(a) No government entity shall purchase, sell, trade or transfer personal data without the express written consent of the natural person whom the personal data references except as otherwise expressly provided by law and except that:
(i) A government entity may transfer personal data to another government entity provided that the other government entity complies with this article;
(ii) A government entity may transfer personal data to a nongovernment entity contracted by the government entity to provide or assist with government services provided by the government entity. Any contract for services with a nongovernment entity shall include requirements for the protection of personal data consistent with this article. Any personal data transferred pursuant to this paragraph shall be returned or destroyed by the nongovernment entity once the personal data is no longer necessary for the provision of the government service. No nongovernment entity shall maintain, sell, transfer, process or otherwise use the personal data in any manner except as necessary to provide the contracted service;
(iii) A government entity may petition the elected governing person or body with authority over the government entity for an exception to this subsection on a case by case basis. The elected governing person or body, in the elected governing person's or body's discretion, may publicly approve in writing an exception to this subsection not to exceed a term of two (2) years per petition; and
(iv) Nothing in this subsection shall be construed to prohibit the transfer of personal data that is transferrable pursuant to the Health Insurance Portability and Accountability Act or the Family Education Rights and Privacy Act.
(b) Any current or former Wyoming resident or the resident's legally authorized representative may request a copy of their personal data from any government entity maintaining it. The government entity may charge a fee for production of the requested personal data consistent with fees authorized to be charged under the Wyoming Public Records Act, W.S. 16-4-201 through 16-4-205.
(c) A current or former Wyoming resident or the resident's legally authorized representative who objects to the accuracy, completeness, pertinence, timeliness, relevance, retention, dissemination or denial of access to the resident's own personal data that is maintained by a government entity may, individually or through a duly authorized representative, file an objection with the government entity that maintains the data. The government entity maintaining the personal data shall, within sixty (60) days of the receipt of an objection:
(i) Verify the identity of the current or former Wyoming resident or the resident's legally authorized representative who filed the objection with the government entity;
(ii) Review the validity of the objection;
(iii) If the objection is found to be meritorious after review, alter the contents of, or the methods for holding, or the dissemination or use of the personal data, or delete or grant access to it;
(iv) If the objection is found to lack merit after review, provide the resident the opportunity to have a statement reflecting the resident's views maintained with the personal data in question;
(v) Notify the resident in writing of any decision regarding the resident's objection.
(d) To the extent that a provision of this article conflicts with another provision of state or federal law, the other provision shall control. Nothing in this article shall be construed to abrogate any disclosure of data or public records under the Wyoming Public Records Act, W.S. 16-4-201 through 16-4-205.
