Pandemic Darlings The pandemic economy, in original documents
Home Source documents Bill Analysis - HB 2364, Charter of Personal Data Rights (Innovation, Technology & Economic Development)

Bill Analysis - HB 2364, Charter of Personal Data Rights (Innovation, Technology & Economic Development)

Summary

House Bill Analysis of HB 2364, Creating the charter of personal data rights, from the Office of Program Research of the Washington State House of Representatives for the Innovation, Technology & Economic Development Committee, with a hearing date of 1/21/20. The analysis states that the bill gives individuals rights to know, access, object to and opt out of selling or licensing, correct and delete personal data, and sets duties for businesses. It states that a violation is enforceable under the state Consumer Protection Act and subject to a civil penalty of up to $10,000 per violation in actions brought by the Attorney General. It also states that the bill takes effect 90 days after adjournment of the session in which the bill is passed.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Cite this document

“Bill Analysis - HB 2364, Charter of Personal Data Rights (Innovation, Technology & Economic Development).” Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2020-01-21-a26336-d209441-bill-analysis-a010e74451/, SHA-256 d1632569b79c8af7f64f00c2c4bccaa1d81b72f4b1768b2dbcfe6d9527666336.

Full text

Washington State                   BILL
House of Representatives
Office of Program Research     ANALYSIS
Innovation, Technology & Economic
Development Committee
                                         HB 2364
Brief Description: Creating the charter of personal data rights.

Sponsors: Representatives Smith, Hudgins, Young, Wylie and Pollet.


                                      Brief Summary of Bill
      Ÿ Provides Washington residents with personal data rights of: information, access,
        correction, deletion, and opt-out of the selling or licensing of personal data.
      Ÿ Identifies the duties of businesses that collect or process personal data, such as the
        duty of data minimization and nondiscrimination.
      Ÿ Provides that violations are enforceable under the Consumer Protection Act and
        subject to civil penalties and statutory damages.


Hearing Date: 1/21/20

Staff: Yelena Baker (786-7301).

Background:

Personal information and privacy interests are protected under various provisions of state law.
The Washington Constitution provides that no person shall be disturbed in his private affairs
without authority of law. The Public Records Act protects a person's right to privacy under
certain circumstances if disclosure of personal information would be highly offensive and is not
of legitimate concern to the public.

The state Consumer Protection Act (CPA) prohibits unfair methods of competition and unfair or
deceptive practices in the conduct of any trade or commerce. A private person or the Attorney
General may bring a civil action to enforce the provisions of the CPA. A person or entity found
to have violated the CPA is subject to treble damages and attorney's fees.

––––––––––––––––––––––
    This analysis was prepared by non-partisan legislative staff for the use of legislative
    members in their deliberations. This analysis is not a part of the legislation nor does it
    constitute a statement of legislative intent.

House Bill Analysis                             -1-                                          HB 2364
Summary of Bill:

The Washington State Charter of Personal Data Rights is created to set forth individual rights and
business responsibilities with regard to personal data.

"Personal data" means any information that identifies, relates to, describes, or could reasonably
be linked, directly or indirectly, with a particular individual or household. Employment-related
information is exempt from the provisions of the bill.

"Business" means any person or entity that engages in business and has a substantial nexus with
Washington, has more than $10 million in worldwide gross revenue in the preceding calendar
year, collects or processes personal data of individuals, and determines the purposes and means
of the processing.

With regard to personal data, an individual has the right to:
    Ÿ know what personal data a business collects or processes about the individual;
    Ÿ access and obtain the individual's personal data collected or processed by a business;
    Ÿ object to and opt out of the selling or licensing of personal data;
    Ÿ correct inaccurate personal data; and
    Ÿ delete the individual's personal data collected or processed by a business.

A business that collects or processes personal data has a duty to act in good faith and with due
diligence when responding to requests from individuals to exercise personal data rights and to
not discriminate against individuals who choose to exercise their personal data rights.

In addition, a business has the duty to:
     Ÿ minimize the collection of personal data by collecting and processing personal data only
         as reasonably necessary for services requested by an individual or to verify requests to
         exercise personal data rights;
     Ÿ avoid secondary uses of personal data;
     Ÿ secure personal data from unauthorized acquisition or access;
     Ÿ require service providers to process personal data only on documented instructions from
         the business as to the nature, duration, and purposes of the processing; and
     Ÿ use only those service providers that sufficiently guarantee that the processing of
         personal data meets set forth in the act and ensures the protection of personal data rights.

A violation of these provisions is enforceable under the state Consumer Protection Act and
subject to a civil penalty of up to $10,000 per violation in actions brought by the Attorney
General. An individual whose personal data rights are violated may bring a civil action for
declaratory relief, injunctive relief, or to recover actual damages, but not less than statutory
damages of $10,000 per violation. A court must award costs and reasonable attorney's fees to a
prevailing plaintiff.

Appropriation: None.

Fiscal Note: Available.




House Bill Analysis                             -2-                                          HB 2364
Effective Date: The bill takes effect 90 days after adjournment of the session in which the bill is
passed.




House Bill Analysis                            -3-                                         HB 2364

File and source

File
2020-01-21_a26336_d209441_bill-analysis.pdf
Size
84,377 bytes
SHA-256
d1632569b79c8af7f64f00c2c4bccaa1d81b72f4b1768b2dbcfe6d9527666336
Our copy
2020-01-21_a26336_d209441_bill-analysis.pdf
Original
No public link identified.
Back to top