Bill > SF0020

This bill requires government entities in Wyoming, excluding the judicial branch and law enforcement agencies, to adopt policies for the collection, access, security, and use of personal data, which is defined as information linked to an identifiable person or digital identity. Government entities are prohibited from buying, selling, trading, or transferring personal data without explicit written consent, with exceptions for transfers between government entities, to contractors providing government services (who must protect the data and destroy it when no longer needed), or for specific approved exceptions not exceeding two years. The bill also allows Wyoming residents to request copies of their personal data and object to its accuracy, completeness, or handling, requiring government entities to respond within sixty days. Furthermore, government entities must not collect or retain more personal data than is reasonably necessary for their lawful functions, and personal data generally cannot be kept for more than three years without a written policy justifying the extended retention. The state chief information officer will develop sample policies by January 1, 2027, and the provisions of the bill will become effective at different times for various government entities, with some provisions taking effect immediately.