EdLaw
Wyoming — computer security breach notice (W.S. 40-12-501 and 40-12-502)
Wyoming's breach-notification rules sit in Title 40 (Trade and Commerce), chapter 12, Article 5, "Credit Freeze Reports". Article 5 also holds the security-freeze and identity-theft sections. W.S. 40-12-501 through 40-12-509 were created by 2007 Senate File 53 (Enrolled Act No. 76, 2007 General Session), whose section 2 reads "This act is effective July 1, 2007." W.S. 40-12-502 applies to an "individual or commercial entity that conducts business in Wyoming and that owns or licenses computerized data that includes personal identifying information about a resident of Wyoming". On a breach it must investigate in good faith, and if misuse "has occurred or is reasonably likely to occur", notify the affected resident "as soon as possible" (W.S. 40-12-502(a)). A person that maintains such data on behalf of another business entity must disclose the breach to that entity ((g)).
Applicability to EdTech
- A vendor holding data for a business must tell that business. "Any person who maintains computerized data that includes personal identifying information on behalf of another business entity shall disclose to the business entity for which the information is maintained any breach of the security of the system as soon as practicable". The two may agree which of them sends the one required notice. If they cannot agree, "the person who has the direct business relationship with the resident of this state shall provide notice" (W.S. 40-12-502(g)).
- Login credentials and biometric data trigger notice. Personal identifying information is a name plus one or more of the elements in W.S. 6-3-901(b)(iii)–(xiv) (W.S. 40-12-501(a)(vii)). Those elements include "A username or email address, in combination with a password or security question and answer that would permit access to an online account", "Shared secrets or security tokens that are known to be used for data based authentication", and "Unique biometric data, meaning data generated from measurements or analysis of human body characteristics for authentication purposes" (W.S. 6-3-901(b)).
- Harm threshold. A breach is an unauthorized acquisition that "materially compromises" the information and "causes or is reasonably believed to cause loss or injury to a resident of this state" (W.S. 40-12-501(a)(i)). Notice follows only where the investigation finds misuse has occurred or is reasonably likely (W.S. 40-12-502(a)).
- Notice contents are prescribed. These include a toll-free number, the types of information involved, a description of the incident and its approximate date, and the remedial steps taken (W.S. 40-12-502(e)).
- A public school district is not clearly within the statute. The duty-holder in (a) is "An individual or commercial entity that conducts business in Wyoming". For the state's own student-data rules see Wyoming — student data privacy and security.
Contents
| Document | Covers |
|---|---|
| SECURITY-BREACH.md | W.S. 40-12-501 and 40-12-502 in full; W.S. 6-3-901(b) (the incorporated data elements) |
Not reproduced: W.S. 40-12-503 to 40-12-509 (security freezes and factual declarations of innocence after identity theft), and W.S. 6-3-901(a) and (c)–(e) (the theft-of-identity offence and its penalties).
Enforcement
"The attorney general may bring an action in law or equity to address any violation of this section and for other relief that may be appropriate to ensure proper compliance with this section, to recover damages, or both" (W.S. 40-12-502(f)). Financial institutions that follow the federal Gramm-Leach-Bliley procedures, and HIPAA covered entities and business associates that notify under HIPAA, are deemed compliant (W.S. 40-12-502(c), (h)).
Licence
The corpus reproduces W.S. 40-12-501, 40-12-502 and part of 6-3-901 verbatim from the Wyoming Legislative Service Office's compiled Title 40 and Title 6 PDFs.
Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Supreme Court held that "officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties". Neither PDF carries a copyright notice or terms (title40.pdf and title06.pdf, read 2026-10-08). Their text was searched for "copyright" and "all rights reserved". The only hits were in Title 40's own chapter 13, "Copyrighted Music".
Conditions: none. The corpus names the source in Sources and in each section's {.meta} provenance line.
Related
- Wyoming — student data privacy and security — the Education Code paragraphs on student data
- District of Columbia — Consumer Security Breach Notification and Alaska Personal Information Protection Act — breach statutes with the same holder-notifies-owner rule
- FERPA — the federal education-records layer
Sources
- Wyoming Legislature — Wyoming Statutes, Title 40 (compiled PDF) — W.S. 40-12-501, 40-12-502
- Wyoming Legislature — Wyoming Statutes, Title 6 (compiled PDF) — W.S. 6-3-901
- Wyoming Legislature — 2007 SF0053, Enrolled Act No. 76 — the enacting act: section 1 creates W.S. 40-12-501 through 40-12-509; section 2, "This act is effective July 1, 2007."