Breach of the security of a computerized data system, notification duty

An individual or commercial entity that conducts business in Wyoming and owns or licenses computerized data including personal identifying information about a Wyoming resident must, on becoming aware of a breach of the security of the system, conduct a reasonable and prompt investigation, and if misuse has occurred or is reasonably likely, give notice as soon as possible to each affected resident; timing is a risk-of-harm-triggered standard, not a fixed day count.

Personal identifying information means a name combined with one or more data elements defined by cross-reference to Wyoming's criminal identity-theft statute, Wyo. Stat. Ann. sec. 6-3-901(b), which includes unique biometric data generated from measurements or analysis of human body characteristics for authentication purposes, medical information, and health insurance information, alongside the standard Social Security, driver's license, and financial account elements; none of these carries an exclusion for data derived from a photograph, video, or audio recording.

Personal identifying information excludes information contained in government records or widely distributed media lawfully made available to the general public, regardless of its source. Substitute notice is available when the cost of direct notice would exceed $10,000 for a Wyoming-based entity or $250,000 for an out-of-state entity, or when the affected class exceeds 10,000 Wyoming-based persons or 500,000 out-of-state persons.

The original enacting session law's date is not independently traced, and the codified page prints no separate commencement subsection within this article, so no effective date is recorded here.