(a)  As used in this article:

(i)  "Deidentified data" means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable natural person or personal digital identity or a device linked to a natural person or personal digital identity;

(ii)  "Government entity" means the state and all its political subdivisions, agencies, instrumentalities and institutions and any local government entity. "Government entity" shall not include the judicial branch of government or any law enforcement agency in Wyoming;

(iii)  "Identified or identifiable natural person" means a natural person who can be readily identified, directly or indirectly, by reference to an identifier such as a name, an identification number, specific geolocation data or an online identifier;

(iv)  "Law enforcement agency" means a county, municipal, college or university police force, Wyoming highway patrol, the division of criminal investigation, the department of corrections, the game and fish department when acting within its law enforcement capacity or any state or local agency or political subdivision or part of an agency or political subdivision to the extent that the primary purpose of the agency or political subdivision, or part thereof, is the prevention or investigation of crime or the enforcement of penal, traffic, regulatory or criminal laws. "Law enforcement agency" shall not include the office of any city, county or district attorney or other division of the attorney general;

(v)  "Personal data" means information that is linked or reasonably linkable to an identified or identifiable natural person or personal digital identity and does not include deidentified data;

(vi)  "Personal digital identity" means as defined in W.S. 8-1-102(a)(xviii).

(a)  No government entity shall purchase, sell, trade or transfer personal data without the express written consent of the natural person whom the personal data references except as otherwise expressly provided by law and except that:

(i)  A government entity may transfer personal data to another government entity provided that the other government entity complies with this article;

(ii)  A government entity may transfer personal data to a nongovernment entity contracted by the government entity to provide or assist with government services provided by the government entity. Any contract for services with a nongovernment entity shall include requirements for the protection of personal data consistent with this article. Any personal data transferred pursuant to this paragraph shall be returned or destroyed by the nongovernment entity once the personal data is no longer necessary for the provision of the government service. No nongovernment entity shall maintain, sell, transfer, process or otherwise use the personal data in any manner except as necessary to provide the contracted service;

(iii)  A government entity may petition the elected governing person or body with authority over the government entity for an exception to this subsection on a case by case basis. The elected governing person or body, in the elected governing person's or body's discretion, may publicly approve in writing an exception to this subsection not to exceed a term of two (2) years per petition; and

(iv)  Nothing in this subsection shall be construed to prohibit the transfer of personal data that is transferrable pursuant to the Health Insurance Portability and Accountability Act or the Family Education Rights and Privacy Act.

(b)  Any current or former Wyoming resident or the resident's legally authorized representative may request a copy of their personal data from any government entity maintaining it. The government entity may charge a fee for production of the requested personal data consistent with fees authorized to be charged under the Wyoming Public Records Act, W.S. 16-4-201 through 16-4-205.

(c)  A current or former Wyoming resident or the resident's legally authorized representative who objects to the accuracy, completeness, pertinence, timeliness, relevance, retention, dissemination or denial of access to the resident's own personal data that is maintained by a government entity may, individually or through a duly authorized representative, file an objection with the government entity that maintains the data. The government entity maintaining the personal data shall, within sixty (60) days of the receipt of an objection:

(i)  Verify the identity of the current or former Wyoming resident or the resident's legally authorized representative who filed the objection with the government entity;

(ii)  Review the validity of the objection;

(iii)  If the objection is found to be meritorious after review, alter the contents of, or the methods for holding, or the dissemination or use of the personal data, or delete or grant access to it;

(iv)  If the objection is found to lack merit after review, provide the resident the opportunity to have a statement reflecting the resident's views maintained with the personal data in question;

(v)  Notify the resident in writing of any decision regarding the resident's objection.

(d)  To the extent that a provision of this article conflicts with another provision of state or federal law, the other provision shall control. Nothing in this article shall be construed to abrogate any disclosure of data or public records under the Wyoming Public Records Act, W.S. 16-4-201 through 16-4-205.