Senate advances data-privacy bill imposing limits on government purchase, retention and transfer of personal data

The Wyoming Senate on Jan. 29 advanced Senate File 65, a data‑privacy bill for government entities that would prohibit state and local agencies from purchasing, selling, trading or transferring personal data without the individual’s written consent except in narrowly defined circumstances.

Senator Rothfuss, who presented the bill, said the legislation was prompted by concerns that government agencies had acquired detailed commercial data about residents. "Based on concerns that the government was effectively collecting and maintaining without check too much information about the citizens of the state, we worked on this legislation to try and provide some limitations," Rothfuss said.

Key provisions include: - A prohibition on government entities purchasing, selling, trading or transferring personal data without the express written consent of the natural person, with exceptions available through written petitions to the elected governing authority of that entity for up to two years. - An explicit carve‑out that compliance with HIPAA and FERPA satisfies the statute's requirements where applicable. - A requirement that each government entity adopt and maintain written policies governing collection, access, retention, security and use of personal data. - A default retention period of three years for personal data unless an entity adopts a written policy justifying a longer retention period; statutory retention requirements (for example, archival law) serve as acceptable justification. - A transparency right allowing Wyoming residents to request copies of personal data held by a government entity and an objection process that requires a response within 60 days and, if meritorious, correction or a statement of the resident's view.

Rothfuss said the bill is deliberately flexible: government entities may request exceptions from elected bodies if they need longer retention or different uses. He also noted the legislation provides that, "To the extent that a provision of this article conflicts with another provision of state or federal law, the other provision shall control." That clause ensures federal and specific statutes take precedence.

The standing committee amendment clarified the use of third‑party contractors by allowing agencies to contract for services but requiring those contractors to meet the act's safeguards as part of their contracts. A Committee of the Whole amendment clarified that compliance with HIPAA should be treated as satisfying specific policy requirements in the bill so health providers and entities with HIPAA obligations do not face duplicative requirements.

Lawmakers asked about administrative costs. Senator Okfus said the three‑year default was a compromise: "Shorter than that, there's not even enough time sometimes to process it, but that does seem like enough time that any entity should be able to really have a reason to have it longer than 3 years." Sponsors said the Information Technology Services division would provide sample policies to reduce the implementation burden.

The Committee of the Whole adopted the standing committee amendment and a Committee of the Whole amendment clarifying HIPAA and FERPA treatment, and the bill was reported do pass.

Ending: The bill sets deadlines for sample policy issuance and staggered effective dates for political subdivisions and other entities, giving local governments time to adopt policies before the law fully takes effect.