Committee approves government data‑privacy draft with carve‑outs for public records

A legislative select committee voted to advance a government data‑privacy bill that would, in general, prohibit state and local government entities from purchasing, selling, trading or transferring personal data without the natural person’s expressed consent — but would exempt records covered by the Public Records Act and several routine government uses. The draft also gives Wyoming residents the right to request copies of their personal data from government entities and requires agencies that collect personal data to adopt policies on collection, retention, access, and security. Why it matters: the draft aims to increase transparency and public trust in how government handles personally identifiable information (PII) while preserving standard public‑records access, court‑mandated disclosures and necessary operational data sharing (for example, between agencies, with vendors performing government services, and when federal law permits disclosure). Key provisions and committee action - Core prohibition and exceptions: The draft makes it unlawful for government entities to purchase, sell, trade or transfer personal data without the natural person’s consent, subject to enumerated exemptions and to any other statute that already authorizes disclosure. The committee added an explicit carve‑out confirming the bill does not restrict access to documents that are public records under Wyoming law. - Access and consumer right: The bill grants current or former Wyoming residents (and their legally authorized representatives) the right to request a copy of personal data the government maintains; committee members asked staff to add language requiring agencies to verify a requester’s identity (due diligence) before releasing data. - Data minimization and retention: The draft prohibits agencies from retaining more personal data than reasonably necessary for lawful functions and limits routine retention to three years unless the agency has a written policy justifying an extended retention period. - Implementation and operational concerns: state IT staff and the University of Wyoming flagged administrative and technical costs. The university estimated rework of its primary administrative system could cost roughly $800,000 to manage required deletion/retention workflows. County clerks and election officials asked committee members to clarify how the bill would apply to voter rolls, recorded deeds and other public records; the committee added text to make public records governed by the Public Records Act explicitly out of scope for the new restrictions. Stakeholder input - TechNet (technology industry trade group) said the bill’s goals are sound but urged the committee to align its draft with other state privacy laws and to be careful about exemptions so government agencies can keep providing services that rely on third‑party data and federal law demands. - The University of Wyoming asked the committee to note the administrative impacts of changes to retention and deletion requirements for core campus systems. - County election official testimony highlighted that voter‑roll data is a public record and that routine public‑records access and archival requests must remain possible. Next steps and guidance Committee members adopted several technical clarifications (adding current/former resident language in the requester definition, adding a legally authorized‑representative clause, and explicitly exempting documents subject to the Public Records Act). Members asked staff to draft verifying‑identity/due‑diligence language before the bill moves into the formal bill‑draft process.