McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
Business Home → Products & Solutions → Data Protection → US & Global Data Protection Laws → Security Breach Notification Laws

Wyoming

Wyoming Consumer Protection Act
CITATION Wyo. Stat. § 40-12-501 to -502
ENACTED 2006
SUMMARY

The law requires an individual or commercial entity that conducts business in Wyoming and that owns or licenses computerized data that includes personal identifying information about a resident of Wyoming shall, when it becomes aware of a breach of the security of the system, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal identifying information has been or will be misused. If the investigation determines that the misuse of personal identifying information about a Wyoming resident has occurred or is reasonably likely to occur, the individual or the commercial entity must give notice as soon as possible to the affected Wyoming resident.

The law also provides consumers with the right to ‘freeze’ their credit reports in the event of identity theft.
DATA COVERED

The law covers ‘Personal Identifying Information’ as meaning the first name or first initial and last name of a person in combination with one (1) or more of the following data elements when either the name or the data elements are not redacted:

  • Social Security number; 
  • Driver's license number or Wyoming identification card number; 
  • Account number, credit card number or debit card number in combination with any security code, access code or password that would allow access to a financial account of the person;
  • Tribal identification card; or
  • Federal or state government issued identification card.
INDUSTRY Any person who maintains computerized data that includes personal identifying information on behalf of another business entity shall disclose to the business entity for which the information is maintained any breach of the security of the system as soon as practicable following the determination that personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person. The person who maintains the data on behalf of another business entity and the business entity on whose behalf the data is maintained may agree which person or entity will provide any required notice provided only a single notice for each breach of the security of the system will be required.
PENALTIES

Any person who willfully uses, or has willfully used, a method, act or practice in violation of this act which victimizes or attempts to victimize an older person or a person with disabilities, and commits such violation when the person knew or should have known that the conduct was unfair or deceptive, must make restitution or reimbursement to the older person or person with disabilities including reasonable attorney fees and costs, and, in addition, is liable for a civil penalty of up to fifteen thousand dollars ($15,000.00) for each violation recoverable by the office of the attorney general.

The enforcing authority, upon petition to the court, may recover, on behalf of the state, a civil penalty of not more than five thousand dollars ($5,000.00) from any person who violates the terms of a permanent injunction issued. Any person or agent or employee of the person, who willfully uses, or has willfully used, a method or act, in violation of this act, is liable for a civil penalty of not more than ten thousand dollars ($10,000.00) for each violation.
United States - English