Wyoming lawmakers fight to set limits on private data tracked, stored by state agencies

May 21—CHEYENNE — Wyoming lawmakers are wrestling with state agencies over where they can limit the storage and use of private data, which some policymakers say is a growing problem.

At least 40 states have enacted laws that protect their residents' private data to some extent, such as the California Consumer Privacy Act, Colorado Privacy Act, and Connecticut Personal Data Privacy and Online Monitoring.

Wyoming lawmakers, however, want to create a comprehensive bill that will protect private data in every scenario, not just for consumers.

The Legislature's Select Committee on Blockchain, Financial Technology and Digital Innovation Technology considered a working bill draft on Tuesday that aims to protect citizens' private data.

House Bill 163, "Data privacy-government entities," was sponsored by the committee for the 2024 budget session, but failed to pass introduction. This bill would set a three-year limit on the retention of private data by a state or local government entity. It also would require these entities to obtain "the express written consent of the natural person" before purchasing, selling, trading or transferring their personal data.

The bill exempts the consent requirement "as otherwise expressly provided by law and except that a government entity may transfer personal data to another government entity, provided that the other government entity complies with this article."

Co-Chairman Sen. Chris Rothfuss, D-Laramie, told the Wyoming Tribune Eagle on Thursday that data privacy "is really a challenge" that needs to be addressed in Wyoming.

There are currently no requirements for any state or local government entity to provide citizens the right to access, alter or delete their own private records, Rothfuss said.

Many Wyomingites may also be unaware of the personal information that is being stored through a governmental agency.

State agencies have argued in the past that the storage and use of private data helps them to conduct research and develop modeling trends.

"A lot of privacy is ridiculously inconvenient for the government," Rothfuss said. "But it doesn't necessarily mean the public wants to give up its privacy."

On Tuesday, three state agencies — Wyoming Department of Health, Wyoming State Archives and Wyoming Community College Commission — provided testimony on how HB 163 would affect and potentially disrupt their services.

Colleges purchasing data

Lawmakers were surprised to learn that community colleges purchase private data from social media companies, like Meta, to attract student applicants. One provision in HB 163 would prohibit any state or local government entity from purchasing or selling private data.

WCCC Chief Technology Officer Paris Edeburn said purchased personal data is stored at the community college level and doesn't reach the commission unless that person becomes a student. That data is then protected under the Family Educational Rights and Privacy Act (FERPA).

"But I think it does call into question who sold the data to you? And how did they get the data in the first place?" Rothfuss said. "That, I think, is the inspiration for the creepy factor of where did that data come from? And why are we selling data about students in the state of Wyoming?"

Co-Chairman Rep. Cyrus Western, R-Big Horn, said this was probably "the most bothersome" portion of the day's discussion. Rothfuss asked if a person would be able to query the data of a college-aged consumer, if they're not a current student.

Edeburn said that was a question for the community colleges, since the commission doesn't receive data of non-students.

State Archives, health insurance

Social Security records, medical records and high school transcripts are all examples of personal data that is stored in the Wyoming State Archives.

State Archivist Sara Davis said the purpose of this department is "to provide long-term preservation and access to essential records of state government, which includes permanent and vital workers from state and local government agencies." Such agencies extend from the Wyoming Department of Health to local school districts.

Under state and federal law, most records have a retention period in a state agency that exceeds the three-year limit prescribed in HB 163, Davis said. If the bill were to pass, there would be written requests from a hundred state and local agencies to extend this time period.

The bill also requires state agencies to fill out a formal exemption request for a records transfer to the State Archives.

There is also an issue between the State Archives and some state agencies about maintaining records for the appropriate amount of time before transferring them to the Archives. Davis worried this additional obstacle would create a destruction of these records before their specified time period expires.

"There are certain state agencies that do not follow the guidelines at all," Davis said. "These agencies and representatives do not want to keep and maintain records or have to do extra work to maintain these records. Creating more obstacles does prohibit people from following rules and regulations."

Rep. Mike Yin, D-Jackson, said the bill only asks that agencies have a policy explaining why data records are retained for more than three years, if that is the case.

"There's no submission, there's no roadblock in that regulatory framework," Yin said. "We just have to have a policy."

Wyoming Department of Health policy analyst Franz Fuchs asked lawmakers to provide an exception to needing written consent to purchase, sell, trade or transfer personal data for any medical records under the Health Insurance Portability and Accountability Act (HIPAA) privacy rule.

Fuchs said it would be next to impossible to collect written consent from every person who is enrolled in Medicaid. Each enrollee already consented to the use of their personal data in their enrollment form.

This data helps the department in its research on medical trends in Wyoming, such as modeling long-term care transition probabilities, Fuchs said.

"It's really important to have those demographic characteristics to be able to model the risk," Fuchs said. "We do use those personal, identifiable details all the time, and modeling those demographic characteristics are very, very important to retain."

Next time

State Sen. Affie Ellis, R-Cheyenne, suggested the committee create a list of exceptions for state agencies in transferring data to a federal or tribal government entity without needing written consent. Rothfuss cautioned against a blanket green light of sharing this data with federal agencies.

"There are some concerns there," Rothfuss said. "HIPAA and FERPA aren't iron clad great laws that protect data privacy in an incredible way."

FERPA, especially, has some major "carve outs" in its policy when it comes to providing educational services, Rothfuss said, adding he was still "creeped out" by the fact community colleges are purchasing private data from social media companies.

He also suggested changing the retention limit from three years to five years, which is the minimum retention period under state law.

"I'm sensitive to some of the concerns raised that this will hold things back," Rothfuss said. "But our job is not necessarily to find ways to make things easier for the government. Our job is also to protect the rights of all of our constituents."

The bill draft was advanced to the next meeting, which will be held in Sheridan on July 1-2.

Hannah Shields is the Wyoming Tribune Eagle's state government reporter. She can be reached at 307-633-3167 or hshields@wyomingnews.com. You can follow her on X @happyfeet004.