Government data privacy: no sale or transfer of personal data without written consent, contractor flow-down, and resident access and objection

A government entity may not purchase, sell, trade or transfer personal data without the express written consent of the person the data references, except as otherwise expressly provided by law and the exceptions the section lists. A government entity is the state and all its political subdivisions, agencies, instrumentalities and institutions and any local government entity.

The definition of government entity does not include the judicial branch of government or any law enforcement agency in Wyoming. A government entity may transfer personal data to another government entity that complies with the article. A government entity may petition the elected governing person or body with authority over it for an exception, which that person or body may publicly approve in writing for a term of up to two years per petition.

The prohibition does not bar the transfer of personal data that is transferable under the Health Insurance Portability and Accountability Act or the Family Education Rights and Privacy Act. A government entity may transfer personal data to a nongovernment entity it contracts with to provide or assist with government services, and the contract must include requirements for the protection of personal data consistent with the article.

The nongovernment entity must return or destroy the personal data once it is no longer necessary for the government service, and may not maintain, sell, transfer, process or otherwise use it except as necessary to provide the contracted service.

A current or former Wyoming resident, or the resident's legally authorized representative, may request a copy of the resident's personal data from any government entity maintaining it, and the entity may charge a fee consistent with the fees the Wyoming Public Records Act authorizes.

A resident who objects to the accuracy, completeness, pertinence, timeliness, relevance, retention, dissemination or denial of access to the resident's own personal data may file an objection with the government entity that maintains the data. The government entity must act on the objection within sixty days of receiving it.

Where the article conflicts with another provision of state or federal law, the other provision controls, and nothing in the article abrogates any disclosure of data or public records under the Wyoming Public Records Act. Under section 5 of the act, its section 1, which created these two sections, takes effect immediately upon completion of all acts necessary for a bill to become law. The Governor signed Senate Enrolled Act 32 of 2026 on March 6, 2026.