Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

Data Breach Requirements: Wis. Stat. § 134.98.

core/heading

The numbering and internal citations herein are derived from the applicable state statute.

core/paragraph

(b) The term “personal information” means an individual’s last name and the individual’s first name or first initial, in combination with and linked to any of the following elements, if the element is not publicly available information and is not encrypted, redacted, or altered in a manner that renders the element unreadable:

core/list

core/separator

If an entity whose principal place of business is located in this state or an entity that maintains or licenses personal information in this state knows that personal information in the entity’s possession has been acquired by a person whom the entity has not authorized to acquire the personal information, the entity shall make reasonable efforts to notify each subject of the personal information.

An entity is not required to provide a breach notice if the personal information was acquired in good faith by an employee or agent of the entity, if the personal information is used for a lawful purpose of the entity.

An entity is not required to provide a breach notice if the acquisition of personal information does not create a material risk of identity theft or fraud to the subject of the personal information.

The breach notice shall be provided within a reasonable time, not to exceed 45 days after the entity learns of the acquisition of personal information. A determination as to reasonableness herein shall include consideration of the number of notices that an entity must provide and the methods of communication available to the entity.

A law enforcement agency may, in order to protect an investigation or homeland security, ask an entity not to provide a breach notice that is otherwise required for any period of time, and the notification process shall begin at the end of that time period. Notwithstanding, if an entity receives such a request, the entity may not provide notice of or publicize an unauthorized acquisition of personal information, except as authorized by the law enforcement agency that made the request.

The breach notice shall indicate that the entity knows of the unauthorized acquisition of personal information pertaining to the subject of the personal information.

Upon written request by a person who has received a breach notice, the entity that provided the notice shall identify the personal information that was acquired.

An entity shall provide the breach notice by mail or by a method the entity has previously employed to communicate with the subject of the personal information. If an entity cannot with reasonable diligence determine the mailing address of the subject of the personal information, and if the entity has not previously communicated with the subject of the personal information, the entity shall provide notice by a method reasonably calculated to provide actual notice to the subject of the personal information.

See Delivery Methods (reasonably calculated standard).

If, as the result of a single incident, an entity is required to notify 1,000 or more individuals that personal information pertaining to the individuals has been acquired, the entity shall without unreasonable delay notify all consumer reporting agencies of the timing, distribution, and content of the notices sent to the individuals.

The law does not apply to any of the following: (a) An entity that is subject to, and in compliance with, the privacy and security requirements of 15 USC 6801 to 6827, or a person that has a contractual obligation to such an entity, if the entity or person has in effect a policy concerning breaches of information security. (b) An entity that is described in 45 CFR 164.104(a), if the entity complies with the requirements of 45 CFR part 164.

If a person, other than an individual, who stores personal information pertaining to a resident of this state, but does not own or license the personal information, knows that the personal information has been acquired by a person whom the person storing the personal information has not authorized to acquire the personal information, and the person storing the personal information has not entered into a contract with the person that owns or licenses the personal information, the person storing the personal information shall notify the person that owns or licenses the personal information of the acquisition as soon as practicable.

(b) If an entity whose principal place of business is not located in this state knows that personal information pertaining to a resident of this state has been acquired by a person whom the entity has not authorized to acquire the personal information, the entity shall make reasonable efforts to notify each resident of this state who is the subject of the personal information. The notice shall indicate that the entity knows of the unauthorized acquisition of personal information pertaining to the resident of this state who is the subject of the personal information.

Data Disposal and Security: Wis. Stat. § 134.97.

The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.

The term “dispose” does not include a sale of a record or the transfer of a record for value.

The term “personal information” means any of the following:

The term “personally identifiable” means capable of being associated with a particular individual through one or more identifiers or other information or circumstances.

A financial institution, medical business, or tax preparation business may not dispose of a record containing personal information unless the financial institution, medical business, tax preparation business, or other person under contract with the financial institution, medical business, or tax preparation business does any of the following: (a) Shreds the record before the disposal of the record. (b) Erases the personal information contained in the record before the disposal of the record. (c) Modifies the record to make the personal information unreadable before the disposal of the record. (d) Takes actions that it reasonably believes will ensure that no unauthorized person will have access to the personal information contained in the record for the period between the record’s disposal and the record’s destruction.

Wisconsin