Wisconsin Assembly passes personal data consumer rights legislation

The Wisconsin Assembly passed legislation on party lines Wednesday expanding the rights consumers have around how their personal data is used and sold.

The bill allows consumers to ask certain data-processing businesses for their personal data to be deleted. They’d also be able to opt out of having their data sold or used for targeted advertising.

Bill sponsor state Rep. Shannon Zimmerman, R-River Falls, said he’s spent decades in the tech industry.

“I am convinced that technology is doing so many wonderful things for the residents of Wisconsin and Americans abroad,” Zimmerman said.

But Zimmerman said the malicious use of data poses a threat.

“The information that is collected on all of us is scary in their ability to track, monitor, manipulate you,” he said. “Today we are going to take a bold step in defending those in Wisconsin.”

Businesses would have to provide information about personal data to consumers free of charge up to twice a year, and businesses would not be allowed to discriminate against customers for exercising the rights provided in the bill. The state attorney general would be allowed to fine people responsible for deciding why and how to process personal data up to $7,500 for each time they don’t comply with the new rules.

According to a filing from the Department of Justice, the new responsibilities would create an estimated $949,900 a year in expenses while bringing in an estimated $75,000 a year, a sum the filing described as “nominal” compared to enforcement costs.

“It is likely that the majority of complaint investigations and notifications will not result in an enforcement prosecution, and it may take several years to collect cost reimbursements from controllers found to have violated the provisions of the bill,” the filing reads.

Zimmerman said the bill would protect the state’s residents.

“If you’re uncomfortable, you can say, ‘No more, I want you to delete that information that you have on me, I feel violated.’ And you can move on,” Zimmerman said.

Businesses would also have to provide privacy notices to consumers regarding the categories of personal data processed and the reasons for doing so.

The legislation has polarized businesses to an extent. Microsoft has registered in support of the legislation, while Wisconsin-based Kwik Trip and the lobbying group Wisconsin Manufacturers and Commerce, or WMC, have filed against it.

“This issue should be handled at the federal level, not state by state,” WMC said in its filing.

Consumer advocacy groups have expressed opposition to the bill. In a letter to the Assembly Committee on Consumer Protection, Senior Policy Analyst Maureen Mahoney of the nonprofit organization Consumer Reports said the legislation is ineffective at reining in big tech companies such as Facebook and Google.

“It would risk locking in industry-friendly provisions that avoid actual reform,” Mahoney’s letter reads. “Consumers should be able to hold companies accountable in some way for violating their rights — there should be some form of a private right of action.”

The bill passed out of committee Tuesday. State Rep. Nancy VanderMeer, R-Tomah, joined the two Democrats present on the committee in voting against the legislation.

It’s unclear whether Gov. Tony Evers supports the bill. Last year, he signed a law that added cybersecurity requirements for data the insurance industry collects.

Having passed the Assembly, the bill now heads to the Senate.