Law / United States / 
Wyoming
Breach of the security of a computerized data system, notification duty
Wyo. Stat. Ann. secs. 40-12-501 to 40-12-511
In force.
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Give notice as soon as possible to each affected Wyoming resident once your investigation determines misuse of their personal identifying information has occurred or is reasonably likely.
- Treat a biometric identifier used for authentication as personal identifying information here, whether or not it was derived from a photograph, video, or audio recording. No recording-derived exclusion exists in this cross-referenced definition.
- Use substitute notice only when direct notice would exceed the statute's cost or class-size thresholds, which differ for a Wyoming-based versus an out-of-state entity.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- What counts as an unauthorized acquisition of computerized data that 'materially compromises the security, confidentiality or integrity of personal identifying information' under Wyo. Stat. Ann. sec. 40-12-501(a)(i)?
What it makes you log
Logging duty
Section 40-12-502 requires an individual or commercial entity that conducts business in Wyoming and owns or licenses computerized personal identifying information to investigate a breach in good faith and, where misuse has occurred or is reasonably likely, to notify each affected Wyoming resident with the contents listed in subsection (e), and requires a person that maintains data for another business to disclose a breach to it. A duty to investigate and notify, with no instruction to document the investigation or its finding, is not a log or record, and the article names no content fields, retention period, audit or person who may demand a record. Section 40-12-509(f) has the Attorney General maintain a database of identity theft victims who hold determinations of factual innocence, which is a register the State keeps and not a duty on a person subject to the notice rule. The security freeze sections (40-12-503 to 40-12-508) require a consumer reporting agency to send written confirmations and keep no record the sections name.
- Kind
- None
- As of
What this law does
An individual or commercial entity that conducts business in Wyoming and owns or licenses computerized data including personal identifying information about a Wyoming resident must, on becoming aware of a breach of the security of the system, conduct a reasonable and prompt investigation, and if misuse has occurred or is reasonably likely, give notice as soon as possible to each affected resident; timing is a risk-of-harm-triggered standard, not a fixed day count.
Personal identifying information means a name combined with one or more data elements defined by cross-reference to Wyoming's criminal identity-theft statute, Wyo. Stat. Ann. sec. 6-3-901(b), which includes unique biometric data generated from measurements or analysis of human body characteristics for authentication purposes, medical information, and health insurance information, alongside the standard Social Security, driver's license, and financial account elements; none of these carries an exclusion for data derived from a photograph, video, or audio recording.
Personal identifying information excludes information contained in government records or widely distributed media lawfully made available to the general public, regardless of its source. Substitute notice is available when the cost of direct notice would exceed $10,000 for a Wyoming-based entity or $250,000 for an out-of-state entity, or when the affected class exceeds 10,000 Wyoming-based persons or 500,000 out-of-state persons. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .