House Bill 2364 - State of Washington, 66th Legislature (2020 Regular Session)

Summary

House Bill 2364, State of Washington, 66th Legislature, 2020 Regular Session, by Representatives Smith, Hudgins, Young, Wylie, and Pollet, prefiled January 10, 2020 and read first time January 13, 2020. It is referred to the Committee on Innovation, Technology & Economic Development. The act relates to creating the charter of personal data rights, adding a new chapter to Title 19 RCW, and prescribing penalties. The second new section lists the rights of an individual residing in Washington state regarding the individual's personal data, including to know, access, opt out of the selling or licensing of the data to third parties, correct and delete. The third new section sets duties of a business, including a privacy policy.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

     H-3624.2

                                HOUSE BILL 2364


     State of Washington       66th Legislature       2020 Regular Session

     By Representatives Smith, Hudgins, Young, Wylie, and Pollet

     Prefiled 01/10/20. Read first time 01/13/20. Referred to Committee
     on Innovation, Technology & Economic Development.




 1       AN ACT Relating to creating the charter of personal data rights;
 2   adding a new chapter to Title 19 RCW; and prescribing penalties.


 3   BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:


 4       NEW SECTION.      Sec. 1.      (1) The legislature finds that
 5   Washingtonians have a right to privacy and that advances in
 6   technology make the protection of this vital right a matter of
 7   urgency.
 8       (2) The legislature further finds that privacy is also the
 9   foundation of consumer trust, particularly in electronic commerce,
10   and that people will use advanced data-driven technology only if
11   their privacy rights are respected, their personal information is
12   safeguarded, and their freedom to choose how much personal
13   information to share is unobstructed.
14       (3) Therefore, the legislature declares, in plain language, the
15   new baseline norms and expectations for the protection of personal
16   data by businesses and enacts a lasting charter of personal data
17   rights.


18                           CONSUMER EMPOWERMENT



                                     p. 1                           HB 2364
 1       NEW SECTION. Sec. 2. An individual residing in Washington state
 2   has the following rights with regard to the individual's personal
 3   data:
 4       (1) The right to know what personal data a business collects or
 5   processes about the individual, including the categories and specific
 6   pieces of personal data the business collects or processes;
 7       (2) The right to access and to obtain, in a readily useable
 8   portable format, the individual's personal data collected or
 9   processed by a business;
10       (3) The right to object to and opt out of the selling or
11   licensing of the individual's personal data to third parties;
12       (4) The right to correct inaccurate personal data; and
13       (5) The right to delete all personal data of the individual
14   collected or processed by a business.


15                         CORPORATE RESPONSIBILITY


16        NEW SECTION.     Sec. 3.     (1) To safeguard the privacy of
17   individuals, a business has the duty to:
18        (a) Provide a prominent, publicly accessible, and easy to read
19   privacy policy that specifies how and where an individual may contact
20   the business to exercise personal data rights under this chapter and
21   clearly states that the business collects or processes personal data
22   only as reasonably necessary to provide services requested by an
23   individual or to verify requests made pursuant to section 2 of this
24   act;
25       (b) Minimize the collection of personal data by collecting and
26   processing personal data only as reasonably necessary for services
27   requested by an individual or to verify requests made pursuant to
28   section 2 of this act;
29        (c) Avoid secondary uses of personal data and not process
30   personal data for purposes that are not reasonably necessary to
31   provide services requested by an individual or to verify requests
32   made pursuant to section 2 of this act;
33        (d) Secure personal data from unauthorized acquisition or access
34   by    developing,  implementing,  and   maintaining  a  comprehensive
35   information security program that includes administrative, technical,
36   and physical safeguards and meets or exceeds relevant security
37   standards;


                                     p. 2                          HB 2364
 1       (e) Act in good faith and with due diligence when responding to
 2   requests made pursuant to section 2 of this act; and
 3       (f) Not discriminate against individuals who choose to exercise
 4   their rights under this chapter, including by denying goods or
 5   services, charging different prices or rates, or providing a
 6   different level of quality of goods and services.
 7       (2)(a) If a business uses a service provider to process personal
 8   data on behalf of the business, the business shall require the
 9   service provider to process personal data only on documented
10   instructions from the business as to the nature, duration, and
11   purposes of the processing.
12       (b) A business shall use only those service providers that
13   deliver sufficient guarantees that processing meets the requirements
14   of this chapter and ensures the protection of personal data rights.
15       (3) The duties in this chapter are in addition to any other
16   duties imposed on a business by any state or federal law or
17   regulation.


18                            STRONG ENFORCEMENT


19       NEW SECTION. Sec. 4. (1) Any waiver of the provisions of this
20   chapter is contrary to public policy and is void and unenforceable.
21       (2) The legislature finds that the practices covered by this
22   chapter are matters vitally affecting the public interest for the
23   purpose of applying the consumer protection act, chapter 19.86 RCW. A
24   violation of this chapter is not reasonable in relation to the
25   development and preservation of business and is an unfair or
26   deceptive act in trade or commerce and an unfair method of
27   competition for purposes of applying the consumer protection act,
28   chapter 19.86 RCW.
29       (3) The attorney general may bring an action in the name of the
30   state, or as parens patriae on behalf of persons residing in the
31   state, to enforce this chapter. In any action brought by the attorney
32   general to enforce this chapter, a violation of this chapter is
33   subject to a civil penalty of not more than ten thousand dollars per
34   violation.
35       (4) Any violation of this chapter constitutes an injury and any
36   individual whose rights under this chapter have been violated or
37   whose personal data has been collected or processed in violation of
38   this chapter may bring a civil action for declaratory relief,
                                     p. 3                          HB 2364
 1   injunctive relief, and actual damages, but not less than statutory
 2   damages of ten thousand dollars per violation.
 3       (5) A court shall award costs and reasonable attorneys' fees to a
 4   plaintiff who prevails in an action under this chapter.
 5       (6) The provisions of this chapter are not exclusive and are in
 6   addition to any other requirements, rights, remedies, and penalties
 7   provided by law.

 8                        NARROWLY SCOPED EXEMPTIONS


 9       NEW SECTION.    Sec. 5.     Nothing in this chapter applies to
10   information that is collected or used by a business about an
11   individual in the course of the individual's role as a job applicant,
12   employee, or contractor of the business.


13                                DEFINITIONS


14       NEW SECTION.    Sec. 6.    The definitions in this section apply
15   throughout   this  chapter   unless  the   context  clearly   requires
16   otherwise.
17       (1)(a) "Business" means a person or entity that, alone or
18   together with any affiliates:
19       (i) Engages in business in and has a substantial nexus with
20   Washington state;
21       (ii) Has more than ten million dollars in worldwide gross revenue
22   during the immediately preceding calendar year;
23       (iii) Collects or processes personal data of individuals; and
24       (iv) Alone or jointly with others determines the purposes and
25   means of the processing of personal data.
26       (b) For the purposes of this subsection:
27       (i) "Affiliate" means a person that directly or indirectly,
28   through one or more intermediaries, controls, is controlled by, or is
29   under common control with another person;
30       (ii) "Engage in business" means commencing, conducting, or
31   continuing in business and also the exercise of corporate or
32   franchise powers as well as liquidating a business when the
33   liquidators thereof hold themselves out to the public as conducting
34   such a business; and
35       (iii) "Substantial nexus" has the same meaning as in RCW
36   82.04.067.
                                     p. 4                          HB 2364
 1       (2) "Individual" means a natural person residing in Washington
 2   state.
 3       (3) "Personal data" means any information that identifies,
 4   relates to, describes, or could reasonably be linked, directly or
 5   indirectly, with a particular individual or household.
 6       (4) "Process" or "processing" means any collection, use, storage,
 7   disclosure, analysis, deletion, or modification of personal data.
 8       (5) "Service provider" means a natural or legal person that
 9   processes personal data on behalf of a business.


10                                SHORT TITLE

11       NEW SECTION. Sec. 7. This chapter may be known and cited as the
12   Washington state charter of personal data rights.


13       NEW SECTION.     Sec. 8.    Sections 1   through   7   of   this   act
14   constitute a new chapter in Title 19 RCW.

                                  --- END ---




                                     p. 5                             HB 2364


File and source

File

2020-01-21_a26336_bill_2364.pdf

Size

77,183 bytes

SHA-256

bc2d3ce6f3d8d3694b7df161234cd06c0872d6974ab81655f68c91638faf156a

Our copy

2020-01-21_a26336_bill_2364.pdf

Original

No public link identified.