Wyoming Senate Committee Advances Bill Limiting Government Purchase, Sale and Transfer of Personal Data

The Senate Minerals, Business & Economic Development Committee advanced Senate File 65, a measure that would restrict how state and local government entities collect, use and transfer personal data and would give Wyoming residents rights to inspect and correct data about themselves.

The bill's sponsor said the legislation would bar a government entity from buying, selling, trading or transferring an individual's personal data without that person's express written consent, while preserving a set of exceptions. "This is the heart of the bill. No government entity shall purchase, sell, trade, or transfer personal data without the express written consent of the natural person," the sponsor told the committee during the bill presentation.

The bill would also require each government entity that collects or retains personal data to adopt a written policy describing collection, access, retention, security and use of that data. Under the draft, agencies may not keep personal data longer than three years unless they adopt a written justification for extended retention. The bill would require the State Chief Information Officer to develop sample policies by Jan. 1, 2026, and staggers the effective dates: the provision in W.S. 9-22-203 would be effective as to counties, cities and towns on July 1, 2027, and to other political subdivisions on July 1, 2028.

Supporters said the measure responds to a prior state purchase of private data and aims to create clearer rules and public accountability. "The impetus for this was a purchase of a private dataset by a government entity in Wyoming that caused a lot of consternation," the sponsor said, describing the goal as "draw some lines and give some rights to the citizens of the state."

Agencies and stakeholders told the committee they are largely neutral or supportive but urged careful drafting around healthcare privacy and contracts with third-party vendors. Ben Moritz, executive director of the Community College Commission, said college admissions offices often buy lists of graduating seniors but that the bill's draft amendment and timeline addressed his group's concerns. "We don't have extended concerns about it. There were some concerns about purchasing lists for marketing purposes," Moritz said.

The Wyoming Hospital Association urged clearer language addressing how the bill interacts with HIPAA. An association representative said hospitals want assurance the state law would not create conflicts with federal health-privacy obligations. The sponsor noted the draft expressly provides that federal or state law controls when there is a conflict and said he preferred narrowly tailored language rather than adding multiple carve-outs.

Committee members asked how compliance and oversight would work; the sponsor said the bill establishes policy and public review rather than criminal penalties. He described the exemption process in which an agency could petition its elected governing body for a public, time-limited exemption that must be reauthorized in writing every two years.

The committee adopted an amendment that allows government entities to transfer personal data to non-governmental contractors when necessary to provide contracted government services and requires contracts to include data-protection terms and return or destruction of data when the contracted services end. After public comment, the committee approved the amendment and then approved the bill in committee by roll call.

The committee recorded five ayes on the bill in committee. The chair said the bill will go to the floor with a senator named in the committee record to present it.

The measure retains explicit exemptions for the judicial branch and law enforcement, and it recognizes HIPAA and FERPA in the draft as areas where federal obligations must be honored. Residents would have the right to obtain copies of personal data held by a government entity and to request corrections; agencies would have 60 days to investigate and respond in writing.

The committee record shows broad stakeholder engagement during interim work and public hearings; several agencies and associations offered comments and suggested technical amendments, particularly to ensure healthcare providers covered by HIPAA are not placed in conflict with federal law. The bill sponsor said he would work with the hospital association on a narrower amendment to address those concerns before the bill moves forward.

The committee advanced the bill out of standing committee to the floor with the amendment and recorded the committee vote as five ayes. The committee also provided a timetable for agencies to adopt policies if the bill becomes law.