United States of America: Passage with amendments of Assembly Bill 957 for an Act on Consumer data protection

On 23 February 2022, the Wisconsin General Assembly passed Assembly Bill 957 for an Act on Consumer data protection. The Act applies to companies conducting business in Wisconsin or generating items or services that are marketed to Wisconsin citizens. Furthermore, affected companies must either process personal data of 100'000 consumers per year or process personal data of 25'000 consumers and derive a majority of gross revenue from personal data sales. The Act introduces several data protection obligations but no private right of action, the Attorney General would be responsible for enforcement. Sepcifically, the Act specifies that controllers must react to consumer requests to exercise their rights under the bill and if a controller refuses to act on a customer's request, the controller must explain its reasoning to the consumer in a timely manner. Violations result in penalties of up to USD 7'500. The Act passed with amendments, including to the definition of biometric data, and with respect to the consumer right to data deletion. Specifically, an added paragraph explains how data controllers, which have obtained personal data about a consumer from a source other than the consumer, must comply with consumer requests for data deletion.