Law / United States / 
Wisconsin
Notice of unauthorized acquisition of personal information
In force since .
A breach notification rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- If your principal place of business is in Wisconsin, or you maintain or license personal information in Wisconsin, make reasonable efforts to notify each subject of personal information that you know a person you have not authorized has acquired, within a reasonable time, not to exceed 45 days after you learn of the acquisition; if your principal place of business is elsewhere, make reasonable efforts to notify each Wisconsin resident who is a subject.
- Notify consumer reporting agencies if a single incident requires notifying 1,000 or more individuals.
- Treat a recording-derived voiceprint or faceprint as unique biometric data under this statute. It carries no exclusion for an identifier derived from a photograph, video, or audio recording.
- Do not expect an individual to be able to sue you directly for a violation of this section. Its own official annotation states that it creates no private right of action.
These lines are LexLint's reading of the law's text. Also read by: Wisconsin Department of Agriculture, Trade and Consumer Protection (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://datcp.wi.gov/Pages/Publications/IDTheftDataBreach607.aspx
- Guidance body
- Wisconsin Department of Agriculture, Trade and Consumer Protection
- Open questions
- When does the acquisition of personal information 'not create a material risk of identity theft or fraud to the subject' so that an entity need not give notice under Wis. Stat. sec. 134.98(2)(cm)1.?
What it makes you log
Logging duty
Section 134.98(2) requires an entity that knows personal information in its possession has been acquired by an unauthorized person to make reasonable efforts to notify each subject (each resident of this state where the entity's principal place of business is elsewhere), to notify the owner or licensee where the entity only stores the information, and to notify the nationwide consumer reporting agencies when 1,000 or more individuals are notified of a single incident. Section 134.98(3)(c) has the entity identify the personal information acquired on a written request from a person it notified. A duty to notify, with no instruction to document the incident or the finding that notice is not required, is not a log or record, and the section names no content fields, retention period, audit or person who may demand a record. The prong of the entity definition that turns on maintaining or licensing personal information in this state (section 134.98(1)(a)1.b and (2)(a)) turns on where the information is held and sets no hook value here.
- Kind
- None
- As of
What this law does
An entity whose principal place of business is in Wisconsin, or that maintains or licenses personal information in Wisconsin, that knows personal information in its possession has been acquired by an unauthorized person must make reasonable efforts to notify each affected individual within a reasonable time, not to exceed 45 days after learning of the acquisition.
Personal information includes an individual's name combined with, among other elements, a Social Security number, a DNA profile, or unique biometric data such as a fingerprint, voiceprint, or retina or iris image, each on the same footing as the others, with no exclusion anywhere in the section for an identifier derived from a photograph, video, or audio recording. If a single incident requires notifying 1,000 or more individuals, the entity must also notify consumer reporting agencies.
Gramm-Leach-Bliley Act (GLBA)-compliant and Health Insurance Portability and Accountability Act (HIPAA)-covered entities are exempt outright. The statute's own official annotation states directly that the section does not create a private right of action, citing Fox v. Iowa Health System, 399 F. Supp. 3d 780 (2019).
No separate civil-penalty or forfeiture amount specific to a section 134.98 violation appears within the section itself; Wis. Stat. sec. 134.99 addresses only accomplice or conspirator liability for a chapter violation carrying a forfeiture, without stating the amount or who may bring the action, and the underlying enforcement mechanism is not traced further here into Wisconsin's general consumer-protection authority under chs. 93 or 100. The Act that enacted the notice duty, 2005 Wisconsin Act 138, became effective on .
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .