What does Wisconsin's data breach law ask a business to do?

Who does this law apply to?

Wisconsin's consumer protection agency says the law asks most businesses operating in Wisconsin that hold personal information about Wisconsin residents to tell individuals when an unauthorized person has acquired it. State agencies, cities, towns, villages and counties are covered too.

No notice is owed when the acquisition does not create a material risk of identity theft or fraud.

Section 134.98 of the Wisconsin Statutes requires most businesses to notify individuals if an unauthorized person has acquired their personal information. The business must be operating in Wisconsin and maintaining personal information about individuals who reside in Wisconsin.

However, no notice is required if the unauthorized acquisition does not create a material risk of identity theft or fraud, or if the information was acquired in good faith by an employee or agent and is used for a lawful purpose of the entity.

What counts as personal information?

Personal information is a person's name linked to a social security number, a driver's licence or state identification number, a financial account or card number or the code that opens it, a DNA profile or biometric data, where the item is not publicly available and is not encrypted, redacted or otherwise made unreadable.

The law defines personal information to mean an individual's last name and first name or first initial in combination with and linked to any of the following elements, if the element is not publicly available information, and is not encrypted, redacted or altered in a manner that renders the element unreadable:

How fast must people be told?

Notice goes out within a reasonable time, not to exceed 45 days after the entity learns of the unauthorized acquisition.

The notice must be given within a reasonable time, not to exceed 45 days after the entity learns of the unauthorized acquisition.

Who else must be told?

If the personal information of more than 1,000 individuals was acquired at one time, the nationwide consumer reporting agencies must also be told.

In cases where the personal information of more than 1,000 individuals was acquired at one time, the entity from which the information was required must also give notice to all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.