In this subchapter: (1) “Authorized individual” means an individual who is known to and screened by a licensee and whose access to the licensee’s information system or nonpublic information is determined by the licensee to be necessary and appropriate. (2) “Consumer” means an individual who is a resident of this state and whose nonpublic information is in the possession, custody, or control of a licensee. (3) “Cybersecurity event” means an event resulting in the unauthorized access to, or disruption or misuse of, an information system or the nonpublic information stored on an information system, except that a “cybersecurity event” does not include any of the following: (a) The unauthorized acquisition of encrypted nonpublic information if the encryption process or key is not also acquired, released, or used without authorization. (b) The unauthorized acquisition of nonpublic information if the licensee determines that the nonpublic information has not been used or released and has been returned to the licensee or destroyed. (4) “Encrypted” means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key. (5) “Information security program” means the administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information. (6) “Information system” means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of nonpublic information, as well as any specialized system, including an industrial or process controls system, telephone switching and private branch exchange system, and environmental control system. (7) “Licensee” means a person licensed, authorized, or registered, or a person required to be licensed, authorized, or registered, under chs. 600 to 655, other than a purchasing or risk retention group that is chartered and licensed in another state or a person acting as an assuming insurer that is domiciled in another state or jurisdiction. (8) “Multifactor authentication” means authentication through verification of at least 2 of the following types of authentication factors: (a) Knowledge factor, including a password. (b) Possession factor, including a token or text message on a mobile phone. (c) Inherence factor, including a biometric characteristic. (9) “Nonpublic information” means electronic information in the possession, custody, or control of a licensee that is not publicly available information and is any of the following: (a) Information concerning a consumer that can be used to identify the consumer, in combination with at least one of the following data elements: 1. Social security number. 2. Driver’s license number or nondriver identification card number. 3. Financial account number or credit or debit card number. 4. Security code, access code, or password that permits access to a financial account. 5. Biometric records. (b) Information or data, other than information or data regarding age or gender, in any form or medium created by or derived from a health care provider or a consumer that can be used to identify the consumer and that relates to any of the following: 1. The physical, mental, or behavioral health or condition of the consumer or a member of the consumer’s family. 2. The provision of health care to the consumer. 3. Payment for the provision of health care to the consumer. (10) “Publicly available information” means information that a licensee has a reasonable basis to believe is lawfully made available to the general public from federal, state, or local government records, widely distributed media, or disclosures required by federal, state, or local law. (11) “Third-party service provider” means a person other than a licensee who contracts with a licensee to maintain, process, or store nonpublic information or is otherwise permitted access to nonpublic information through its provision of services to the licensee.
‹ Prev All Wisconsin sections Next ›
Lexace provides legal information, not legal advice, and no attorney–client relationship is created. Statute text is provided for general information and may not reflect the most recent amendments; verify against the official state code.