{ "type": "practice-guide", "canonical": "https://openagreements.org/practice-guides/privacy/us/wyoming", "links": [ { "rel": "self", "href": "https://openagreements.org/practice-guides/privacy/us/wyoming.json", "type": "application/json" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/wyoming", "type": "text/html" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/wyoming/markdown", "type": "text/markdown" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/wyoming/json", "type": "application/json" } ], "data": { "topic": "privacy", "state": "wyoming", "frontmatter": { "title": "Wyoming Consumer Privacy Law", "description": "Wyoming has no comprehensive consumer-privacy statute. The operative state laws are the data-breach statute (Wyo. Stat. §§ 40-12-501 et seq.), the Wyoming Consumer Protection Act, and a genetic-data privacy chapter, plus the federal overlay.", "state": "Wyoming", "lastReviewed": "2026-06-12", "license": "CC BY 4.0", "authors": [ "steven-obiajulu" ], "summary": { "keyLaw": "Wyo. Stat. §§ 40-12-501 et seq. (breach of the security of the data system), the Wyoming Consumer Protection Act, §§ 40-12-101 et seq., and the genetic data privacy chapter, §§ 35-32-101 et seq. — Wyoming has no comprehensive consumer-privacy law", "appliesTo": "Any individual or commercial entity that conducts business in Wyoming and owns or licenses computerized personal identifying information about Wyoming residents — no revenue or consumer-volume threshold; the genetic-data chapter reaches direct-to-consumer genetic testing companies", "privacyPolicyRequired": "No general Wyoming statute mandates a consumer privacy policy or fixes its contents; direct-to-consumer genetic testing companies must post a high-level privacy-policy overview and a prominent privacy notice, and FTC Act § 5, GLBA, HIPAA, and COPPA drive contents for everyone else", "privateRightOfAction": "Not under the breach statute, which the Attorney General enforces; the Wyoming Consumer Protection Act lets a consumer sue over an uncured deceptive trade practice (§ 40-12-108), and the genetic-data chapter gives individuals a civil action after a 60-day cure window (§ 35-32-104)", "regulator": "Wyoming Attorney General (the enforcing authority under the Wyoming Consumer Protection Act)", "bottomLine": "Wyoming has not enacted a comprehensive consumer-privacy law, so there are no general data-rights, notice-at-collection, consent, or processor-contract duties under state law. The operative state laws are the data-breach notification statute (Wyo. Stat. §§ 40-12-501 et seq.), the Wyoming Consumer Protection Act, and a genetic-data privacy chapter that imposes consent, notice, and deletion duties on direct-to-consumer genetic testing companies and carries a private right of action. Everything else in a Wyoming-facing privacy program comes from the federal and sectoral overlay — FTC Act § 5, GLBA, HIPAA, and COPPA.", "lawCoverage": "sectoral", "policyMandate": "sectoralPolicy", "consumersCanSue": "narrow", "sensitiveDataConsent": "categorySpecific", "universalOptOutSignal": "notRequired" }, "about": [ "Wyoming consumer privacy law", "Wyoming data breach notification 40-12-502", "Wyoming Consumer Protection Act privacy", "Wyoming genetic data privacy 35-32-101", "Wyoming no comprehensive privacy law", "Wyoming privacy policy requirements", "Wyoming direct-to-consumer genetic testing consent", "Wyoming Attorney General privacy enforcement", "Wyoming data breach private right of action", "Wyoming security freeze credit report", "Wyoming mugshot removal website law" ], "translations": [ { "language": "中文", "status": "planned" }, { "language": "Español", "status": "planned" }, { "language": "Português", "status": "planned" }, { "language": "Deutsch", "status": "planned" } ] }, "questions": [ { "slug": "which-privacy-laws-apply", "label": "Which privacy laws apply to your business in Wyoming?", "heading": "Which privacy laws apply to your business in Wyoming?", "answerText": "There is no comprehensive Wyoming consumer-privacy law. Three sectoral state statutes do the work instead: the data-breach statute, which defines a reportable breach as unauthorized acquisition of computerized data that materially compromises personal identifying information and causes or is reasonably believed to cause loss or injury to a Wyoming resident; the Wyoming Consumer Protection Act, the state's general deceptive-trade-practices law; and a genetic-data privacy chapter that bars obtaining, testing, retaining, or disclosing genetic data without informed consent.", "sources": [ { "id": "breach-def", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-501", "citation": "Wyo. Stat. § 40-12-501(a)(i).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "Wyoming's breach statute defines a breach of the security of the data system as unauthorized acquisition of computerized data that materially compromises personal identifying information and causes or is reasonably believed to cause loss or injury to a Wyoming resident.", "verbatimQuote": "\"Breach of the security of the data system\" means unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal identifying information maintained by a person or business and causes or is reasonably believed to cause loss or injury to a resident of this state.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-breach-def" }, { "id": "wcpa-unlawful-practices", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-105", "citation": "Wyo. Stat. § 40-12-105(a).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "The Wyoming Consumer Protection Act makes knowing deceptive trade practices in connection with a consumer transaction unlawful, which is the hook for misrepresented data practices.", "verbatimQuote": "A person engages in a deceptive trade practice unlawful under this act when, in the course of his business and in connection with a consumer transaction, he knowingly:", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-wcpa-unlawful-practices" }, { "id": "q1-genetic-informed-consent", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-102", "citation": "Wyo. Stat. § 35-32-102(a).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "Wyoming's genetic-data chapter prohibits obtaining, testing, retaining, or disclosing an individual's genetic data without informed consent, subject to enumerated exceptions.", "verbatimQuote": "Except as provided in subsection (b) of this section, no person conducting genetic testing shall do any of the following without the informed consent of the individual or the individual's authorized representative: (i) Obtain an individual's genetic data; (ii) Perform genetic testing on an individual; (iii) Retain an individual's genetic data; (iv) Disclose an individual's genetic data.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-q1-genetic-informed-consent" }, { "id": "mugshot-removal", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-601", "citation": "Wyo. Stat. § 40-12-601(a).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "A website operator that disseminates arrest photographs and charges for removal must remove a photograph and related personal information without charge within thirty days of a qualifying written request.", "verbatimQuote": "A person who operates a website that disseminates photographic records of arrested individuals made by law enforcement agencies as part of routinely documenting an arrest and who charges individuals to remove their photographs shall remove any photograph and related name and personal information from all websites owned or controlled by that person without charging a fee within thirty (30) days of the date of a request to remove the photograph and information if the request:", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-mugshot-removal" }, { "id": "q1-fed-ftc5", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "FTC Act § 5", "citation": "15 U.S.C. § 45(a)(1).", "url": "https://www.law.cornell.edu/uscode/text/15/45", "deepLink": "https://www.law.cornell.edu/uscode/text/15/45#:~:text=Unfair%20methods%20of%20competition%20in,commerce%2C%20are%20hereby%20declared%20unlawful.", "proposition": "Section 5 of the FTC Act declares unfair or deceptive acts or practices in or affecting commerce unlawful, which reaches privacy misrepresentations by businesses nationwide.", "verbatimQuote": "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-q1-fed-ftc5" } ] }, { "slug": "privacy-policy-contents", "label": "What must your Wyoming privacy policy contain?", "heading": "What must your Wyoming privacy policy contain?", "answerText": "No Wyoming statute requires a general consumer privacy policy or fixes what it must say. The one state-law exception is sectoral: a direct-to-consumer genetic testing company must make available both a high-level privacy-policy overview and a prominent, publicly available privacy notice covering its data collection, consent, use, access, disclosure, transfer, security, retention, and deletion practices. For everyone else, the governing rule is that whatever you publish has to be true — under Section 5 of the FTC Act, and under the Wyoming Consumer Protection Act by the same logic, a policy that misstates how you collect, use, share, or secure data is a deceptive practice.", "sources": [ { "id": "genetic-privacy-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-102(c)(i)", "citation": "Wyo. Stat. § 35-32-102(c)(i).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "A direct-to-consumer genetic testing company must provide both a high-level privacy-policy overview and a prominent, publicly available privacy notice covering collection, consent, use, access, disclosure, transfer, security, retention, and deletion practices.", "verbatimQuote": "To safeguard the privacy, confidentiality, security and integrity of a consumer's genetic data, a direct to consumer genetic testing company shall: (i) Provide clear and complete information regarding the company's policies and procedures for the collection, use or disclosure of genetic data by making available to a consumer: (A) A high-level privacy policy overview that includes essential information about the company's collection, use or disclosure of genetic data; and (B) A prominent, publicly available privacy notice that includes, at a minimum, information about the company's data collection, consent, use, access, disclosure, transfer, security and retention and deletion practices.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-genetic-privacy-notice" }, { "id": "q2-fed-ftc5", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "FTC Act § 5", "citation": "15 U.S.C. § 45(a)(1).", "url": "https://www.law.cornell.edu/uscode/text/15/45", "deepLink": "https://www.law.cornell.edu/uscode/text/15/45#:~:text=Unfair%20methods%20of%20competition%20in,commerce%2C%20are%20hereby%20declared%20unlawful.", "proposition": "Section 5 of the FTC Act declares unfair or deceptive acts or practices unlawful, which reaches a privacy policy that misstates a business's actual data practices.", "verbatimQuote": "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-q2-fed-ftc5" }, { "id": "q2-fed-hipaa-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "HIPAA Notice of Privacy Practices", "citation": "45 C.F.R. § 164.520(a)(1).", "url": "https://www.law.cornell.edu/cfr/text/45/164.520", "deepLink": "https://www.law.cornell.edu/cfr/text/45/164.520#:~:text=an%20individual%20has%20a%20right,respect%20to%20protected%20health%20information", "proposition": "A HIPAA covered entity must give individuals a notice describing the uses and disclosures of their protected health information and their rights and the entity's legal duties.", "verbatimQuote": "an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-q2-fed-hipaa-notice" } ] }, { "slug": "vendor-contracts", "label": "What must your contracts with vendors say?", "heading": "What must your contracts with vendors say?", "answerText": "Wyoming has no omnibus data-processing-agreement requirement — no state statute prescribes controller-to-processor terms, audit rights, deletion clauses, or subprocessor flow-downs for general commercial contracts. The breach statute does impose one vendor-facing duty: a person that maintains computerized personal identifying information on behalf of another business must disclose any breach of the security of the system to that business as soon as practicable, and the two may agree by contract which of them gives the required consumer notice.", "sources": [ { "id": "breach-data-maintainer", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-502(g)", "citation": "Wyo. Stat. § 40-12-502(g).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "A vendor that maintains computerized personal identifying information on another business's behalf must disclose a breach to that business as soon as practicable, and the parties may agree which of them provides the required notice.", "verbatimQuote": "Any person who maintains computerized data that includes personal identifying information on behalf of another business entity shall disclose to the business entity for which the information is maintained any breach of the security of the system as soon as practicable following the determination that personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person. The person who maintains the data on behalf of another business entity and the business entity on whose behalf the data is maintained may agree which person or entity will provide any required notice as provided in subsection (a) of this section, provided only a single notice for each breach of the security of the system shall be required.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-breach-data-maintainer" }, { "id": "genetic-service-provider", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-102(b)(xi)", "citation": "Wyo. Stat. § 35-32-102(b)(xi).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "The genetic-data chapter excepts from its informed-consent requirement services limited to storage, retrieval, handling, or transmission of genetic data by a third-party service provider acting under a contract.", "verbatimQuote": "Services limited to storage, retrieval, handling or transmission of genetic data by a third party service provider pursuant to a contract or other obligation;", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-genetic-service-provider" }, { "id": "fed-glba-safeguards", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "GLBA Safeguards Rule", "citation": "16 C.F.R. § 314.4(f)(2).", "url": "https://www.law.cornell.edu/cfr/text/16/314.4", "deepLink": "https://www.law.cornell.edu/cfr/text/16/314.4#:~:text=Requiring%20your%20service%20providers%20by,implement%20and%20maintain%20such%20safeguards", "proposition": "The GLBA Safeguards Rule requires a financial institution to oversee its service providers, including by requiring them by contract to implement and maintain appropriate safeguards for customer information.", "verbatimQuote": "Requiring your service providers by contract to implement and maintain such safeguards", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-fed-glba-safeguards" }, { "id": "fed-hipaa-baa", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "HIPAA Business Associate Contracts", "citation": "45 C.F.R. § 164.504(e)(2).", "url": "https://www.law.cornell.edu/cfr/text/45/164.504", "deepLink": "https://www.law.cornell.edu/cfr/text/45/164.504#:~:text=A%20contract%20between%20the%20covered,and%20a%20business%20associate%20must", "proposition": "HIPAA requires a written business-associate contract that establishes the permitted uses and disclosures of protected health information and binds the business associate to safeguard it.", "verbatimQuote": "A contract between the covered entity and a business associate must", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-fed-hipaa-baa" } ] }, { "slug": "consumer-rights", "label": "What rights do Wyoming consumers have over their personal data?", "heading": "What rights do Wyoming consumers have over their personal data?", "answerText": "None of general application — Wyoming law gives consumers no across-the-board rights to access, delete, correct, or port personal data, no right to opt out of its sale or of targeted advertising, and no recognition of universal opt-out signals such as Global Privacy Control. The exceptions are domain-specific. For genetic data, an individual or an authorized representative may inspect, correct, and obtain the individual's genetic data, and a direct-to-consumer genetic testing company must provide a process to access genetic data, delete the account and genetic data, and obtain destruction of the biological sample. For credit data, a consumer may place a security freeze that blocks a consumer reporting agency from releasing the credit report for new-credit purposes without prior authorization.", "sources": [ { "id": "genetic-inspect-correct", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-103(a)", "citation": "Wyo. Stat. § 35-32-103(a).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "An individual or the individual's authorized representative may inspect, correct, and obtain the individual's genetic data.", "verbatimQuote": "An individual or the individual's authorized representative may inspect, correct and obtain genetic data about the individual.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-genetic-inspect-correct" }, { "id": "genetic-deletion-process", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-102(c)(v)", "citation": "Wyo. Stat. § 35-32-102(c)(v).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "A direct-to-consumer genetic testing company must provide a process for a consumer to access genetic data, delete the account and genetic data, and obtain destruction of the biological sample.", "verbatimQuote": "Provide a process for a consumer to: (A) Access the consumer's genetic data; (B) Delete the consumer's account and genetic data; and (C) Request and obtain the destruction of the consumer's biological sample.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-genetic-deletion-process" }, { "id": "genetic-destroy-request", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-103(b)", "citation": "Wyo. Stat. § 35-32-103(b).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "A person conducting genetic testing must destroy an individual's genetic data on request unless the data was obtained under a statutory exception or retention is necessary for a purpose disclosed in the informed consent.", "verbatimQuote": "A person conducting genetic testing shall destroy an individual's genetic data upon request by the individual or the individual's authorized representative unless: (i) The data was obtained pursuant to W.S. 35-32-102(b); or (ii) Retention of the data is necessary for a purpose disclosed to the individual or representative in the informed consent.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-genetic-destroy-request" }, { "id": "security-freeze", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-503(b)", "citation": "Wyo. Stat. § 40-12-503(b).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "Once a security freeze is in place, a consumer reporting agency may not release the consumer's credit report or information from it for new-credit purposes without the consumer's prior authorization.", "verbatimQuote": "If a security freeze is in place, a consumer reporting agency may not release a consumer's credit report or information derived from the credit report to a third party that intends to use the information to determine a consumer's eligibility for credit or the opening of a new account without prior authorization from the consumer.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-security-freeze" } ] }, { "slug": "genetic-data-consent", "label": "Do you need consent to collect or share genetic data in Wyoming?", "heading": "Do you need consent to collect or share genetic data in Wyoming?", "answerText": "Yes. No person conducting genetic testing may obtain, test, retain, or disclose an individual's genetic data without informed consent, subject to enumerated exceptions such as law enforcement, court orders, paternity determinations, newborn screening, and anonymous research. Direct-to-consumer genetic testing companies face a layered express-consent regime on top of that baseline: initial express consent for the collection itself, plus separate express consent before transferring genetic data to anyone beyond vendors and service providers or using it beyond the primary purpose of the testing service.", "sources": [ { "id": "q5-genetic-informed-consent", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-102(a)", "citation": "Wyo. Stat. § 35-32-102(a).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "No person conducting genetic testing may obtain, test, retain, or disclose an individual's genetic data without informed consent, subject to the exceptions in subsection (b).", "verbatimQuote": "Except as provided in subsection (b) of this section, no person conducting genetic testing shall do any of the following without the informed consent of the individual or the individual's authorized representative: (i) Obtain an individual's genetic data; (ii) Perform genetic testing on an individual; (iii) Retain an individual's genetic data; (iv) Disclose an individual's genetic data.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-q5-genetic-informed-consent" }, { "id": "genetic-express-consent", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-102(c)(ii)", "citation": "Wyo. Stat. § 35-32-102(c)(ii).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "A direct-to-consumer genetic testing company must obtain initial express consent describing uses, access, and sharing of genetic data, plus separate express consent before transfers beyond vendors and service providers or uses beyond the primary purpose of the service.", "verbatimQuote": "Obtain a consumer's consent for the collection, use or disclosure of the consumer's genetic data including, at a minimum: (A) Initial express consent that describes the uses of the genetic data collected through the genetic testing product or service, and specifies who has access to test results and how the genetic data may be shared; (B) Separate express consent for transferring or disclosing the consumer's genetic data to any person other than the company's vendors and service providers, or for using genetic data beyond the primary purpose of the genetic testing product or service and inherent contextual uses;", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-genetic-express-consent" }, { "id": "genetic-sample-retention-consent", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-102(c)(ii)(C)", "citation": "Wyo. Stat. § 35-32-102(c)(ii)(C).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "A direct-to-consumer genetic testing company must obtain separate express consent to retain a consumer's biological sample after the initial testing service is complete.", "verbatimQuote": "Separate express consent for the retention of any biological sample provided by the consumer following completion of the initial testing service requested by the consumer;", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-genetic-sample-retention-consent" }, { "id": "genetic-marketing-consent", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-102(c)(ii)(E)", "citation": "Wyo. Stat. § 35-32-102(c)(ii)(E).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "A direct-to-consumer genetic testing company must obtain separate express consent for marketing based on a consumer's genetic data or based on the consumer having ordered or purchased a genetic testing product or service.", "verbatimQuote": "Separate express consent for marketing to a consumer based on the consumer's genetic data, or for marketing by a third party person to a consumer based on the consumer having ordered or purchased a genetic testing product or service.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-genetic-marketing-consent" }, { "id": "genetic-legal-process-security", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-102(c)(iii)-(iv)", "citation": "Wyo. Stat. § 35-32-102(c)(iii)-(iv).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "A direct-to-consumer genetic testing company must require valid legal process before disclosing genetic data to law enforcement or other government agencies absent express written consent, and must maintain a comprehensive security program protecting genetic data.", "verbatimQuote": "Require valid legal process for disclosing genetic data to law enforcement or any other government agency without a consumer's express written consent; (iv) Develop, implement and maintain a comprehensive security program that protects a consumer's genetic data against unauthorized access, use or disclosure", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-genetic-legal-process-security" }, { "id": "genetic-insurer-employer", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-102(d)", "citation": "Wyo. Stat. § 35-32-102(d).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "A direct-to-consumer genetic testing company may not disclose a consumer's genetic data to health, life, or long-term-care insurers, or to the consumer's employer, without the consumer's written consent.", "verbatimQuote": "Notwithstanding any other provisions in this section, a direct to consumer genetic testing company shall not disclose a consumer's genetic data to any entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer without the consumer's written consent.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-genetic-insurer-employer" }, { "id": "genetic-no-waiver", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-105(a)", "citation": "Wyo. Stat. § 35-32-105(a).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "The genetic-data chapter's provisions applicable to direct-to-consumer genetic testing companies cannot be waived, so contract terms purporting to waive them are ineffective.", "verbatimQuote": "The provisions of this chapter applicable to direct to consumer genetic testing companies shall not be waived.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-genetic-no-waiver" }, { "id": "genetic-hipaa-carveout", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-105(b)", "citation": "Wyo. Stat. § 35-32-105(b).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "The genetic-data chapter does not apply to protected health information collected by a HIPAA covered entity or business associate.", "verbatimQuote": "This chapter shall not apply to protected health information that is collected by a covered entity or business associate governed by the privacy, security and breach notification rules issued by the United States Department of Health and Human Services", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-genetic-hipaa-carveout" } ] }, { "slug": "breach-notification", "label": "When must you notify people of a data breach in Wyoming?", "heading": "When must you notify people of a data breach in Wyoming?", "answerText": "An individual or commercial entity that conducts business in Wyoming and owns or licenses computerized personal identifying information about Wyoming residents must, on becoming aware of a breach, conduct a good-faith, reasonable, and prompt investigation into the likelihood of misuse — and if misuse has occurred or is reasonably likely, give notice to affected residents as soon as possible, in the most expedient time possible and without unreasonable delay. There is no fixed day-count deadline and no Attorney General or consumer-reporting-agency notification trigger in the statute; the clock is the reasonableness standard itself.", "sources": [ { "id": "breach-notice-duty", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-502(a)", "citation": "Wyo. Stat. § 40-12-502(a).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "A business that owns or licenses computerized personal identifying information of Wyoming residents must promptly investigate a suspected breach and, if misuse occurred or is reasonably likely, notify affected residents as soon as possible and without unreasonable delay.", "verbatimQuote": "An individual or commercial entity that conducts business in Wyoming and that owns or licenses computerized data that includes personal identifying information about a resident of Wyoming shall, when it becomes aware of a breach of the security of the system, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal identifying information has been or will be misused. If the investigation determines that the misuse of personal identifying information about a Wyoming resident has occurred or is reasonably likely to occur, the individual or the commercial entity shall give notice as soon as possible to the affected Wyoming resident. Notice shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-breach-notice-duty" }, { "id": "breach-pii-definition", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-501(a)(vii)", "citation": "Wyo. Stat. § 40-12-501(a)(vii).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "Personal identifying information under the breach statute is a name combined with one or more unredacted data elements specified in Wyoming's identity-theft statute, W.S. 6-3-901(b)(iii) through (xiv).", "verbatimQuote": "\"Personal identifying information\" means the first name or first initial and last name of a person in combination with one (1) or more of the data elements specified in W.S. 6-3-901(b)(iii) through (xiv), when the data elements are not redacted.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-breach-pii-definition" }, { "id": "breach-notice-contents", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-502(e)", "citation": "Wyo. Stat. § 40-12-502(e).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "Breach notices must be clear and conspicuous and include, at a minimum, a toll-free contact number, the types of personal identifying information involved, a general description of the incident, the approximate breach date if determinable, the remedial actions taken, vigilance advice, and whether notice was delayed for law enforcement.", "verbatimQuote": "Notice required under subsection (a) of this section shall be clear and conspicuous and shall include, at a minimum: (i) A toll-free number: (A) That the individual may use to contact the person collecting the data, or his agent; and (B) From which the individual may learn the toll-free contact telephone numbers and addresses for the major credit reporting agencies. (ii) The types of personal identifying information that were or are reasonably believed to have been the subject of the breach; (iii) A general description of the breach incident; (iv) The approximate date of the breach of security, if that information is reasonably possible to determine at the time notice is provided; (v) In general terms, the actions taken by the individual or commercial entity to protect the system containing the personal identifying information from further breaches; (vi) Advice that directs the person to remain vigilant by reviewing account statements and monitoring credit reports; (vii) Whether notification was delayed as a result of a law enforcement investigation, if that information is reasonably possible to determine at the time the notice is provided.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-breach-notice-contents" }, { "id": "breach-substitute-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-502(d)(iii)", "citation": "Wyo. Stat. § 40-12-502(d)(iii).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "Substitute notice is available only if the business demonstrates that notice costs would exceed statutory dollar thresholds, that the affected class exceeds statutory volume thresholds, or that it lacks sufficient contact information.", "verbatimQuote": "Substitute notice, if the person demonstrates: (A) That the cost of providing notice would exceed ten thousand dollars ($10,000.00) for Wyoming-based persons or businesses, and two hundred fifty thousand dollars ($250,000.00) for all other businesses operating but not based in Wyoming; (B) That the affected class of subject persons to be notified exceeds ten thousand (10,000) for Wyoming-based persons or businesses and five hundred thousand (500,000) for all other businesses operating but not based in Wyoming; or (C) The person does not have sufficient contact information.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-breach-substitute-notice" }, { "id": "breach-le-delay", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-502(b)", "citation": "Wyo. Stat. § 40-12-502(b).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "Breach notification may be delayed if a law enforcement agency determines in writing that notification may seriously impede a criminal investigation.", "verbatimQuote": "The notification required by this section may be delayed if a law enforcement agency determines in writing that the notification may seriously impede a criminal investigation.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-breach-le-delay" }, { "id": "breach-hipaa-harbor", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-502(h)", "citation": "Wyo. Stat. § 40-12-502(h).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "A HIPAA covered entity or business associate that notifies affected Wyoming customers in compliance with the HIPAA breach-notification rules is deemed compliant with the Wyoming breach statute.", "verbatimQuote": "A covered entity or business associate that is subject to and complies with the Health Insurance Portability and Accountability Act, and the regulations promulgated under that act, 45 C.F.R. Parts 160 and 164, is deemed to be in compliance with this section if the covered entity or business associate notifies affected Wyoming customers or entities in compliance with the requirements of the Health Insurance Portability and Accountability Act and 45 C.F.R. Parts 160 and 164.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-breach-hipaa-harbor" } ] }, { "slug": "consumer-lawsuit", "label": "Can a consumer sue your business under Wyoming privacy law?", "heading": "Can a consumer sue your business under Wyoming privacy law?", "answerText": "Not under the breach statute — enforcement of the notification duty belongs to the Attorney General, who may bring an action in law or equity for compliance, damages, or both. But two other Wyoming statutes do open the courthouse door. The Wyoming Consumer Protection Act lets a person sue for actual damages suffered from an uncured unlawful deceptive trade practice, and the genetic-data chapter gives an individual whose rights were violated a civil action for an injunction and damages after written notice and a sixty-day cure window.", "sources": [ { "id": "breach-ag-enforcement", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-502(f)", "citation": "Wyo. Stat. § 40-12-502(f).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "The Attorney General enforces the breach-notification statute through actions in law or equity for compliance and damages; the statute creates no consumer private right of action.", "verbatimQuote": "The attorney general may bring an action in law or equity to address any violation of this section and for other relief that may be appropriate to ensure proper compliance with this section, to recover damages, or both. The provisions of this section are not exclusive and do not relieve an individual or a commercial entity subject to this section from compliance with all other applicable provisions of law.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-breach-ag-enforcement" }, { "id": "wcpa-private-remedy", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-108(a)", "citation": "Wyo. Stat. § 40-12-108(a).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "A person relying on an uncured unlawful deceptive trade practice may sue under the Consumer Protection Act for the damages actually suffered as a consumer.", "verbatimQuote": "A person relying upon an uncured unlawful deceptive trade practice may bring an action under this act for the damages he has actually suffered as a consumer as a result of such unlawful deceptive trade practice.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-wcpa-private-remedy" }, { "id": "wcpa-class-action", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-108(b)", "citation": "Wyo. Stat. § 40-12-108(b).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "A consumer entitled to sue over an uncured unlawful deceptive trade practice may bring a class action, and court-awarded attorney fees are determined by the time reasonably expended rather than by the amount of the judgment.", "verbatimQuote": "Any person who is entitled to bring an action under subsection (a) of this section on his own behalf against an alleged violator of this act for damages for an unlawful deceptive trade practice may bring a class action against such person on behalf of any class of persons of which he is a member and which has been damaged by such unlawful deceptive trade practice, subject to and pursuant to the Wyoming Rules of Civil Procedure governing class actions, except as herein expressly provided. If the court determines that actual damages have been suffered by reason of the unlawful deceptive trade practice, the court shall award reasonable attorney's fees to the plaintiffs in a class action under this subsection, provided that such fees shall be determined by the amount of time reasonably expended by the attorney for the plaintiffs and not by the amount of the judgment.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-wcpa-class-action" }, { "id": "wcpa-injunction", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-106", "citation": "Wyo. Stat. § 40-12-106.", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "The Attorney General may sue to restrain unlawful practices by temporary restraining order or injunction, and the court may enter additional orders to compensate identifiable persons for actual damages or restore money or property.", "verbatimQuote": "Whenever the enforcing authority has reasonable cause to believe that any person has engaged in, is engaging in, or is about to engage in any practice which is unlawful under W.S. 40-12-104 or 40-12-105, and that proceedings would be in the public interest, he may bring an action in the name of this state against such person to restrain by temporary restraining order or preliminary or permanent injunction the use of such practice. The action may be brought in the district court of the county in which the person resides or has his principal place of business or in the district court of Laramie county, Wyoming. The district court may issue temporary restraining orders, including ex parte temporary restraining orders, or preliminary or permanent injunctions, in accordance with the principles of equity, to restrain and prevent violations of this act. The court may make such additional orders or judgments as are necessary to compensate identifiable persons for actual damages or restoration of money or property, real or personal, which may have been acquired by means or any act or practice restrained.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-wcpa-injunction" }, { "id": "wcpa-cure-definition", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-102(a)(ix)", "citation": "Wyo. Stat. § 40-12-102(a)(ix).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "A deceptive trade practice is uncured — and therefore actionable privately — only after consumer notice and either no cure offer within fifteen days or a failure to cure within a reasonable time after acceptance.", "verbatimQuote": "\"Uncured unlawful deceptive trade practice\" means an unlawful deceptive trade practice as defined in W.S. 40-12-105: (A) With respect to which a consumer who has been damaged by the unlawful deceptive trade practice has given notice to the alleged violator pursuant to W.S. 40-12-109; and (B) Either: (I) No offer to cure has been made to such consumer within fifteen (15) days after such notice; or (II) The unlawful deceptive trade practice has not been cured as to such consumer within a reasonable time after his acceptance of the offer to cure.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-wcpa-cure-definition" }, { "id": "wcpa-civil-penalty", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-113(c)", "citation": "Wyo. Stat. § 40-12-113(c).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "A willful violation of the Consumer Protection Act carries a civil penalty of up to ten thousand dollars per violation, recoverable by the enforcing authority.", "verbatimQuote": "Except as provided in W.S. 40-12-111, any person or agent or employee of the person, who willfully uses, or has willfully used, a method or act, in violation of this act, is liable for a civil penalty of not more than ten thousand dollars ($10,000.00) for each violation. Willful violations occur when the person knew or should have known that the person's conduct was unfair or deceptive.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-wcpa-civil-penalty" }, { "id": "wcpa-elder-penalty", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 40-12-111(b)", "citation": "Wyo. Stat. § 40-12-111(b).", "url": "https://wyoleg.gov/statutes/compress/title40.pdf", "proposition": "Willful violations that victimize older persons or persons with disabilities require restitution and carry a civil penalty of up to fifteen thousand dollars per violation, recoverable by the Attorney General.", "verbatimQuote": "Any person who willfully uses, or has willfully used, a method, act or practice in violation of this act which victimizes or attempts to victimize an older person or a person with disabilities, and commits such violation when the person knew or should have known that the conduct was unfair or deceptive, shall make restitution or reimbursement to the older person or person with disabilities including reasonable attorney fees and costs, and, in addition, is liable for a civil penalty of up to fifteen thousand dollars ($15,000.00) for each violation recoverable by the office of the attorney general.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-wcpa-elder-penalty" }, { "id": "genetic-private-action", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-104(a)-(b)", "citation": "Wyo. Stat. § 35-32-104(a)-(b).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "Violating the genetic-data chapter is a misdemeanor, and an individual whose rights are violated may bring a civil action for an injunction and damages after written notice and a sixty-day cure period, with a prevailing party able to recover costs, expenses, and reasonable attorney fees.", "verbatimQuote": "Any person violating the provisions of this chapter is guilty of a misdemeanor punishable by a fine of not more than one thousand dollars ($1,000.00) for each violation. (b) An individual whose rights have been violated under the provisions of this chapter may bring a civil action to enjoin or restrain any violation of this chapter and may in the same action seek damages from the person violating this chapter. Prior to filing an action under this subsection the individual shall give notice in writing to the alleged violator stating fully the nature of the alleged violation. The alleged violator shall have not more than sixty (60) days from the date notice is provided to cure any violation. If, after sixty (60) days the violation has not been cured, the individual may bring a civil action. A prevailing party in an action brought under this subsection may recover all costs and expenses reasonably associated with the action, including but not limited to reasonable attorney fees.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-genetic-private-action" }, { "id": "genetic-ag-penalty", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "Wyo. Stat. § 35-32-104(c)", "citation": "Wyo. Stat. § 35-32-104(c).", "url": "https://wyoleg.gov/statutes/compress/title35.pdf", "proposition": "The Attorney General may enforce the genetic-data chapter in the name of the state or as parens patriae, with a civil penalty of two thousand five hundred dollars per violation plus actual consumer damages and fees.", "verbatimQuote": "The attorney general may bring an action in the name of the state or as parens patriae on behalf of consumers to enforce this chapter. In any action brought by the attorney general to enforce this chapter, a person found to have violated this chapter shall be subject to a civil penalty of two thousand five hundred dollars ($2,500.00) for each violation, the recovery of actual damages incurred by consumers on whose behalf the action was brought and costs and reasonable attorneys' fees incurred by the office of the attorney general.", "anchor": "https://openagreements.org/practice-guides/privacy/us/wyoming#src-genetic-ag-penalty" } ] } ] } }