Wyoming government entities must limit and protect personal data

Government entities may not buy, sell, trade, or transfer personal data without the person's written consent, unless an exception applies. The rule covers Wyoming government entities but excludes the judicial branch and Wyoming law enforcement agencies. Transfers to another government entity are allowed if it follows these rules. Contractors may use data only to provide government services, must protect it, and must return or destroy it when it is no longer needed. An elected official or governing body may publicly approve a written exception for up to two years per request. Transfers allowed under federal health or education privacy laws remain allowed.

Entities that collect or keep personal data must adopt and maintain policies for handling it. The rules cover government entities that collect or keep personal data; courts and Wyoming law enforcement agencies are excluded from the article's definition of government entity. Entities may collect or keep only data reasonably needed for their lawful work, and their policies must identify a specific purpose for it. Keeping data longer than three years requires a written policy and reasonable justification. Required record-retention periods count as justification. Covered entities that follow qualifying federal health or education privacy policies meet this section's requirements. These requirements take effect July 1, 2027 for state agencies, July 1, 2028 for counties, cities, public colleges, and towns, and July 1, 2029 for other political subdivisions.

Residents may request their personal data and object to how it is handled; the entity must review and respond to an objection within 60 days. Current and former Wyoming residents, or their legally authorized representatives, may request or challenge their data held by a government entity. An objection may concern accuracy, completeness, relevance, retention, sharing, or denied access. If the objection is upheld, the entity must change, delete, or provide access to the data as appropriate. If the objection is rejected, the resident may have a statement of their views kept with the data. The entity may charge a copy fee within public-records fee limits.