On November 14, 2023, Assembly Bill 466 on consumer data protection and providing a penalty passed its third reading in the Wisconsin State Assembly and was ordered immediately to the Wisconsin State Senate. The bill seeks to apply to controllers that control or process the personal data of at least 100,000 consumers or that control or process the personal data of at least 25,000 consumers and derive over 50% of their gross revenue from the sale of personal data.

The bill would provide consumers with rights including:

• to confirm whether a controller is processing the consumer's personal data and to access the personal data;
• to correct inaccuracies in the consumer's personal data;
• to require a controller to delete personal data provided by or about the consumer;
• to obtain a copy of the personal data that the consumer previously provided to the controller; and
• to opt out of the processing of the consumer's personal data for:
  • targeted advertising;
  • the sale of the consumer's personal data; and
  • certain forms of automated processing of the consumer's personal data.

Moreover, the bill would impose obligations on controllers such as the establishment of a privacy notice, managing vendors, and conducting data protection assessments. A controller or processor that violates the bill's requirements would be subject to a forfeiture of up to $7,500 per violation but would be provided with a 30-day cure period by the Attorney General.

You can read the bill here and track its progress here.