What does Wyoming's data breach law ask a business to do?

Who does this law apply to?

The law says an individual or commercial entity that does business in Wyoming and owns or licenses computerized personal identifying information about a Wyoming resident must investigate promptly and in good faith once it learns of a breach.

Notice to the affected Wyoming resident is owed when that investigation finds misuse has occurred or is reasonably likely.

An individual or commercial entity that conducts business in Wyoming and that owns or licenses computerized data that includes personal identifying information about a resident of Wyoming shall, when it becomes aware of a breach of the security of the system, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal identifying information has been or will be misused.

If the investigation determines that the misuse of personal identifying information about a Wyoming resident has occurred or is reasonably likely to occur, the individual or the commercial entity shall give notice as soon as possible to the affected Wyoming resident.

What counts as personal information?

Personal identifying information is a person's name together with one or more data elements listed in another section of Wyoming law, Section 6-3-901(b), where those elements are not redacted. The list includes items such as a social security number, a driver's licence number, account and card numbers with access codes, government identification cards, medical and health insurance information, biometric data and a taxpayer identification number.

A username or email address together with a password or security question and answer that opens an online account is on that list too.

"Personal identifying information" means the first name or first initial and last name of a person in combination with one (1) or more of the data elements specified in W.S. 6-3-901(b)(iii) through (xiv), when the data elements are not redacted.

A username or email address, in combination with a password or security question and answer that would permit access to an online account;

How fast must people be told?

The text sets no fixed number of days. It says notice goes out as soon as possible, in the most expedient time possible and without unreasonable delay, allowing for law enforcement, finding the scope of the breach and restoring the system.

Notice shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system.

Who else must be told?

The text we read names no one else.

What if a vendor holds the data?

A person who holds personal identifying information on behalf of another business must tell that business of a breach as soon as practicable. The two may agree which of them sends the notice to residents.

Any person who maintains computerized data that includes personal identifying information on behalf of another business entity shall disclose to the business entity for which the information is maintained any breach of the security of the system as soon as practicable following the determination that personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.