SB 851

Generally, this bill establishes requirements for businesses related to personal

information collected about consumers. The bill's requirements apply to

“businesses,” which is defined in the bill to mean a sole proprietorship, limited

liability company, corporation, association, or other entity operated for profit that

satisfies all of the following: 1) collects consumers' personal information or alone or

jointly with others determines the purposes and means of the processing of personal

information; 2) does business in this state; and 3) either has annual gross revenues

exceeding $25,000,000; buys, receives, sells, or shares the personal information of

50,000 or more consumers annually; or derives 50 percent or more of its annual

revenues from selling consumers' personal information. The bill defines “

personal

information” as information that identifies, relates to, describes, or is capable of

being associated or linked with a particular consumer or household other than

certain information that is lawfully made available from federal, state, or local

government records.

The bill requires a business to disclose certain information to consumers if the

business has an online privacy policy or a Wisconsin-specific description of

consumers' privacy rights, including the following: 1) information about how a

consumer can make a request for a copy of the personal information collected about

the consumer; 2) the categories of personal information collected by the business in

the past twelve months; 3) the categories of sources from which the business collected

personal information in the past twelve months; 4) the business's purposes for

collecting consumers' personal information; and 5) if the business sells consumers'

personal information, the purpose for selling the personal information. If the

business has an Internet site but not an online privacy policy or a Wisconsin-specific

description of consumers' privacy rights, the business must disclose the above

information on the Internet site.

Under the bill, a consumer may request a business to disclose certain

information if the business collects personal information about the consumer,

including the following: 1) the categories of personal information about the

consumer collected by the business in the past twelve months; 2) the categories of

sources from which the business collected personal information about the consumer

in the past twelve months; 3) the purposes for collecting the personal information

about the consumer; 4) if the business has sold the consumer's personal information

in the past twelve months, the purpose for selling the personal information; and 5)

the specific pieces of personal information about the consumer that the business

collected in the past twelve months. In addition, the business must deliver this

information within 45 days or within 90 days if the longer duration is reasonably

necessary and the business notifies the consumer about the delay within 45 days.

The business must disclose the information in a portable and readily useable format.