Bill Description
AN ACT relating to
the administration of the government; requiring government entities to
adopt policies for the collection, access, security and use of personal
data as specified; requiring specific personal data policies; providing
definitions; specifying applicability; and providing for effective
dates.
Notes
This bill, which amends Wyoming statutes to introduce data privacy
measures for government entities, is a deeply flawed piece of
legislation that masquerades as protective but ultimately undermines
individual privacy through weak safeguards, broad exemptions, and
insufficient enforcement mechanisms. While it gestures toward limiting
the handling of personal data, it creates numerous loopholes that allow
government overreach, perpetuating a surveillance-friendly environment
rather than curbing it. This is particularly anti-privacy in a state
like Wyoming, where residents value independence and minimal government
intrusion—yet this bill entrenches data collection practices under the
guise of "necessity."
The definitions are
overly narrow and riddled with ambiguities that invite abuse. For
instance, "deidentified data" is excluded from protections if it "cannot
reasonably be used to infer information" about a person—but what
constitutes "reasonably" is left undefined, allowing government entities
to strip minimal identifiers and claim data is anonymized, even when
re-identification is feasible with modern techniques like AI or
cross-referencing public records. This anti-privacy loophole could
enable widespread data aggregation without consent, turning personal
information into a commodity for analysis or sharing.
Critically,
"government entity" excludes the judicial branch and all law
enforcement agencies, meaning courts, police, highways patrol, and
criminal investigators can collect, sell, or transfer personal data
unchecked. In an era of expanding surveillance tools like license plate
readers and facial recognition, this exemption is a glaring anti-privacy
flaw, leaving citizens vulnerable to unchecked data harvesting by the
very entities most likely to misuse it for profiling or investigations
without oversight.
"Personal data" is limited
to information "linked or reasonably linkable" to a person, but this
ignores emerging threats like inferred data from patterns (e.g.,
location tracking via apps or devices). By tying definitions to existing
laws like W.S. 8-1-102(a)(xviii) for "personal digital identity," the
bill fails to future-proof against evolving tech, making it anti-privacy
by design as it doesn't address AI-driven inferences or biometric data
comprehensively.
Subsection (a) prohibits
purchasing, selling, trading, or transferring personal data without
consent, but it's gutted by exceptions: transfers between government
entities are allowed if they "comply" with the article (a low bar given
its weaknesses), and data can be handed to private contractors for
"government services" with vague contractual safeguards. Contractors
must return or destroy data post-use, but there's no robust auditing or
penalties outlined, opening doors to data breaches or unauthorized
retention. This is profoundly anti-privacy, as it facilitates
public-private data pipelines where sensitive information (e.g., health
or financial records) could leak to corporations without meaningful
accountability.
The petition process in
(a)(iii) for exceptions—granted by elected officials for up to two
years—is a recipe for cronyism and arbitrary approvals. Public approval
is required, but without strict criteria, this could normalize privacy
erosions for "case-by-case" needs, like economic development projects or
emergency responses, effectively making consent optional and
anti-privacy.
Subsection (b) allows residents
to request their data, but charging fees (tied to public records acts)
creates a financial barrier, disproportionately affecting low-income
individuals. This paywall is anti-privacy, as it discourages people from
monitoring how their data is used, especially in a rural state where
access to government offices might already be challenging.
In
summary, this bill is a net negative for Wyomingites, prioritizing
government flexibility over robust privacy rights. Its exemptions for
law enforcement and judiciary, coupled with easy exceptions and weak
oversight, make it actively anti-privacy, potentially enabling more
surveillance and data commodification rather than curbing it. Far from a
shield, it's a sieve that could worsen the erosion of personal autonomy
in an increasingly digital world. Lawmakers should scrap it and start
over with stronger, enforceable measures that truly put citizens first.
View on Wyoming LSO
.png)