Law note · Wyoming
Breach of the security of a computerized data system, notification duty
An individual or commercial entity that conducts business in Wyoming and owns or licenses computerized data including personal identifying information about a Wyoming resident must, on becoming aware of a breach of the security of the system, conduct a reasonable and prompt investigation, and if misuse has occurred or is reasonably likely, give notice as soon as possible to each affected resident; timing is a risk-of-harm-triggered standard, not a fixed day count.
Personal identifying information means a name combined with one or more data elements defined by cross-reference to Wyoming's criminal identity-theft statute, Wyo. Stat. Ann. sec. 6-3-901(b), which includes unique biometric data generated from measurements or analysis of human body characteristics for authentication purposes, medical information, and health insurance information, alongside the standard Social Security, driver's license, and financial account elements; none of these carries an exclusion for data derived from a photograph, video, or audio recording.
Personal identifying information excludes information contained in government records or widely distributed media lawfully made available to the general public, regardless of its source. Substitute notice is available when the cost of direct notice would exceed $10,000 for a Wyoming-based entity or $250,000 for an out-of-state entity, or when the affected class exceeds 10,000 Wyoming-based persons or 500,000 out-of-state persons.
This document did not independently trace the original enacting session law's date, and the codified page prints no separate commencement subsection within this article, so no effective_date is recorded here.
What it asks of an app
- Give notice as soon as possible to each affected Wyoming resident once your investigation determines misuse of their personal identifying information has occurred or is reasonably likely.
- Treat a biometric identifier used for authentication as personal identifying information here, whether or not it was derived from a photograph, video, or audio recording. No recording-derived exclusion exists in this cross-referenced definition.
- Use substitute notice only when direct notice would exceed the statute's cost or class-size thresholds, which differ for a Wyoming-based versus an out-of-state entity.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, processes_biometrics
Primary source: official Wyoming statute text, Wyo. Stat. Ann. secs. 40-12-501 to 40-12-511, Wyoming Legislature website (compressed statutes, Title 40)