An Act to create 20.934 of the statutes; Relating to: prohibiting the state from sharing data with the federal government that contains personally identifiable information if the data is not first masked or otherwise anonymized and authorizing a civil cause of action for negligent violations of that prohibition. (FE)
Summary
AB378 would create a new statute, s. 20.934, that generally prohibits Wisconsin state government entities from sharing data with the federal government when that data contains personally identifiable information unless the information is first masked or otherwise anonymized. The bill defines personally identifiable information broadly and applies the restriction to state agencies, the legislature, and the courts.
The bill also creates exceptions allowing unmasked data sharing when necessary to comply with other state or federal law, to administer a state or federal program, or, for legislators and courts, to carry out official duties. In addition, the bill authorizes a civil cause of action against any person who negligently violates the prohibition, allowing an injured person to recover actual damages, up to $1,000 in exemplary damages, and attorney fees and costs.
Impact
AB378 would add a new data-sharing restriction to Wisconsin statutes and impose potential civil liability for negligent violations. It would affect a wide range of state entities, including executive agencies, the legislature, and the courts, by requiring masking or anonymization before sharing personally identifiable information with federal officials or agencies except in specified circumstances. The bill would also create a private enforcement mechanism for individuals harmed by improper disclosure.
Sentiment
The available context shows no recorded committee testimony or vote breakdown, so there is no detailed discussion record to gauge support or opposition. The bill’s introduction by a large bipartisan-looking list of Assembly authors and several Senate cosponsors suggests at least some interest in the proposal, but its final status indicates it ultimately failed to pass pursuant to Senate Joint Resolution 1. Overall, the bill appears to have been framed as a privacy-protection measure rather than a controversial policy expansion, though the lack of recorded debate limits certainty about sentiment.
Contention
The main points of contention likely center on the breadth of the prohibition and the practical burden it could place on state agencies and other government bodies that routinely exchange data with federal partners. Another possible issue is the civil liability provision, which could expose state actors to lawsuits for negligent violations and may raise concerns about compliance costs, administrative complexity, and the risk of inhibiting lawful data sharing. The exceptions for legal compliance and program administration appear designed to address these concerns, but the balance between privacy protection and operational flexibility is the bill’s central tension.
Crossfiled
An Act to create 20.934 of the statutes; Relating to: prohibiting the state from sharing data with the federal government that contains personally identifiable information if the data is not first masked or otherwise anonymized and authorizing a civil cause of action for negligent violations of that prohibition. (FE)