2025
STATE OF WYOMING
25LSO-0088
ENGROSSED
1SF0065
SENATE FILE NO. SF0065
Data privacy-government entities.
Sponsored by: Select Committee on Blockchain, Financial
Technology and Digital Innovation Technology
A BILL
for
1 AN ACT relating to the administration of the government;
2 requiring government entities to adopt policies for the
3 collection, access, security and use of personal data as
4 specified; requiring specific personal data policies;
5 providing definitions; specifying applicability; and
6 providing for effective dates.
7
8
9
10. W.S. 9-21-201 and 9-21-202 are created to
11 read:
12
13 ARTICLE 2
14 DATA PRIVACY-GOVERNMENT ENTITIES
15 2025STATE OF WYOMING25LSO-0088
ENGROSSED
2SF00651
2
3 (a) As used in this article:
4
5 (i) "Deidentified data" means data that cannot
6 reasonably be used to infer information about, or otherwise
7 be linked to, an identified or identifiable natural person
8 or personal digital identity or a device linked to a
9 natural person or personal digital identity, if the
10 government entity that possesses the data takes reasonable
11 measures to ensure the data cannot be associated with a
12 natural person or personal digital identity;
13
14 (ii) "Government entity" means the state and all
15 its political subdivisions, agencies, instrumentalities and
16 institutions and any local government entity. "Government
17 entity" shall not include the judicial branch of government
18 or any law enforcement agency in Wyoming;
19
20 (iii) "Identified or identifiable natural
21 person" means a natural person who can be readily
22 identified, directly or indirectly, by reference to an 2025STATE OF WYOMING25LSO-0088
ENGROSSED
3SF0065
1 identifier such as a name, an identification number,
2 specific geolocation data or an online identifier;
3
4 (iv) "Law enforcement agency" means a county,
5 municipal, college or university police force, Wyoming
6 highway patrol, the division of criminal investigation, the
7 department of corrections or any state or local agency or
8 political subdivision or part of an agency or political
9 subdivision to the extent that the primary purpose of the
10 agency or political subdivision, or part thereof, is the
11 prevention or investigation of crime or the enforcement of
12 penal, traffic, regulatory or criminal laws. "Law
13 enforcement agency" shall not include the office of any
14 city, county or district attorney or other division of the
15 attorney general;
16
17 (v) "Personal data" means information that is
18 linked or reasonably linkable to an identified or
19 identifiable natural person or personal digital identity
20 and does not include deidentified data;
21
22 (vi) "Personal digital identity" means as
23 defined in W.S. 8-1-102(a)(xviii). 2025STATE OF WYOMING25LSO-0088
ENGROSSED
4SF00651
2
3
4
5 (a) No government entity shall purchase, sell, trade
6 or transfer personal data without the express written
7 consent of the natural person except as otherwise expressly
8 provided by law and except that:
9
10 (i) A government entity may transfer personal
11 data to another government entity provided that the other
12 government entity complies with this article;
13
14 (ii) A government entity may transfer personal
15 data to nongovernment entity contracted by the government
16 entity to provide or assist with government services
17 provided by the government entity. Any contract for
18 services with a nongovernment entity shall include
19 requirements for the protection of personal data consistent
20 with this article. Any personal data transferred pursuant
21 to this paragraph shall be returned or destroyed by the
22 nongovernment entity once the personal data is no longer
23 necessary for the provision of the government service. No 2025STATE OF WYOMING25LSO-0088
ENGROSSED
5SF0065
1 nongovernment entity shall maintain, sell, transfer,
2 process or otherwise use the personal data in any manner
3 except as necessary to provide the contracted service;
4
5 (iii) A government entity may petition the
6 elected governing person or body with direct authority over
7 the government entity for an exception to this subsection
8 on a case by case basis. The elected governing person or
9 body, in the elected governing person's or body's
10 discretion, may publicly approve in writing an exception to
11 this subsection not to exceed a term of two (2) years per
12 petition; and
13
14 (iv) Nothing in this subsection shall be
15 construed to prohibit the transfer of personal data in a
16 manner that is otherwise compliant with the Health
17 Insurance Portability and Accountability Act or the Family
18 Education Rights and Privacy Act.
19
20 (b) Any Wyoming resident may request a copy of their
21 personal data from any government entity maintaining it.
22 The government entity may charge a fee for production of
23 the requested personal data consistent with fees authorized 2025STATE OF WYOMING25LSO-0088
ENGROSSED
6SF0065
1 to be charged under the Wyoming Public Records Act, W.S.
2 16-4-201 through 16-4-205.
3
4 (c) A Wyoming resident who objects to the accuracy,
5 completeness, pertinence, timeliness, relevance, retention,
6 dissemination or denial of access to the resident's own
7 personal data that is maintained by a government entity
8 may, individually or through a duly authorized
9 representative, file an objection with the government
10 entity that maintains the data. The government entity
11 maintaining the personal data shall, within sixty (60) days
12 of the receipt of an objection:
13
14 (i) Investigate the validity of the objection;
15
16 (ii) If the objection is found to be meritorious
17 after investigation, alter the contents of, or the methods
18 for holding, or the dissemination or use of the personal
19 data, or delete or grant access to it;
20
21 (iii) If the objection is found to lack merit
22 after investigation, provide the resident the opportunity
23 to have a statement reflecting the resident's views 2025STATE OF WYOMING25LSO-0088
ENGROSSED
7SF0065
1 maintained and disseminated with the personal data in
2 question;
3
4 (iv) Notify the resident in writing of any
5 decision regarding the resident's objection.
6
7 (d) To the extent that a provision of this article
8 conflicts with another provision of state or federal law,
9 the other provision shall control.
10
11W.S. 9-21-203 is created to read:
12
13
14
15
16 (a) In addition to the policies required under W.S.
17 9-21-101, if applicable, each government entity that
18 collects or retains personal data shall adopt, enforce and
19 maintain a policy regarding the collection, access,
20 retention, security and use of personal data consistent
21 with all applicable federal and state laws, including this
22 article.
23 2025STATE OF WYOMING25LSO-0088
ENGROSSED
8SF00651 (b) No government entity shall collect or maintain
2 more personal data than is reasonably necessary for the
3 performance of the government entity's lawful functions.
4 All personal data collected and maintained by government
5 entities shall be necessary for a specific pre-defined
6 purpose.
7
8 (c) No government entity shall maintain personal data
9 for longer than three (3) years without an express written
10 policy identifying the extended retention period and
11 providing a reasonable justification for the extended
12 retention period. Statutory retention requirements provided
13 for in W.S. 9-2-405 through 9-2-413 constitute a reasonable
14 justification.
15
16 (d) A government entity to which the Health Insurance
17 Portability and Accountability Act or the Family Education
18 Rights and Privacy Act applies that is compliant with a
19 written data collection and retention policy that meets the
20 requirements of the Health Insurance Portability and
21 Accountability Act or the Family Education Rights and
22 Privacy Act shall be deemed compliant with this section.
23 2025STATE OF WYOMING25LSO-0088
ENGROSSED
9SF00651
2 chief information officer in consultation with the state
3 archivist shall develop sample policies for use by state
4 agencies, counties, cities, towns and other political
5 subdivisions consistent with the requirements of this act.
6
7. W.S. 9-2-203 as created by section 2 of
8 this act shall be effective as to counties, cities or towns
9 on July 1, 2027 and as to each political subdivision of the
10 state other than state agencies, counties, cities or towns
11 on July 1, 2028. All state agencies, counties, cities,
12 towns and other political subdivisions shall adopt any
13 necessary policies and procedures to meet the requirements
14 of this act.
15 2025STATE OF WYOMING25LSO-0088
ENGROSSED
10SF00651.
2
3 (a) Section 2 of this act is effective July 1, 2026.
4
5 (b) Sections 1, 3, 4 and 5 of this act are effective
6 immediately upon completion of all acts necessary for a
7 bill to become law as provided by Article 4, Section 8 of
8 the Wyoming Constitution.
9
10 (END)