Processes biometric data, in Wisconsin

Wis. Stat. sec. 134.98 · Read the law's page

• If your principal place of business is in Wisconsin, or you maintain or license personal information in Wisconsin, make reasonable efforts to notify each subject of personal information that you know a person you have not authorized has acquired, within a reasonable time, not to exceed 45 days after you learn of the acquisition; if your principal place of business is elsewhere, make reasonable efforts to notify each Wisconsin resident who is a subject.
• If you only store personal information of a Wisconsin resident, without owning or licensing it, and you have no contract with the owner or licensee, notify the owner or licensee as soon as practicable once you know a person you have not authorized has acquired it.
• Notify consumer reporting agencies if a single incident requires notifying 1,000 or more individuals.
• Do not give notice of, or publicize, an unauthorized acquisition during a period for which a law enforcement agency has asked you to hold notice, except as that agency authorizes; the notice period begins at the end of that period.
• Treat a recording-derived voiceprint or faceprint as unique biometric data under this statute. It carries no exclusion for an identifier derived from a photograph, video, or audio recording.
• Do not expect an individual to be able to sue you directly for a violation of this section. Its own official annotation states that it creates no private right of action.