Wyoming. Breach notification. Act
WY breach lawWyoming data breach notification law (Wyo. Stat. §§ 40-12-501 to 40-12-502)
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Wyoming residents to notify affected individuals after a security breach. Core timing rule: Individuals as soon as possible after determining misuse is likely. Covered data: name plus SSN, driver's licence, financial account with codes, government ID, security tokens, online credentials, birth/marriage certificate, medical and health insurance data, biometric data, taxpayer ID.
- Key themes
- Unique features
Very broad PI definition including shared secrets/security tokens and birth or marriage certificates; no regulator notice.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Wyoming requires the maintaining entity to notify the owner as soon as practicable. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals as soon as possible after determining misuse is likely; no AG notice
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- AG may seek damages and other relief; no specific penalty
§3Dates
- Key dates
- Adopted
- In force
- SF 35 and SF 36 (2015, eff. 2015-07-01) broadened PI and notice content
§4Text and authority
- Text
- Authoritative text wyoleg.gov
- Authority
- Wyoming Attorney General
§5Where it applies
- Domestic law of
- Wyoming
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.