Wisconsin's Section 134.98: An Acquisition Statute With DNA and Biometrics, a 45-Day Limit and No Enforcer

What Section 134.98 Covers

The requirement began as 2005 Wisconsin Act 138, enacted from 2005 Senate Bill 164 on March 16, 2006 and published March 30, 2006. The act created section 895.507 of the statutes "relating to: notice regarding unauthorized acquisition of personal information." The current text at section 134.98 carries a history line of 2005 Act 138, 2007 Act 20 and 2007 Act 97, section 238. Throughout, the statute is framed around acquisition: the trigger is that an entity "knows that personal information in the entity's possession has been acquired by a person whom the entity has not authorized to acquire" it.

An "entity" is a person other than an individual that does any one of four things: conducts business in Wisconsin and maintains personal information in the ordinary course of business; licenses personal information in Wisconsin; maintains a depository account for a Wisconsin resident; or lends money to a Wisconsin resident. Subdivision (1)(a)2. adds the state and every body in state government, "including the legislature and the courts," and every city, village, town and county. Public bodies are therefore inside the same section as businesses rather than under a separate statute.

Subsection (2) divides the duty by location. An entity whose principal place of business is in Wisconsin, or that maintains or licenses personal information in Wisconsin, notifies "each subject of the personal information," wherever that subject lives. An entity based elsewhere notifies each Wisconsin resident who is a subject. A person that stores information it does not own or license, and has no contract with the owner, notifies the owner "as soon as practicable."

Biometric Data and DNA in the Definition

Personal information is a last name with a first name or initial, linked to any of five elements that is neither publicly available nor encrypted, redacted or otherwise unreadable. Three are familiar: a Social Security number; a driver's license or state identification number; and a financial account or card number "or any security code, access code, or password that would permit access to the individual's financial account." The disjunctive "or" in that element differs from statutes requiring the account number and the code together. The other two are less common:

• the individual's deoxyribonucleic acid profile, as defined in Wis. Stat. 939.74(2d)(a); and
• the individual's "unique biometric data, including fingerprint, voice print, retina or iris image, or any other unique physical representation."

Both appear in the text of Act 138 as enacted, so neither is a later addition. "Publicly available information" is defined by what the entity "reasonably believes" was lawfully made widely available through media or from government records or legally required public disclosures.

Subsection (2)(cm) then lists two situations in which notice is not required: the acquisition "does not create a material risk of identity theft or fraud to the subject," or the information was acquired in good faith by an employee or agent and is used for a lawful purpose of the entity. The statute frames these as exceptions to a duty already triggered, rather than as part of the definition of an incident.

The 45-Day Outer Limit

Under subsection (3)(a), notice is due "within a reasonable time, not to exceed 45 days after the entity learns of the acquisition of personal information." Reasonableness "shall include consideration of the number of notices that an entity must provide and the methods of communication available to the entity." Notice goes by mail or by a method the entity has previously used with the subject; if neither a mailing address nor prior communication exists, by a method reasonably calculated to give actual notice. The only content the statute prescribes is that the notice "indicate that the entity knows of the unauthorized acquisition," and under subsection (3)(c) a recipient may make a written request to be told which personal information was acquired.

Subsection (5) is unusual in two respects. A law enforcement agency may ask an entity not to notify "in order to protect an investigation or homeland security" for "any period of time," with the notification process beginning when that period ends. And while the request stands, the entity "may not provide notice of or publicize an unauthorized acquisition," except as the agency authorizes.

Where a single incident requires notice to 1,000 or more individuals, subsection (2)(br) requires notice, without unreasonable delay, to the nationwide consumer reporting agencies defined in 15 U.S.C. 1681a(p) "of the timing, distribution, and content of the notices." No subsection requires notice to the Department of Justice, DATCP or any other state office.

Who Is Exempt

Subsection (3m) removes two groups from the section, each on conditions:

• an entity "subject to, and in compliance with," the privacy and security requirements of 15 U.S.C. 6801 to 6827, or a person with a contractual obligation to such an entity, if the entity or person "has in effect a policy concerning breaches of information security"; and
• an entity described in 45 CFR 164.104(a), the HIPAA applicability provision, "if the entity complies with the requirements of 45 CFR part 164."

Subsection (6m) bars a city, village, town or county from enacting or enforcing its own ordinance on breach notice. Subsection (7m) provides a conditional sunset: if the joint committee on administrative rules determines that Congress has enacted substantially similar, non-preemptive notice requirements and publishes notice of that determination, "this section does not apply after publication." No such determination was located.

What the Statute Says About Liability

Section 134.98 contains no penalty, forfeiture or enforcement clause and does not name an agency. Its only liability provision is subsection (4): "Failure to comply with this section is not negligence or a breach of any duty, but may be evidence of negligence or a breach of a legal duty." The neighbouring section 134.99, on parties to a violation, applies to violations of chapter 134 "for which a forfeiture is imposed," and 134.98 imposes none.

The published annotation to 134.98 cites one case. In Fox v. Iowa Health System, No. 18-cv-327-jdp, an opinion entered July 24, 2019 and reported at 399 F. Supp. 3d 780, Judge James D. Peterson of the Western District of Wisconsin dismissed claims under the statute arising from breaches at UnityPoint Health. The plaintiffs argued that liability should attach when a violation also breaches a separate duty of care; the court answered that "that would already be a claim for common law negligence," and held that because "the legislature has not provided any indication that § 134.98 creates a separate right of action," the claims were dismissed. Negligence claims of the Wisconsin plaintiffs under state law were allowed to proceed.

No state enforcement action citing 134.98 was located, and the enforcement record here is zero. Two state agency sources were read. DATCP's data breach page lists breaches that "were either reported to DATCP, or have been identified as affecting Wisconsin consumers," with the stated purpose of informing consumers of available services; the statute does not require such reports. The Department of Justice's July 14, 2026 release announced a 42-state settlement of bankruptcy claims against 23andMe over a 2023 breach of genetic data, with Wisconsin to receive over $275,000; the release does not cite 134.98 or any other statute.

Frequently Asked Questions