity shall purchase, sell, trade
81	73		6 or transfer personal data without the express written
82	74		7 consent of the natural person except as otherwise expressly
83	75		8 provided by law and except that:
84	76		9
85	77		10 (i) A government entity may transfer personal
86	78		11 data to another government entity provided that the other
87	79		12 government entity complies with this article;
88	80		13
89		-	14 (ii) A government entity may transfer personal
90		-	15 data to nongovernment entity contracted by the government
91		-	16 entity to provide or assist with government services
92		-	17 provided by the government entity. Any contract for
93		-	18 services with a nongovernment entity shall include
94		-	19 requirements for the protection of personal data consistent
95		-	20 with this article. Any personal data transferred pursuant
96		-	21 to this paragraph shall be returned or destroyed by the
97		-	22 nongovernment entity once the personal data is no longer
98		-	23 necessary for the provision of the government service. No 2025STATE OF WYOMING25LSO-0088
99		-	ENGROSSED
100		-	5SF0065
101		-	1 nongovernment entity shall maintain, sell, transfer,
102		-	2 process or otherwise use the personal data in any manner
103		-	3 except as necessary to provide the contracted service;
	81	+	14 (ii) A government entity may petition the
	82	+	15 elected governing person or body with direct authority over
	83	+	16 the government entity for an exception to this subsection
	84	+	17 on a case by case basis. The elected governing person or
	85	+	18 body, in the elected governing person's or body's
	86	+	19 discretion, may publicly approve in writing an exception to
	87	+	20 this subsection not to exceed a term of two (2) years per
	88	+	21 petition; and
	89	+	22 2025STATE OF WYOMING25LSO-00885SF00651 (iii) Nothing in this subsection shall be
	90	+	2 construed to prohibit the transfer of personal data that is
	91	+	3 otherwise compliant with the Health Insurance Portability
	92	+	4 and Accountability Act or the Family Education Rights and
	93	+	5 Privacy Act.
	94	+	6
	95	+	7 (b) Any Wyoming resident may request a copy of their
	96	+	8 personal data from any government entity maintaining it.
	97	+	9 The government entity may charge a fee for production of
	98	+	10 the requested personal data consistent with fees authorized
	99	+	11 to be charged under the Wyoming Public Records Act, W.S.
	100	+	12 16-4-201 through 16-4-205.
	101	+	13
	102	+	14 (c) A Wyoming resident who objects to the accuracy,
	103	+	15 completeness, pertinence, timeliness, relevance, retention,
	104	+	16 dissemination or denial of access to the resident's own
	105	+	17 personal data that is maintained by a government entity
	106	+	18 may, individually or through a duly authorized
	107	+	19 representative, file an objection with the government
	108	+	20 entity that maintains the data. The government entity
	109	+	21 maintaining the personal data shall, within sixty (60) days
	110	+	22 of the receipt of an objection:
	111	+	23 2025STATE OF WYOMING25LSO-00886SF00651 (i) Investigate the validity of the objection;
	112	+	2
	113	+	3 (ii) If the objection is found to be meritorious
	114	+	4 after investigation, alter the contents of, or the methods
	115	+	5 for holding, or the dissemination or use of the personal
	116	+	6 data, or delete or grant access to it;
	117	+	7
	118	+	8 (iii) If the objection is found to lack merit
	119	+	9 after investigation, provide the resident the opportunity
	120	+	10 to have a statement reflecting the resident's views
	121	+	11 maintained and disseminated with the personal data in
	122	+	12 question;
	123	+	13
	124	+	14 (iv) Notify the resident in writing of any
	125	+	15 decision regarding the resident's objection.
	126	+	16
	127	+	17 (d) To the extent that a provision of this article
	128	+	18 conflicts with another provision of state or federal law,
	129	+	19 the other provision shall control.
	130	+	20
	131	+	21W.S. 9-21-203 is created to read:
	132	+	22 2025STATE OF WYOMING25LSO-00887SF00651
	133	+	2
	134	+	3
	135	+	4 (a) In addition to the policies required under W.S.
	136	+	5 9-21-101, if applicable, each government entity that
	137	+	6 collects or retains personal data shall adopt, enforce and
	138	+	7 maintain a policy regarding the collection, access,
	139	+	8 retention, security and use of personal data consistent
	140	+	9 with all applicable federal and state laws, including this
	141	+	10 article.
	142	+	11
	143	+	12 (b) No government entity shall collect or maintain
	144	+	13 more personal data than is reasonably necessary for the
	145	+	14 performance of the government entity's lawful functions.
	146	+	15 All personal data collected and maintained by government
	147	+	16 entities shall be necessary for a specific pre-defined
	148	+	17 purpose.
	149	+	18
	150	+	19 (c) No government entity shall maintain personal data
	151	+	20 for longer than three (3) years without an express written
	152	+	21 policy identifying the extended retention period and
	153	+	22 providing a reasonable justification for the extended
	154	+	23 retention period. Statutory retention requirements provided 2025STATE OF WYOMING25LSO-00888SF0065
	155	+	1 for in W.S. 9-2-405 through 9-2-413 constitute a reasonable
	156	+	2 justification.
	157	+	3
104	158		4
105		-	5 (iii) A government entity may petition the
106		-	6 elected governing person or body with direct authority over
107		-	7 the government entity for an exception to this subsection
108		-	8 on a case by case basis. The elected governing person or
109		-	9 body, in the elected governing person's or body's
110		-	10 discretion, may publicly approve in writing an exception to
111		-	11 this subsection not to exceed a term of two (2) years per
112		-	12 petition; and
113		-	13
114		-	14 (iv) Nothing in this subsection shall be
115		-	15 construed to prohibit the transfer of personal data in a
116		-	16 manner that is otherwise compliant with the Health
117		-	17 Insurance Portability and Accountability Act or the Family
118		-	18 Education Rights and Privacy Act.
119		-	19
120		-	20 (b) Any Wyoming resident may request a copy of their
121		-	21 personal data from any government entity maintaining it.
122		-	22 The government entity may charge a fee for production of
123		-	23 the requested personal data consistent with fees authorized 2025STATE OF WYOMING25LSO-0088
124		-	ENGROSSED
125		-	6SF0065
126		-	1 to be charged under the Wyoming Public Records Act, W.S.
127		-	2 16-4-201 through 16-4-205.
128		-	3
129		-	4 (c) A Wyoming resident who objects to the accuracy,
130		-	5 completeness, pertinence, timeliness, relevance, retention,
131		-	6 dissemination or denial of access to the resident's own
132		-	7 personal data that is maintained by a government entity
133		-	8 may, individually or through a duly authorized
134		-	9 representative, file an objection with the government
135		-	10 entity that maintains the data. The government entity
136		-	11 maintaining the personal data shall, within sixty (60) days
137		-	12 of the receipt of an objection:
138		-	13
139		-	14 (i) Investigate the validity of the objection;
140		-	15
141		-	16 (ii) If the objection is found to be meritorious
142		-	17 after investigation, alter the contents of, or the methods
143		-	18 for holding, or the dissemination or use of the personal
144		-	19 data, or delete or grant access to it;
145		-	20
146		-	21 (iii) If the objection is found to lack merit
147		-	22 after investigation, provide the resident the opportunity
148		-	23 to have a statement reflecting the resident's views 2025STATE OF WYOMING25LSO-0088
149		-	ENGROSSED
150		-	7SF0065
151		-	1 maintained and disseminated with the personal data in
152		-	2 question;
153		-	3
154		-	4 (iv) Notify the resident in writing of any
155		-	5 decision regarding the resident's objection.
156		-	6
157		-	7 (d) To the extent that a provision of this article
158		-	8 conflicts with another provision of state or federal law,
159		-	9 the other provision shall control.
160		-	10
161		-	11W.S. 9-21-203 is created to read:
162		-	12
163		-	13
164		-	14
165		-	15
166		-	16 (a) In addition to the policies required under W.S.
167		-	17 9-21-101, if applicable, each government entity that
168		-	18 collects or retains personal data shall adopt, enforce and
169		-	19 maintain a policy regarding the collection, access,
170		-	20 retention, security and use of personal data consistent
171		-	21 with all applicable federal and state laws, including this
172		-	22 article.
173		-	23 2025STATE OF WYOMING25LSO-0088
174		-	ENGROSSED
175		-	8SF00651 (b) No government entity shall collect or maintain
176		-	2 more personal data than is reasonably necessary for the
177		-	3 performance of the government entity's lawful functions.
178		-	4 All personal data collected and maintained by government
179		-	5 entities shall be necessary for a specific pre-defined
180		-	6 purpose.
181		-	7
182		-	8 (c) No government entity shall maintain personal data
183		-	9 for longer than three (3) years without an express written
184		-	10 policy identifying the extended retention period and
185		-	11 providing a reasonable justification for the extended
186		-	12 retention period. Statutory retention requirements provided
187		-	13 for in W.S. 9-2-405 through 9-2-413 constitute a reasonable
188		-	14 justification.
189		-	15
190		-	16 (d) A government entity to which the Health Insurance
191		-	17 Portability and Accountability Act or the Family Education
192		-	18 Rights and Privacy Act applies that is compliant with a
193		-	19 written data collection and retention policy that meets the
194		-	20 requirements of the Health Insurance Portability and
195		-	21 Accountability Act or the Family Education Rights and
196		-	22 Privacy Act shall be deemed compliant with this section.
197		-	23 2025STATE OF WYOMING25LSO-0088
198		-	ENGROSSED
199		-	9SF00651
200		-	2 chief information officer in consultation with the state
201		-	3 archivist shall develop sample policies for use by state
202		-	4 agencies, counties, cities, towns and other political
203		-	5 subdivisions consistent with the requirements of this act.
204		-	6
205		-	7. W.S. 9-2-203 as created by section 2 of
206		-	8 this act shall be effective as to counties, cities or towns
207		-	9 on July 1, 2027 and as to each political subdivision of the
208		-	10 state other than state agencies, counties, cities or towns
209		-	11 on July 1, 2028. All state agencies, counties, cities,
210		-	12 towns and other political subdivisions shall adopt any
211		-	13 necessary policies and procedures to meet the requirements
212		-	14 of this act.
213		-	15 2025STATE OF WYOMING25LSO-0088
214		-	ENGROSSED
215		-	10SF00651.
	159	+	5 chief information officer in consultation with the state
	160	+	6 archivist shall develop sample policies for use by state
	161	+	7 agencies, counties, cities, towns and other political
	162	+	8 subdivisions consistent with the requirements of this act.
	163	+	9
	164	+	10. W.S. 9-2-203 as created by section 2 of
	165	+	11 this act shall be effective as to counties, cities or towns
	166	+	12 on July 1, 2027 and as to each political subdivision of the
	167	+	13 state other than state agencies, counties, cities or towns
	168	+	14 on July 1, 2028. All state agencies, counties, cities,
	169	+	15 towns and other political subdivisions shall adopt any
	170	+	16 necessary policies and procedures to meet the requirements
	171	+	17 of this act.
	172	+	18 2025STATE OF WYOMING25LSO-00889SF00651.
216	173		2
217	174		3 (a) Section 2 of this act is effective July 1, 2026.
218	175		4
219	176		5 (b) Sections 1, 3, 4 and 5 of this act are effective
220	177		6 immediately upon completion of all acts necessary for a
221	178		7 bill to become law as provided by Article 4, Section 8 of
222	179		8 the Wyoming Constitution.
223	180		9
224	181		10 (END)