Quick Facts
Breach Based on Harm Threshold: Yes
Deadline for Consumer Notice: Most expedient time possible without unreasonable delay
Government Notification Required: No
Scope of this Summary:
Notification requirements applicable to individuals and commercial entities that conduct business in the state and own, license, or maintain covered info. Some types of businesses may be exempt from some or all of these requirements, and non-commercial entities may be subject to different requirements.
Risk of Harm Threshold
Notification not required if, after a reasonable and prompt investigation, covered entity determines that misuse of covered info about a Wyoming resident has not occurred and is not likely to occur.
Breach Defined
Unauthorized acquisition of computerized data that materially compromises the security, confidentiality, or integrity of the covered info, excluding certain good-faith acquisitions by employees or agents.
Encryption Safe Harbor
Statute does not apply to information where data elements are redacted.
Form of Covered Information
Electronic Only
Covered Information
The first name or first initial and last name of a person in combination with one or more of the data elements:
- Social Security number.
- Driver's license number.
- Account number, credit card number or debit card number in combination with any security code, access code or password that would allow access to a financial account of the person.
- Tribal identification card.
- Federal or state government-issued identification card.
- Shared secrets or security tokens that are known to be used for data-based authentication.
- A username or email address, in combination with a password or security question and answer that would permit access to an online account.
- A birth or marriage certificate.
- Medical information, meaning a person's medical history, mental or physical condition, or medical treatment or diagnosis by a healthcare professional.
- Health insurance information, meaning a person's health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the person or information related to a person's application and claims history.
- Unique biometric data, meaning data generated from measurements or analysis of human body characteristics for authentication purposes.
- An individual taxpayer identification number.
Consumer Notice Timing
Must be made in the most expedient time possible without unreasonable delay following determination that covered info has been or will be misused, consistent with any measures to determine the scope of the breach and to restore the reasonable integrity of the system.
Consumer Notice Method
Written notice. Electronic mail notice. Substitute notice is available if certain criteria are satisfied.
Consumer Notice Content
The notification shall be clear and conspicuous and shall include, at a minimum:
- A toll-free number
- That the individual may use to contact the person collecting the data, or his agent; and
- From which the individual may learn the toll-free contact telephone numbers and addresses for the major credit reporting agencies.
- The types of personally identifying information that were or are reasonably believed to have been the subject of the breach.
- A general description of the breach incident.
- The approximate date of the breach of security, if that information is reasonably possible to determine at the time notice is provided.
- In general terms, the actions taken by the individual or commercial entity to protect the system containing the personally identifying information from further breaches.
- Advice that directs the person to remain vigilant by reviewing account statements and monitoring credit reports.
- Whether notification was delayed as a result of a law enforcement investigation, if that information is reasonably possible to determine at the time the notice is provided.
Delayed Notice
Notification may be delayed if law enforcement determines in writing that notification may seriously impede a criminal investigation.
Government Notice
The Wyoming statute does not require notice to any government or regulatory agencies.
Consumer Reporting Agency Notice
The Wyoming statute does not require notification to credit reporting agencies.
Exceptions for Other Laws
The statute includes certain exceptions for entities that are subject to either the Gramm-Leach-Bliley Act (GLBA) or Health Insurance Portability and Accountability Act (HIPAA) if those entities notify affected Wyoming residents in compliance with the requirements of those laws.
Third-Party Notice
If you maintain covered info on behalf of another entity, you must notify it as soon as practicable following determination of a breach.
Private Right of Action
The Wyoming statute does not provide for a private right of action.
Potential Penalties
Violations may result in civil penalties.
This summary is for informational purposes only. It provides general information and not legal advice or opinions regarding specific facts. Additional requirements or conditions may apply to any or all provisions referenced herein. For more information about the state data breach notification laws or other data security matters, please seek the advice of counsel.
Last revised on June 15, 2023