State Agency Website
http://ag.wyo.gov/cpu
Timing of Consumer Notification
“Most expedient time possible and without unreasonable delay.”
Method of Notice
Mail or email.
Breach Definition
Unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal identifying information and causes or is reasonably believed to cause loss or injury to a resident of this state.
PII Definition
Individual’s first name or first initial and last name in combination with one or more of these:
  1. Social security number or individual taxpayer identification number;
  2. Driver’s license number, tribal identification card, or federal or state government issued identification card;
  3. Account number, credit card or debit card number in combination with any security code, access code or password that would allow access to a financial account;
  4. Shared secrets or security tokens known to be used for data based authentication;
  5. Username or email address, in combination with password or security question and answer that would permit access to online account;
  6. Birth or marriage certificate;
  7. Medical information, meaning a person’s medical history, mental or physical condition, or medical treatment or diagnosis by health care professional;
  8. Health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the person, or information related to a person’s application and claims history; or
  9. Unique biometric data, meaning data generated from measurements or analysis of human body characteristics for authentication purposes.
Third Party Notice
If person maintains covered information on behalf of another entity, it must notify them as soon as practicable following determination that the information was or is reasonably to have been acquired.
How to Notify
Notice must include: (a) toll-free number to contact data collector or its agent from which individual may learn contact numbers and addresses for the major credit reporting agencies; (b) types of personal identifying information that were or are reasonably believed to have been subject of breach; (c) general description of breach incident; (d) approximate date of breach if determinable at time of notice; (e) actions taken by entity to protect system containing information from further breach; (f) advice directing person to remain vigilant by reviewing account statements and monitoring credit reports; and (g) whether notice was delayed as result of a law enforcement investigation if determinable at time of notice.
Substitute Notice

If no sufficient contact information, cost of providing notice would exceed $10,000 for Wyoming-based persons or businesses and $250,000 for businesses operating but not based in Wyoming, or affected class of residents exceeds 10,000 for Wyoming-based persons or businesses and 500,000 for businesses operating but not based in Wyoming, all of the following: (a)  conspicuous posting on the entity’s website if it maintains one; and (b) notification to major statewide media, including toll-free telephone number where residents can learn whether information is included in breach.

Credit Monitoring
Not required.
When to Notify Credit Agencies
Not required.
This State's Law
Broad definition of PII.
State Government Agency Notification Required
Not required.