Data privacy-government entities. | 26LSO-0012, 1.1 |
FISCAL NOTE
The fiscal impact, in the form of increased expenditures, is indeterminable but could be significant.
The Department of Enterprise Technology Services (ETS) has determined that the cost of deleting and de-identifying data is currently unknown. Agencies must comply with federal data retention requirements, and as such will need to develop policies that extend retention beyond the bill's proposed three-year period. While this extension is essential for maintaining federal compliance and supporting informed policy decisions, the bill’s requirement to delete and de-identify data presents significant challenges.
ETS noted many legacy systems lack this functionality, and the number of systems requiring upgrades, and the associated costs, cannot be accurately estimated at this time. ETS anticipates additional workload and required resources to support and partner with state agencies to review their applications, databases and retention schedules to estimate the costs for full compliance. These changes will impact most, if not all applications currently used. Due to the anticipated change and the unknown state of each application to fully comply with the legislation, ETS is unable to provide a reasonable cost estimate.
According to the Department of Workforce Services, the duties proposed in W.S. 9-21-202(c) requiring an investigation into the validity of an objection regarding the “accuracy, completeness, pertinence, timeliness, relevance, retention, dissemination, or denial of access” have the potential to require additional personnel and expenditures, which are indeterminable at this time.
According to the Department of Family Services (DFS), the costs associated with deleting and de-identifying data remain uncertain. To comply with federal data retention requirements for various DFS programs, it will be necessary for DFS to develop policies that extend data retention beyond the three-year period. This extension is crucial for ensuring federal compliance and enabling longitudinal analysis of case information.
The Wyoming Game and Fish Department anticipates a total expenditure increase of
$2,356 due to the staff time required to develop policies and practices to be in
compliance with the bill. Policy development and a request to retain personal
data beyond three years for hunting and fishing licensing history, law
enforcement purposes and hunting preference point data is expected to take
approximately 38 hours of administrative time at an hourly rate of $62.
According to the Wyoming Department of Health (WDH), the duties associated with this bill can be incorporated into the routine process by existing personnel. The WDH will draft additional policies into its privacy and security policies where needed to ensure compliance.
According to the State Auditor’s Office (SAO), the majority of the bill’s changes will not cause additional expenditures. However, proposed W.S. 9-21-202(c) requires the government entity to investigate the validity of resident objections and issue decision letters regarding merit. If the volume of objections were high, this may cause additional expenditures for legal assistance investigation regarding validity.
Additionally, the SAO noted if an individual’s objection is found to lack merit, W.S. 9-21-202(c)(iii) would require the government to attach an individual’s statement, if they desire, to any disseminated information regarding the individual. This could have a substantial impact on the SAO’s ability to respond to public records requests, maintain the statutorily required transparency website, and complete required tax reporting.
The Governor’s Office, the Secretary of State’s Office, the Department of Education, the Dept. of Administration & Information, the Attorney General’s Office, the Dept. of Transportation, the State Engineer’s Office, the Laramie County District Attorney’s Office, the Public Defender’s Office, Wyoming Retirement System and the Natrona County District Attorney’s Office indicated the bill would have no significant fiscal or personnel impact to their agency.
NOTICE-AGENCY ESTIMATE OF ADMINISTRATIVE IMPACT REQUESTED
This bill has administrative impact that appears to increase duties or responsibilities of one or more state agencies and may impact agency spending or staffing requirements. As introduced, the bill does not modify any state agency budget or current personnel authorizations. The following state agencies will be asked to provide their estimate of the administrative fiscal impact prior to the first committee meeting held to consider the bill:
University of Wyoming Community College Commission Department of Parks and Cultural Resources |
Prepared by: Matt Sackett, LSO Phone: 777-7881
(Information provided by Mike Smith, University of Wyoming, 214-4053;
Paris Edeburn, Community College Commission, 777-7218;
Caryn Erickson, Department of Parks and Cultural Resources, 777-6538;
Roxanne O'Conner, Department of Family Services, 777-6101;
Kristin Burkhart, Enterprise Technology Services, 287-0879;
Kristi Racines, State Auditor's Office, 777-7831;
Jennifer Martinez, Department of Workforce Services, 777-6746;
Lindsay Mills, Department of Health, 777-8622;
Meredith Wood, Game and Fish Department, 777-4618;
Rachel Meeker, Retirement System, 777-6109;
Rodney Freier, Jr., Department of Transportation, 777-4174;
Kristin Baker, State Engineer's Office, 777-6977;
Barbara Wallace, District Attorney/Jud. Dist. 1, 777-7136;
Dan Itzen, District Attorney/Jud. Dist. 7, 235-9223;
Colin Crossman, Secretary of State's Office, 777-5873;
Barbara Wallace, Dept. of Administration & Information, 777-7136;
Barbara Wallace, Governor's Office, 777-7136;
April Christensen, Attorney General's Office, 777-7840;
Brandon Booth, Public Defenders Office, 777-7519;
Trent Carroll, Department of Education, 777-7720)
SF0020
ORIGINAL Senate ENGROSSED
File No. SF0020
ENROLLED ACT NO. 32, SENATE
SIXTY-EIGHTH LEGISLATURE OF THE STATE OF WYOMING
2026 Budget Session
AN ACT relating to the administration of the government; requiring government entities to adopt policies for the collection, access, security and use of personal data as specified; requiring specific personal data policies; providing definitions; specifying applicability; and providing for effective dates.
Be It Enacted by the Legislature of the State of Wyoming:
Section 1. W.S. 9‑21‑201 and 9‑21‑202 are created to read:
ARTICLE 2
DATA PRIVACY‑GOVERNMENT ENTITIES
9‑21‑201. Definitions.
(a) As used in this article:
(i) \"Deidentified data\" means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable natural person or personal digital identity or a device linked to a natural person or personal digital identity;
(ii) \"Government entity\" means the state and all its political subdivisions, agencies, instrumentalities and institutions and any local government entity. \"Government entity\" shall not include the judicial branch of government or any law enforcement agency in Wyoming;
(iii) \"Identified or identifiable natural person\" means a natural person who can be readily identified, directly or indirectly, by reference to an identifier such as a name, an identification number, specific geolocation data or an online identifier;
(iv) \"Law enforcement agency\" means a county, municipal, college or university police force, Wyoming highway patrol, the division of criminal investigation, the department of corrections, the game and fish department when acting within its law enforcement capacity or any state or local agency or political subdivision or part of an agency or political subdivision to the extent that the primary purpose of the agency or political subdivision, or part thereof, is the prevention or investigation of crime or the enforcement of penal, traffic, regulatory or criminal laws. \"Law enforcement agency\" shall not include the office of any city, county or district attorney or other division of the attorney general;
(v) \"Personal data\" means information that is linked or reasonably linkable to an identified or identifiable natural person or personal digital identity and does not include deidentified data;
(vi) \"Personal digital identity\" means as defined in W.S. 8‑1‑102(a)(xviii).
9‑21‑202. Limitations on personal data by government entities; conflict of laws.
(a) No government entity shall purchase, sell, trade or transfer personal data without the express written consent of the natural person whom the personal data references except as otherwise expressly provided by law and except that:
(i) A government entity may transfer personal data to another government entity provided that the other government entity complies with this article;
(ii) A government entity may transfer personal data to a nongovernment entity contracted by the government entity to provide or assist with government services provided by the government entity. Any contract for services with a nongovernment entity shall include requirements for the protection of personal data consistent with this article. Any personal data transferred pursuant to this paragraph shall be returned or destroyed by the nongovernment entity once the personal data is no longer necessary for the provision of the government service. No nongovernment entity shall maintain, sell, transfer, process or otherwise use the personal data in any manner except as necessary to provide the contracted service;
(iii) A government entity may petition the elected governing person or body with authority over the government entity for an exception to this subsection on a case by case basis. The elected governing person or body, in the elected governing person's or body's discretion, may publicly approve in writing an exception to this subsection not to exceed a term of two (2) years per petition; and
(iv) Nothing in this subsection shall be construed to prohibit the transfer of personal data that is transferrable pursuant to the Health Insurance Portability and Accountability Act or the Family Education Rights and Privacy Act.
(b) Any current or former Wyoming resident or the resident's legally authorized representative may request a copy of their personal data from any government entity maintaining it. The government entity may charge a fee for production of the requested personal data consistent with fees authorized to be charged under the Wyoming Public Records Act, W.S. 16‑4‑201 through 16‑4‑205.
(c) A current or former Wyoming resident or the resident's legally authorized representative who objects to the accuracy, completeness, pertinence, timeliness, relevance, retention, dissemination or denial of access to the resident's own personal data that is maintained by a government entity may, individually or through a duly authorized representative, file an objection with the government entity that maintains the data. The government entity maintaining the personal data shall, within sixty (60) days of the receipt of an objection:
(i) Verify the identity of the current or former Wyoming resident or the resident's legally authorized representative who filed the objection with the government entity;
(ii) Review the validity of the objection;
(iii) If the objection is found to be meritorious after review, alter the contents of, or the methods for holding, or the dissemination or use of the personal data, or delete or grant access to it;
(iv) If the objection is found to lack merit after review, provide the resident the opportunity to have a statement reflecting the resident's views maintained with the personal data in question;
(v) Notify the resident in writing of any decision regarding the resident's objection.
(d) To the extent that a provision of this article conflicts with another provision of state or federal law, the other provision shall control. Nothing in this article shall be construed to abrogate any disclosure of data or public records under the Wyoming Public Records Act, W.S. 16‑4‑201 through 16‑4‑205.
Section 2. W.S. 9‑21‑203 is created to read:
9‑21‑203. Personal data collection and retention by government entities.
(a) In addition to the policies required under W.S. 9‑21‑101, if applicable, each government entity that collects or retains personal data shall adopt, enforce and maintain a policy regarding the collection, access, retention, security and use of personal data consistent with all applicable federal and state laws, including this article.
(b) No government entity shall collect or maintain more personal data than is reasonably necessary for the performance of the government entity's lawful functions. All personal data collected and maintained by government entities shall be necessary for a specific purpose identified in the adopted policies of the government entity.
(c) No government entity shall maintain personal data for longer than three (3) years without a written policy identifying the extended retention period and providing a reasonable justification for the extended retention period. Statutory retention requirements provided for in W.S. 9‑2‑405 through 9‑2‑413 constitute a reasonable justification.
(d) A government entity to which the Health Insurance Portability and Accountability Act or the Family Education Rights and Privacy Act applies that is compliant with a written data collection and retention policy that meets the requirements of the Health Insurance Portability and Accountability Act or the Family Education Rights and Privacy Act shall be deemed compliant with this section.
Section 3. Not later than January 1, 2027, the state chief information officer in consultation with the state archivist shall develop sample policies for use by all government entities as defined by W.S. 9‑21‑201(a)(ii).
Section 4. W.S. 9‑21‑203 as created by section 2 of this act shall be effective as to counties, cities, public institutions of higher education or towns on July 1, 2028 and as to each political subdivision of the state other than state agencies, counties, cities, public institutions of higher education or towns on July 1, 2029. All government entities as defined by W.S. 9‑21‑201(a)(ii) shall adopt any necessary policies and procedures to meet the requirements of this act.
Section 5.
(a) Section 2 of this act is effective July 1, 2027.
(b) Sections 1, 3, 4 and 5 of this act are effective immediately upon completion of all acts necessary for a bill to become law as provided by Article 4, Section 8 of the Wyoming Constitution.
(END)
|
|
|
|
Speaker of the House |
|
| President of the Senate |
|
|
|
| Governor |
|
|
|
|
| TIME APPROVED: _________ |
|
|
|
|
| DATE APPROVED: _________ |
|
I hereby certify that this act originated in the Senate.
|
Chief Clerk |
| 1 |
|
SF0020 | Data privacy-government entities. |
Sponsored By: Select Committee on Blockchain, Financial Technology and Digital Innovation Technology
AN ACT relating to the administration of the government; requiring government entities to adopt policies for the collection, access, security and use of personal data as specified; requiring specific personal data policies; providing definitions; specifying applicability; and providing for effective dates.
12/11/2025 Bill Number Assigned
1/5/2026 S Received for Introduction
2/9/2026 S Introduced and Referred to S09 - Minerals 31-0-0-0-0
ROLL CALL
Ayes: (s) Anderson, Barlow, Biteman, Boner, Brennan, Case, Cooper, Crago, Crum, Dockstader, Driskill, French, Gierau, Hicks, Hutchings, Ide, Jones, Kolb, Landen, Laursen, Love, Mckeown, Nethercott, Olsen, Pappas, Pearson, Rothfuss, Salazar, Schuler, Scott, Steinmetz
Ayes 31 Nays 0 Excused 0 Absent 0 Conflicts 0
2/16/2026 S09 - Minerals:Recommend Amend and Do Pass 3-2-0-0-0
ROLL CALL
Ayes: Senator(s) Anderson, Nethercott, Rothfuss
Nays: Senator(s) Cooper, Jones
Ayes 3 Nays 2 Excused 0 Absent 0 Conflicts 0
2/16/2026 S Placed on General File
SF0020SS001/ADOPTED
Page 3-line 4 After \"corrections\" insert \", the game and fish department when acting within its law enforcement capacity\".
Page 6-line 15 Delete \"Investigate\" and insert \"Review\".
Page 6-line 18 Delete \"investigation\" and insert \"review\".
Page 6-line 23 Delete \"investigation\" and insert \"review\".
Page 7-line 2 Delete \"and disseminated\". Anderson, Chairman
SF0020SW001/ADOPTED
Page 9-line 11 Delete \"9-2-203\" and insert \"9-21-203\". Rothfuss
2/18/2026 S COW:Passed
2/19/2026 S 2nd Reading:Passed
2/20/2026 S 3rd Reading:Passed 30-1-0-0-0
ROLL CALL
Ayes: Senator(s) Anderson, Barlow, Biteman, Boner, Brennan, Case, Cooper, Crago, Crum, Dockstader, Driskill, French, Gierau, Hicks, Hutchings, Ide, Jones, Kolb, Landen, Laursen, Love, Mckeown, Nethercott, Olsen, Pappas, Rothfuss, Salazar, Schuler, Scott, Steinmetz
Nays: Senator Pearson
Ayes 30 Nays 1 Excused 0 Absent 0 Conflicts 0
2/20/2026 H Received for Introduction
2/24/2026 H Introduced and Referred to H09 - Minerals
2/25/2026 H09 - Minerals:Recommend Do Pass 8-0-1-0-0
ROLL CALL
Ayes: Representative(s) Campbell, K, Heiner, Knapp, Larson, Lawley, Riggins, Schmid, Tarver
Excused: Representative Webber
Ayes 8 Nays 0 Excused 1 Absent 0 Conflicts 0
2/25/2026 H Placed on General File
2/25/2026 H COW:Passed
SF0020H2001/ADOPTED (TO ENGROSSED COPY)
Page 6-after line 13 Insert and renumber as necessary:
\"(i) Verify the identity of the current or former Wyoming resident or the resident's legally authorized representative who filed the objection with the government entity;\".
Page 6-line 15 Delete \"(i)\" and insert \"(ii)\".
Page 6-line 17 Delete \"(ii)\" and insert \"(iii)\".
Page 6-line 22 Delete \"(iii)\" and insert \"(iv)\".
Page 7-line 4 Delete \"(iv)\" and insert \"(v)\". Yin
2/26/2026 H 2nd Reading:Passed
2/27/2026 H 3rd Reading:Passed 34-25-3-0-0
ROLL CALL
Ayes: Representative(s) Andrew, Angelos, Banks, Brown, L, Campbell, E, Campbell, K, Chestek, Clouston, Connolly, Davis, Erickson, Filer, Fornstrom, Geringer, Harshman, Jarvis, Larsen, L, Larson, Jt, Lawley, Locke, Neiman, Nicholas, Posey, Provenza, Riggins, Sherwood, Singh, Storer, Tarver, Thayer, Washut, Webb, Williams, Yin
Nays: Representative(s) Allemand, Bear, Brady, Bratten, Brown, G, Byron, Guggenmos, Haroldson, Heiner, Hoeft, Knapp, Lien, Lucas, Mccann, Ottman, Pendergraft, Rodriguez-Williams, Schmid, Smith, Strock, Styvar, Wasserburger, Webber, Wharff, Winter
Excused: Representative(s) Johnson, Kelly, Wylie
Ayes 34 Nays 25 Excused 3 Absent 0 Conflicts 0
3/2/2026 S Received for Concurrence
3/2/2026 S Concur:Passed 28-3-0-0-0
ROLL CALL
Ayes: Senator(s) Anderson, Barlow, Biteman, Boner, Brennan, Case, Cooper, Crago, Crum, Dockstader, Driskill, French, Gierau, Hicks, Ide, Jones, Kolb, Landen, Laursen, Love, Mckeown, Nethercott, Olsen, Pappas, Rothfuss, Salazar, Schuler, Scott
Nays: Senator(s) Hutchings, Pearson, Steinmetz
Ayes 28 Nays 3 Excused 0 Absent 0 Conflicts 0
3/2/2026 Assigned Number SEA No. 0032
3/2/2026 S President Signed SEA No. 0032
3/3/2026 H Speaker Signed SEA No. 0032
3/6/2026 Governor Signed SEA No. 0032
3/6/2026 Assigned Chapter Number 48
Chapter No. 48 Session Laws of Wyoming 2026
Bill No.: SF0020 Effective: Multiple Dates
LSO No.: 26LSO-0012
Enrolled Act No.: SEA No. 0032
Chapter No.: 48
Prime Sponsor: Select Committee on Blockchain, Financial Technology and Digital Innovation Technology
Catch Title: Data privacy-government entities.
Has Report: No
Subject: Data privacy by government entities.
Summary/Major Elements:
Comments:
The above summary is not an official publication of the Wyoming Legislature and is not an official statement of legislative intent. While the Legislative Service Office endeavored to provide accurate information in this summary, it should not be relied upon as a comprehensive abstract of the bill. |