Proposed Substitute HB 2742 (H-4111.1) - Controllers and Processors of Personal Data
Summary
Proposed Substitute HB 2742 (H-4111.1), listed with Hudgins, opens with a summary of the current version of the bill and then gives the bill text. The summary states that the bill applies to controllers and processors of personal data and sets consumer rights including to access, correct and delete personal data and to data portability. It states that the Attorney General has exclusive authority to enforce the provisions and sets forth civil penalties of up to $7,500 per violation. The final section of the bill text states that the act takes effect July 31, 2021.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Proposed Substitute HB 2742 (H-4111.1) - Controllers and Processors of Personal Data.”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2020-01-22-a26337-d209930-2742-pshb-h-4111-1-fa524b8542/
, SHA-256 53cea43c01366391a35c948da326433d44083239cf10d218411836b43090a957.Full text
Proposed Substitute HB 2742 (H-4111.1) (Rep. Hudgins)
Current Version of the Bill:
■ Applies to controllers and processors of personal data which are legal entities that conduct business
in Washington or produce products or services that are targeted to residents of Washington and:
▪ Control or process personal data of 100,000 consumers or more; or
▪ Derive over 50 percent of gross revenue from the sale of personal data and process or
control personal data of 25,000 consumers or more.
■ Does not apply to state and local government, municipal corporations, personal data and
information regulated under enumerated state and federal laws, and data maintained for
employment records purposes.
■ Defines responsibilities of controllers and processors in accordance with their roles in processing
personal data.
■ Sets for the following consumer rights with regard to personal data:
▪ The right to confirm if a controller is processing a consumer's data and the right to access
that data;
▪ The right to correct inaccurate personal data;
▪ The right to delete personal data;
▪ The right to data portability;
▪ The right to opt out of the processing of personal data for purposes of targeted advertising,
the sale of personal data, or profiling in furtherance of decisions that produce legal effects
or similarly significant effects concerning a consumer.
■ Requires controllers to take reasonable steps to notify third parties of consumer requests, unless
certain conditions apply.
■ Specifies the process and timeline a controller must follow in taking action on or otherwise
responding to a consumer request for exercising of consumer rights.
■ Requires controllers to establish an internal process by which consumers may appeal a refusal to
act on a request to exercise consumer rights and sets forth certain requirements with regard to the
internal appeal process.
■ Provides a process by which a controller must submit information related to consumer appeals to
the Attorney General.
■ Specifies that controllers and processors are not required to reidentify deidentified data or maintain
data in identifiable form solely for the purpose of complying with this act.
■ Defines the circumstances under which controllers and processors do not have to comply with
authenticated consumer requests to access, correct, delete, or port personal data.
■ Provides that the rights of access, correction, deletion, and data portability do not apply to
pseudonymous data where a controller is able to demonstrate that it is not in a position to identify
the consumer.
■ Requires controllers that use pseudonymous or deidentified data to exercise reasonable oversight
to monitor compliance and to take appropriate steps to address any breaches of contractual
commitments to which pseudonymous or deidentified data are subject.
■ Requires controllers to:
▪ Provide a privacy notice that meets specified requirements;
▪ Limit collection of personal data to what is reasonably necessary to the specified and
express purposes;
▪ Limit collection of personal data to what is adequate, relevant, and reasonably necessary
to the specified and express purposes; and
▪ Establish, implement, and maintain reasonable data security practices.
■ Prohibits controllers from:
▪ Processing personal data for purposes that are not reasonably necessary to or compatible
with the specified and express purposes;
▪ Discriminating against a consumer for exercising personal data rights; or
▪ Processing a consumer's sensitive data without the consumer's consent.
1
Proposed Substitute HB 2742 (H-4111.1) (Rep. Hudgins)
■ Requires controllers to conduct a data protection assessment of each personal data processing
activity and to make data protection assessments available to the Attorney General upon request.
■ Provides several exemptions to the obligations imposed on controllers and processors, such as
complying with state and federal laws and regulations, providing a service requested by a
consumer, conducting internal research and development, and performing internal operations that
are reasonably aligned with consumer expectations.
■ Requires that processing pursuant to an exemption is necessary, reasonable, and proportionate to
the specified exemption
■ Prohibits controllers relying on one of the specified exemptions from processing personal data for
any other purposes.
■ Provides that any violation of this chapter does not serve as the basis for a private right of action
under this act or any other law.
■ Provides that the Attorney General has exclusive authority to enforce these provisions and sets
forth civil penalties of up to $7,500 per violation.
■ Preempts local laws or regulations regarding processing of personal data.
■ Directs the Office of Privacy and Data Protection to conduct a study on the development of global-
opt out technologies and submit a report and recommendations to the Legislature.
■ Directs the Attorney General to compile and submit to the Legislature a report evaluating the
liability and enforcement provisions of this act and the effectiveness of the Attorney General's
efforts to enforce this act.
■ Authorizes the Governor to enter into agreements with British Columbia, California, and Oregon
for the purpose of sharing personal data for joint research initiatives.
■ Sets forth requirements for controllers and processors that use facial recognition services,
including:
▪ Third-party testing of the services for accuracy and unfair performance;
▪ Developing and implementing a plan to address identified performance differences;
▪ Testing of the services in operational conditions prior to deployment;
▪ Providing documentation that explains the capabilities and limitations of the services;
▪ Conspicuous notice where facial recognition services are deployed in a public space;
▪ Consumer consent prior to enrolling an image in a facial recognition service, unless
specified circumstances permit a controller enrolling a consumer's image without the
consumer's consent;
▪ Meaningful human review when using facial recognition services to make decisions that
produce legal effects or similarly significant effects on consumers; and
▪ Periodic training for all operators of facial recognition services.
■ Takes effect July 31, 2021.
Proposed Substitute (H-4111.1) Compared to HB 2742:
■ Modifies the intent language related to the Office of Privacy and Data Protection.
■ Modifies the definitions of "affiliate," "authenticate," "deidentified data," "sale," and "specific
geolocation data."
■ Specifies that the bill applies to legal entities that control or process personal data of 100,000 or
more consumers during a calendar year.
■ Exempts personal data used or shared in research, healthcare information regulated by specified
federal laws, and personal data collected or processed pursuant to the federal Farm Credit Act.
■ Clarifies that a processor that continues to adhere to a controller's instructions with respect to
specific processing remains a processor.
■ Removes the requirement for a controller to notify third parties of a consumer's personal data
rights request.
2
Proposed Substitute HB 2742 (H-4111.1) (Rep. Hudgins)
■ Removes the requirement for the Attorney General to make information related to consumer
appeals publicly available on its website.
■ Modifies the provision related to a controller's use of pseudonymous data to state that consumer
personal data rights do not apply to pseudonymous data if the controller is able to demonstrate
that any information necessary to identify the consumer is kept separately and is subject to
technical and organizational controls that prevent the controller from accessing such information.
■ Requires controllers to provide consumers with secure and reliable means of submitting personal
data rights requests.
■ Modifies the provision prohibiting discrimination against consumers who exercise personal data
rights and allows a controller to offer different prices or rates of service to a consumer who
voluntarily participates in a loyalty or reward program.
■ Prohibits the sale of a consumer's personal data collected as part of a loyalty program to a third-
party controller unless:
▪ the sale is reasonably necessary to provide the consumer with a benefit;
▪ the sale is clearly disclosed in the terms of the loyalty program; and
▪ the third party uses the personal data only to facilitate the provision of benefit to which
the consumer is entitled.
■ Removes the requirement for controllers to conduct data protection assessments for each of their
processing activities and specifies the activities for which controllers must conduct data
protection assessments.
■ Removes provisions authorizing processing of personal data pursuant to a consumer's consent
where a data protection assessment determines that the risk of privacy harm to consumer
outweighs the benefits of processing to the controller, other stakeholders, or the public.
■ Permits data protection assessments conducted by a controller for the purpose of complying with
other laws to qualify as the assessments required in this act, if the assessments are similar in
scope and effect.
■ Removes the authorization for controllers and processors to allocate liability by contract.
■ Removes the requirement for the Office of Privacy and Data Protection to conduct a study on opt-
out technology.
■ Clarifies that facial recognition services must be tested for unfair performance differences across
distinct subpopulations as defined by visually detectable characteristics or other protected
characteristics.
■ Requires disclosure of independent testing methodology and data to a processor in a manner that
allows full reproduction of the testing of a facial recognition service.
■ Exempts from the requirements of the bill voluntary facial recognition services used to verify
aviation passengers' identity in connection services regulated by certain federal laws.
■ Requires airlines to disclose and obtain a customer consent prior to capturing an image.
■ Prohibits airlines from retaining any images captured with the exempt facial recognition service
for more than 24 hours
■ Makes grammatical and technical corrections, such as correcting "business" to "controller" and
eliminating the effective date for the removed OPDP study.
3
1 AN ACT Relating to the management and oversight of personal data;
2 adding a new chapter to Title 19 RCW; prescribing penalties; and
3 providing an effective date.
4 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:
5 NEW SECTION. Sec. 1. SHORT TITLE. This act may be known and
6 cited as the Washington privacy act.
7 NEW SECTION. Sec. 2. LEGISLATIVE FINDINGS. (1) The legislature
8 finds that the people of Washington regard their privacy as a
9 fundamental right and an essential element of their individual
10 freedom. Washington's Constitution explicitly provides the right to
11 privacy, and fundamental privacy rights have long been and continue
12 to be integral to protecting Washingtonians and to safeguarding our
13 democratic republic.
14 (2) Ongoing advances in technology have produced an exponential
15 growth in the volume and variety of personal data being generated,
16 collected, stored, and analyzed, which presents both promise and
17 potential peril. The ability to harness and use data in positive ways
18 is driving innovation and brings beneficial technologies to society;
19 however, it has also created risks to privacy and freedom. The
20 unregulated and unauthorized use and disclosure of personal
Code Rev/JO:akl 1 H-4111.1/20
1 information and loss of privacy can have devastating impacts, ranging
2 from financial fraud, identity theft, and unnecessary costs, to
3 personal time and finances, to destruction of property, harassment,
4 reputational damage, emotional distress, and physical harm.
5 (3) Given that technological innovation and new uses of data can
6 help solve societal problems and improve quality of life, the
7 legislature seeks to shape responsible public policies where
8 innovation and protection of individual privacy coexist. The
9 legislature notes that our federal authorities have not developed or
10 adopted into law regulatory or legislative solutions that give
11 consumers control over their privacy. In contrast, the European
12 Union's general data protection regulation has continued to influence
13 data privacy policies and practices of those businesses competing in
14 global markets. In the absence of federal standards, Washington and
15 other states across the United States are analyzing elements of the
16 European Union's general data protection regulation to enact state-
17 based data privacy regulatory protections.
18 (4) With this act, Washington state will be among the first tier
19 of states giving consumers the ability to protect their own rights to
20 privacy and requiring companies to be responsible custodians of data
21 as technological innovations emerge. This act does so by explicitly
22 providing consumers the right to access, correction, and deletion of
23 personal data, as well as the right to opt out of the collection and
24 use of personal data for certain purposes. These rights will add to,
25 and not subtract from, the consumer protection rights that consumers
26 already have under Washington state law.
27 (5) Additionally, this act imposes affirmative obligations upon
28 companies to safeguard personal data and provide clear,
29 understandable, and transparent information to consumers about how
30 their personal data are used. It strengthens compliance and
31 accountability by requiring data protection assessments in the
32 collection and use of personal data. Finally, it empowers the state
33 attorney general to obtain and evaluate a company's data protection
34 assessments, to impose penalties where violations occur, and to
35 prevent against future violations.
36 (6) The legislature also encourages the state office of privacy
37 and data protection to monitor the development of universal privacy
38 controls that communicate a consumer's affirmative, freely given, and
39 unambiguous choice to opt out of the processing of personal data
40 concerning the consumer for the purposes of targeted advertising, the
Code Rev/JO:akl 2 H-4111.1/20
1 sale of personal data, or profiling in furtherance of decisions that
2 produce legal effects concerning the consumer or similarly
3 significant effects concerning consumers.
4 NEW SECTION. Sec. 3. DEFINITIONS. The definitions in this
5 section apply throughout this chapter unless the context clearly
6 requires otherwise.
7 (1) "Affiliate" means a legal entity that controls, is controlled
8 by, or is under common control with, that other legal entity. For
9 these purposes, "control" or "controlled" means ownership of, or the
10 power to vote, more than fifty percent of the outstanding shares of
11 any class of voting security of a company; control in any manner over
12 the election of a majority of the directors or of individuals
13 exercising similar functions; or the power to exercise a controlling
14 influence over the management of a company.
15 (2) "Authenticate" means to use reasonable means to determine
16 that a request to exercise any of the rights in section 6 (1) through
17 (4) of this act is being made by the consumer who is entitled to
18 exercise such rights with respect to the personal data at issue.
19 (3) "Business associate" has the same meaning as in Title 45
20 C.F.R., established pursuant to the federal health insurance
21 portability and accountability act of 1996.
22 (4) "Child" means any natural person under thirteen years of age.
23 (5) "Consent" means a clear affirmative act signifying a freely
24 given, specific, informed, and unambiguous indication of a consumer's
25 agreement to the processing of personal data relating to the
26 consumer, such as by a written statement, including by electronic
27 means, or other clear affirmative action.
28 (6) "Consumer" means a natural person who is a Washington
29 resident acting only in an individual or household context. It does
30 not include a natural person acting in a commercial or employment
31 context.
32 (7) "Controller" means the natural or legal person which, alone
33 or jointly with others, determines the purposes and means of the
34 processing of personal data.
35 (8) "Covered entity" has the same meaning as in Title 45 C.F.R.,
36 established pursuant to the federal health insurance portability and
37 accountability act of 1996.
38 (9) "Decisions that produce legal effects concerning a consumer
39 or similarly significant effects concerning a consumer" means
Code Rev/JO:akl 3 H-4111.1/20
1 decisions that include, but are not limited to, the denial of
2 consequential services or support, such as financial and lending
3 services, housing, insurance, education enrollment, criminal justice,
4 employment opportunities, health care services, and access to basic
5 necessities, such as food and water.
6 (10) "Deidentified data" means data that cannot reasonably be
7 used to infer information about, or otherwise be linked to, an
8 identified or identifiable natural person, or a device linked to such
9 person, provided that the controller that possesses the data: (a)
10 Takes reasonable measures to ensure that the data cannot be
11 associated with a natural person; (b) publicly commits to maintain
12 and use the data only in a deidentified fashion and not attempt to
13 reidentify the data; and (c) contractually obligates any recipients
14 of the information to comply with all provisions of this subsection.
15 (11) "Enroll," "enrolled," or "enrolling" means the process by
16 which a facial recognition service creates a facial template from one
17 or more images of a consumer and adds the facial template to a
18 gallery used by the facial recognition service for identification,
19 verification, or persistent tracking of consumers. It also includes
20 the act of adding an existing facial template directly into a gallery
21 used by a facial recognition service.
22 (12) "Facial recognition service" means technology that analyzes
23 facial features and is used for the identification, verification, or
24 persistent tracking of consumers in still or video images.
25 (13) "Facial template" means the machine-interpretable pattern of
26 facial features that is extracted from one or more images of a
27 consumer by a facial recognition service.
28 (14) "Health care facility" has the same meaning as in RCW
29 70.02.010.
30 (15) "Health care information" has the same meaning as in RCW
31 70.02.010.
32 (16) "Health care provider" has the same meaning as in RCW
33 70.02.010.
34 (17) "Identification" means the use of a facial recognition
35 service by a controller to determine whether an unknown consumer
36 matches any consumer who has been enrolled in a gallery used by the
37 facial recognition service.
38 (18) "Identified or identifiable natural person" means a person
39 who can be readily identified, directly or indirectly.
Code Rev/JO:akl 4 H-4111.1/20
1 (19) "Meaningful human review" means review or oversight by one
2 or more individuals who are trained in accordance with section 17(9)
3 of this act and who have the authority to alter the decision under
4 review.
5 (20) "Ongoing surveillance" means tracking the physical movements
6 of a specified individual through one or more public places over
7 time, whether in real time or through application of a facial
8 recognition service to historical records. It does not include a
9 single recognition or attempted recognition of an individual if no
10 attempt is made to subsequently track that individual's movement over
11 time after the individual has been recognized.
12 (21) "Persistent tracking" means the use of a facial recognition
13 service to track the movements of a consumer on a persistent basis
14 without recognition of that consumer. Such tracking becomes
15 persistent as soon as:
16 (a) The facial template that permits the tracking uses a facial
17 recognition service for more than forty-eight hours after the first
18 enrolling of that template; or
19 (b) The data created by the facial recognition service are linked
20 to any other data such that the consumer who has been tracked is
21 identified or identifiable.
22 (22)(a) "Personal data" means any information that is linked or
23 reasonably linkable to an identified or identifiable natural person.
24 "Personal data" does not include deidentified data or publicly
25 available information.
26 (b) For purposes of this subsection, "publicly available
27 information" means information that is lawfully made available from
28 federal, state, or local government records.
29 (23) "Process" or "processing" means any operation or set of
30 operations which are performed on personal data or on sets of
31 personal data, whether or not by automated means, such as the
32 collection, use, storage, disclosure, analysis, deletion, or
33 modification of personal data.
34 (24) "Processor" means a natural or legal person who processes
35 personal data on behalf of a controller.
36 (25) "Profiling" means any form of automated processing of
37 personal data to evaluate, analyze, or predict personal aspects
38 concerning an identified or identifiable natural person's economic
39 situation, health, personal preferences, interests, reliability,
40 behavior, location, or movements.
Code Rev/JO:akl 5 H-4111.1/20
1 (26) "Protected health information" has the same meaning as in
2 Title 45 C.F.R., established pursuant to the federal health insurance
3 portability and accountability act of 1996.
4 (27) "Pseudonymous data" means personal data that cannot be
5 attributed to a specific natural person without the use of additional
6 information, provided that such additional information is kept
7 separately and is subject to appropriate technical and organizational
8 measures to ensure that the personal data are not attributed to an
9 identified or identifiable natural person.
10 (28) "Recognition" means the use of a facial recognition service
11 to determine whether:
12 (a) An unknown consumer matches any consumer who has been
13 enrolled in a gallery used by the facial recognition service; or
14 (b) An unknown consumer matches a specific consumer who has been
15 enrolled in a gallery used by the facial recognition service.
16 (29)(a) "Sale," "sell," or "sold" means the exchange of personal
17 data for monetary or other valuable consideration by the controller
18 to a third party.
19 (b) "Sale" does not include the following: (i) The disclosure of
20 personal data to a processor who processes the personal data on
21 behalf of the controller; (ii) the disclosure of personal data to a
22 third party with whom the consumer has a direct relationship for
23 purposes of providing a product or service requested by the consumer;
24 (iii) the disclosure or transfer of personal data to an affiliate of
25 the controller; (iv) the disclosure of information that the consumer
26 (A) intentionally made available to the general public via a channel
27 of mass media, and (B) did not restrict to a specific audience; or
28 (v) the disclosure or transfer of personal data to a third party as
29 an asset that is part of a merger, acquisition, bankruptcy, or other
30 transaction in which the third party assumes control of all or part
31 of the controller's assets.
32 (30) "Security or safety purpose" means physical security,
33 protection of consumer data, safety, fraud prevention, or asset
34 protection.
35 (31) "Sensitive data" means (a) personal data revealing racial or
36 ethnic origin, religious beliefs, mental or physical health condition
37 or diagnosis, sexual orientation, or citizenship or immigration
38 status; (b) the processing of genetic or biometric data for the
39 purpose of uniquely identifying a natural person; (c) the personal
Code Rev/JO:akl 6 H-4111.1/20
1 data from a known child; or (d) specific geolocation data. "Sensitive
2 data" is a form of personal data.
3 (32) "Serious criminal offense" means any felony under chapter
4 9.94A RCW or an offense enumerated by Title 18 U.S.C. Sec. 2516.
5 (33) "Specific geolocation data" means information derived from
6 technology, including, but not limited to, global positioning system
7 level latitude and longitude coordinates or other mechanisms, that
8 directly identifies the specific location of a natural person with
9 the precision and accuracy below one thousand seven hundred fifty
10 feet.
11 (34) "Targeted advertising" means displaying advertisements to a
12 consumer where the advertisement is selected based on personal data
13 obtained from a consumer's activities over time and across
14 nonaffiliated web sites or online applications to predict such
15 consumer's preferences or interests. It does not include advertising:
16 (a) Based on activities within a controller's own web sites or online
17 applications; (b) based on the context of a consumer's current search
18 query or visit to a web site or online application; or (c) to a
19 consumer in response to the consumer's request for information or
20 feedback.
21 (35) "Third party" means a natural or legal person, public
22 authority, agency, or body other than the consumer, controller,
23 processor, or an affiliate of the processor or the controller.
24 (36) "Verification" means the use of a facial recognition service
25 by a controller to determine whether a consumer is a specific
26 consumer enrolled in a gallery used by the facial recognition
27 service.
28 NEW SECTION. Sec. 4. JURISDICTIONAL SCOPE. (1) This chapter
29 applies to legal entities that conduct business in Washington or
30 produce products or services that are targeted to residents of
31 Washington, and that satisfy one or more of the following thresholds:
32 (a) During a calendar year, controls or processes personal data
33 of one hundred thousand consumers or more; or
34 (b) Derives over fifty percent of gross revenue from the sale of
35 personal data and processes or controls personal data of twenty-five
36 thousand consumers or more.
37 (2) This chapter does not apply to:
38 (a) State and local governments;
39 (b) Municipal corporations;
Code Rev/JO:akl 7 H-4111.1/20
1 (c) Information that meets the definition of:
2 (i) Protected health information for purposes of the federal
3 health insurance portability and accountability act of 1996 and
4 related regulations;
5 (ii) Health care information for purposes of chapter 70.02 RCW;
6 (iii) Patient identifying information for purposes of 42 C.F.R.
7 Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2;
8 (iv) Identifiable private information for purposes of the federal
9 policy for the protection of human subjects, 45 C.F.R. Part 46;
10 identifiable private information that is otherwise information
11 collected as part of human subjects research pursuant to the good
12 clinical practice guidelines issued by the international council for
13 harmonisation; the protection of human subjects under 21 C.F.R. Parts
14 50 and 56; or personal data used or shared in research conducted in
15 accordance with one or more of the requirements set forth in this
16 subsection;
17 (v) Information and documents created specifically for, and
18 collected and maintained by:
19 (A) A quality improvement committee for purposes of RCW
20 43.70.510, 70.230.080, or 70.41.200;
21 (B) A peer review committee for purposes of RCW 4.24.250;
22 (C) A quality assurance committee for purposes of RCW 74.42.640
23 or 18.20.390;
24 (D) A hospital, as defined in RCW 43.70.056, for reporting of
25 health care-associated infections for purposes of RCW 43.70.056, a
26 notification of an incident for purposes of RCW 70.56.040(5), or
27 reports regarding adverse events for purposes of RCW 70.56.020(2)(b);
28 (vi) Information and documents created for purposes of the
29 federal health care quality improvement act of 1986, and related
30 regulations;
31 (vii) Patient safety work product for purposes of 42 C.F.R. Part
32 3, established pursuant to 42 U.S.C. Sec. 299b-21 through 299b-26; or
33 (viii) Information that is (A) deidentified in accordance with
34 the requirements for deidentification set forth in 45 C.F.R. Part
35 164, and (B) derived from any of the health care-related information
36 listed in this subsection (2)(c);
37 (d) Information originating from, and intermingled to be
38 indistinguishable with, information under (c) of this subsection that
39 is maintained by:
Code Rev/JO:akl 8 H-4111.1/20
1 (i) A covered entity or business associate as defined by the
2 health insurance portability and accountability act of 1996 and
3 related regulations;
4 (ii) A health care facility or health care provider as defined in
5 RCW 70.02.010; or
6 (iii) A program or a qualified service organization as defined by
7 42 C.F.R. Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2;
8 (e) Information used only for public health activities and
9 purposes as described in 45 C.F.R. Sec. 164.512;
10 (f)(i) An activity involving the collection, maintenance,
11 disclosure, sale, communication, or use of any personal information
12 bearing on a consumer's credit worthiness, credit standing, credit
13 capacity, character, general reputation, personal characteristics, or
14 mode of living by a consumer reporting agency, as defined in Title 15
15 U.S.C. Sec. 1681a(f), by a furnisher of information, as set forth in
16 Title 15 U.S.C. Sec. 1681s-2, who provides information for use in a
17 consumer report, as defined in Title 15 U.S.C. Sec. 1681a(d), and by
18 a user of a consumer report, as set forth in Title 15 U.S.C. Sec.
19 1681b.
20 (ii) (f)(i) of this subsection shall apply only to the extent
21 that such activity involving the collection, maintenance, disclosure,
22 sale, communication, or use of such information by that agency,
23 furnisher, or user is subject to regulation under the fair credit
24 reporting act, Title 15 U.S.C. Sec. 1681 et seq., and the information
25 is not collected, maintained, used, communicated, disclosed, or sold
26 except as authorized by the fair credit reporting act;
27 (g) Personal data collected and maintained for purposes of
28 chapter 43.71 RCW;
29 (h) Personal data collected, processed, sold, or disclosed
30 pursuant to the federal Gramm-Leach-Bliley act (P.L. 106-102), and
31 implementing regulations, if the collection, processing, sale, or
32 disclosure is in compliance with that law;
33 (i) Personal data collected, processed, sold, or disclosed
34 pursuant to the federal driver's privacy protection act of 1994 (18
35 U.S.C. Sec. 2721 et seq.), if the collection, processing, sale, or
36 disclosure is in compliance with that law;
37 (j) Personal data regulated by the federal family educations
38 rights and privacy act, 20 U.S.C. Sec. 1232g and its implementing
39 regulations;
Code Rev/JO:akl 9 H-4111.1/20
1 (k) Personal data regulated by the student user privacy in
2 education rights act, chapter 28A.604 RCW;
3 (l) Personal data collected, processed, sold, or disclosed
4 pursuant to the federal farm credit act of 1971 (as amended in 12
5 U.S.C. Sec. 2001-2279cc) and its implementing regulations (12 C.F.R.
6 Part 600 et seq.) if the collection, processing, sale, or disclosure
7 is in compliance with that law; or
8 (m) Data maintained for employment records purposes.
9 (3) Controllers that are in compliance with the verifiable
10 parental consent mechanisms under the children's online privacy
11 protection act, Title 15 U.S.C. Sec. 6501 through 6506 and its
12 implementing regulations, shall be deemed compliant with any
13 obligation to obtain parental consent under this chapter.
14 NEW SECTION. Sec. 5. RESPONSIBILITY ACCORDING TO ROLE. (1)
15 Controllers and processors are responsible for meeting their
16 respective obligations established under this chapter.
17 (2) Processors are responsible under this chapter for adhering to
18 the instructions of the controller and assisting the controller to
19 meet its obligations under this chapter. Such assistance shall
20 include the following:
21 (a) Taking into account the nature of the processing, the
22 processor shall assist the controller by appropriate technical and
23 organizational measures, insofar as this is possible, for the
24 fulfillment of the controller's obligation to respond to consumer
25 requests to exercise their rights pursuant to section 6 of this act;
26 and
27 (b) Taking into account the nature of processing and the
28 information available to the processor, the processor shall assist
29 the controller in meeting the controller's obligations in relation to
30 the security of processing the personal data and in relation to the
31 notification of a breach of the security of the system pursuant to
32 RCW 19.255.010; and shall provide information to the controller
33 necessary to enable the controller to conduct and document any data
34 protection assessments required by section 9 of this act.
35 (3) Notwithstanding the instructions of the controller, a
36 processor shall:
37 (a) Implement and maintain reasonable security procedures and
38 practices to protect personal data, taking into account the context
39 in which the personal data are to be processed;
Code Rev/JO:akl 10 H-4111.1/20
1 (b) Ensure that each person processing the personal data is
2 subject to a duty of confidentiality with respect to the data; and
3 (c) Engage a subcontractor only after providing the controller
4 with an opportunity to object and pursuant to a written contract in
5 accordance with subsection (5) of this section that requires the
6 subcontractor to meet the obligations of the processor with respect
7 to the personal data.
8 (4) Processing by a processor shall be governed by a contract
9 between the controller and the processor that is binding on both
10 parties and that sets out the processing instructions to which the
11 processor is bound, including the nature and purpose of the
12 processing, the type of personal data subject to the processing, the
13 duration of the processing, and the obligations and rights of both
14 parties. In addition, the contract shall include the requirements
15 imposed by this subsection and subsection (3) of this section, as
16 well as the following requirements:
17 (a) At the choice of the controller, the processor shall delete
18 or return all personal data to the controller as requested at the end
19 of the provision of services, unless retention of the personal data
20 is required by law;
21 (b)(i) The processor shall make available to the controller all
22 information necessary to demonstrate compliance with the obligations
23 in this chapter; and (ii) the processor shall allow for, and
24 contribute to, reasonable audits and inspections by the controller or
25 the controller's designated auditor; alternatively, the processor
26 may, with the controller's consent, arrange for a qualified and
27 independent auditor to conduct, at least annually and at the
28 processor's expense, an audit of the processor's policies and
29 technical and organizational measures in support of the obligations
30 under this chapter using an appropriate and accepted control standard
31 or framework and audit procedure for such audits as applicable, and
32 shall provide a report of such audit to the controller upon request.
33 (5) In no event shall any contract relieve a controller or a
34 processor from the liabilities imposed on them by virtue of its role
35 in the processing relationship as defined by this chapter.
36 (6) Determining whether a person is acting as a controller or
37 processor with respect to a specific processing of data is a fact-
38 based determination that depends upon the context in which personal
39 data are to be processed. A person that is not limited in its
40 processing of personal data pursuant to a controller's instructions,
Code Rev/JO:akl 11 H-4111.1/20
1 or that fails to adhere to such instructions, is a controller and not
2 a processor with respect to a specific processing of data. A
3 processor that continues to adhere to a controller's instructions
4 with respect to a specific processing of personal data remains a
5 processor. If a processor begins, alone or jointly with others,
6 determining the purposes and means of the processing of personal
7 data, it is a controller with respect to such processing.
8 NEW SECTION. Sec. 6. CONSUMER PERSONAL DATA RIGHTS. Consumers
9 may exercise the rights set forth in this section by submitting a
10 request, at any time, to a controller specifying which rights the
11 consumer wishes to exercise. In the case of processing personal data
12 concerning a known child, the parent or legal guardian of the known
13 child shall exercise the rights of this chapter on the child's
14 behalf. Except as provided in this chapter, the controller must
15 comply with a request to exercise the rights pursuant to subsections
16 (1) through (5) of this section.
17 (1) Right of access. A consumer has the right to confirm whether
18 or not a controller is processing personal data concerning the
19 consumer and access such personal data.
20 (2) Right to correction. A consumer has the right to correct
21 inaccurate personal data concerning the consumer, taking into account
22 the nature of the personal data and the purposes of the processing of
23 the personal data.
24 (3) Right to deletion. A consumer has the right to delete
25 personal data concerning the consumer.
26 (4) Right to data portability. When exercising the right to
27 access personal data pursuant to subsection (1) of this section, a
28 consumer has the right to obtain personal data concerning the
29 consumer, which the consumer previously provided to the controller,
30 in a portable and, to the extent technically feasible, readily usable
31 format that allows the consumer to transmit the data to another
32 controller without hindrance, where the processing is carried out by
33 automated means.
34 (5) Right to opt out. A consumer has the right to opt out of the
35 processing of personal data concerning such consumer for purposes of
36 targeted advertising, the sale of personal data, or profiling in
37 furtherance of decisions that produce legal effects concerning a
38 consumer or similarly significant effects concerning a consumer.
Code Rev/JO:akl 12 H-4111.1/20
1 (6) Responding to consumer requests. (a) A controller must inform
2 a consumer of any action taken on a request under subsections (1)
3 through (5) of this section without undue delay and in any event
4 within forty-five days of receipt of the request. That period may be
5 extended once by forty-five additional days where reasonably
6 necessary, taking into account the complexity and number of the
7 requests. The controller must inform the consumer of any such
8 extension within forty-five days of receipt of the request, together
9 with the reasons for the delay.
10 (b) If a controller does not take action on the request of a
11 consumer, the controller must inform the consumer without undue delay
12 and at the latest within forty-five days of receipt of the request of
13 the reasons for not taking action and instructions for how to appeal
14 the decision with the controller as described in subsection (7) of
15 this section.
16 (c) Information provided under this section must be provided by
17 the controller free of charge, up to twice annually to the consumer.
18 Where requests from a consumer are manifestly unfounded or excessive,
19 in particular because of their repetitive character, the controller
20 may either: (i) Charge a reasonable fee to cover the administrative
21 costs of complying with the request, or (ii) refuse to act on the
22 request. The controller bears the burden of demonstrating the
23 manifestly unfounded or excessive character of the request.
24 (d) A controller is not required to comply with a request to
25 exercise any of the rights under subsections (1) through (4) of this
26 section if the controller is unable to authenticate the request using
27 commercially reasonable efforts. In such cases, the controller may
28 request the provision of additional information reasonably necessary
29 to authenticate the request.
30 (7)(a) Controllers must establish an internal process whereby
31 consumers may appeal a refusal to take action on a request to
32 exercise any of the rights under subsections (1) through (5) of this
33 section within a reasonable period of time after the consumer's
34 receipt of the notice sent by the controller under subsection (6)(b)
35 of this section.
36 (b) The appeal process must be conspicuously available and as
37 easy to use as the process for submitting such requests under this
38 section.
39 (c) Within thirty days of receipt of an appeal, a controller must
40 inform the consumer of any action taken or not taken in response to
Code Rev/JO:akl 13 H-4111.1/20
1 the appeal, along with a written explanation of the reasons in
2 support thereof. That period may be extended by sixty additional days
3 where reasonably necessary, taking into account the complexity and
4 number of the requests serving as the basis for the appeal. The
5 controller must inform the consumer of any such extension within
6 thirty days of receipt of the appeal, together with the reasons for
7 the delay. The controller must also provide the consumer with an
8 email address or other online mechanism through which the consumer
9 may submit the appeal, along with any action taken or not taken by
10 the controller in response to the appeal and the controller's written
11 explanation of the reasons in support thereof, to the attorney
12 general.
13 (d) When informing a consumer of any action taken or not taken in
14 response to an appeal pursuant to (c) of this subsection, the
15 controller must clearly and prominently ask the consumer whether the
16 consumer consents to having the controller submit the appeal, along
17 with any action taken or not taken by the controller in response to
18 the appeal and must, upon request, provide the controller's written
19 explanation of the reasons in support thereof, to the attorney
20 general. If the consumer provides such consent, the controller must
21 submit such information to the attorney general.
22 NEW SECTION. Sec. 7. PROCESSING DEIDENTIFIED DATA OR
23 PSEUDONYMOUS DATA. (1) This chapter does not require a controller or
24 processor to do any of the following solely for purposes of complying
25 with this chapter:
26 (a) Reidentify deidentified data;
27 (b) Comply with an authenticated consumer request to access,
28 correct, delete, or port personal data pursuant to section 6 (1)
29 through (4) of this act, if all of the following are true:
30 (i)(A) The controller is not reasonably capable of associating
31 the request with the personal data, or (B) it would be unreasonably
32 burdensome for the controller to associate the request with the
33 personal data;
34 (ii) The controller does not use the personal data to recognize
35 or respond to the specific consumer who is the subject of the
36 personal data, or associate the personal data with other personal
37 data about the same specific consumer; and
38 (iii) The controller does not sell the personal data to any third
39 party or otherwise voluntarily disclose the personal data to any
Code Rev/JO:akl 14 H-4111.1/20
1 third party other than a processor, except as otherwise permitted in
2 this section; or
3 (c) Maintain data in identifiable form, or collect, obtain,
4 retain, or access any data or technology, in order to be capable of
5 associating an authenticated consumer request with personal data.
6 (2) The rights contained in section 6 (1) through (4) of this act
7 do not apply to pseudonymous data in cases where the controller is
8 able to demonstrate any information necessary to identify the
9 consumer is kept separately and is subject to effective technical and
10 organizational controls that prevent the controller from accessing
11 such information.
12 (3) A controller that uses pseudonymous data or deidentified data
13 must exercise reasonable oversight to monitor compliance with any
14 contractual commitments to which the pseudonymous data or
15 deidentified data are subject, and must take appropriate steps to
16 address any breaches of contractual commitments.
17 NEW SECTION. Sec. 8. RESPONSIBILITIES OF CONTROLLERS. (1)
18 Transparency.
19 (a) Controllers shall provide consumers with a reasonably
20 accessible, clear, and meaningful privacy notice that includes:
21 (i) The categories of personal data processed by the controller;
22 (ii) The purposes for which the categories of personal data are
23 processed;
24 (iii) How and where consumers may exercise the rights contained
25 in section 6 of this act, including how a consumer may appeal a
26 controller's action with regard to the consumer's request;
27 (iv) The categories of personal data that the controller shares
28 with third parties, if any; and
29 (v) The categories of third parties, if any, with whom the
30 controller shares personal data.
31 (b) If a controller sells personal data to third parties or
32 processes personal data for targeted advertising, it must clearly and
33 conspicuously disclose such processing, as well as the manner in
34 which a consumer may exercise the right to opt out of such
35 processing, in a clear and conspicuous manner.
36 (c) Controllers shall establish, and shall describe in the
37 privacy notice, one or more secure and reliable means for consumers
38 to submit a request to exercise their rights under this chapter. Such
39 means shall take into account the ways in which consumers interact
Code Rev/JO:akl 15 H-4111.1/20
1 with the controller, the need for secure and reliable communication
2 of such requests, and the controller's ability to authenticate the
3 identity of the consumer making the request. Controllers shall not
4 require a consumer to create a new account in order to exercise a
5 right, but a controller may require a consumer to use an existing
6 account to exercise the consumer's rights under this chapter.
7 (2) Purpose specification. A controller's collection of personal
8 data must be limited to what is reasonably necessary in relation to
9 the purposes for which such data are processed, as disclosed to the
10 consumer.
11 (3) Data minimization. A controller's collection of personal data
12 must be adequate, relevant, and limited to what is reasonably
13 necessary in relation to the purposes for which such data are
14 processed, as disclosed to the consumer.
15 (4) Avoid secondary use. Except as provided in this chapter, a
16 controller may not process personal data for purposes that are not
17 reasonably necessary to, or compatible with, the purposes for which
18 such personal data are processed, as disclosed to the consumer,
19 unless the controller obtains the consumer's consent.
20 (5) Security. A controller shall establish, implement, and
21 maintain reasonable administrative, technical, and physical data
22 security practices to protect the confidentiality, integrity, and
23 accessibility of personal data. Such data security practices shall be
24 appropriate to the volume and nature of the personal data at issue.
25 (6) Nondiscrimination. A controller may not process personal data
26 in violation of state and federal laws that prohibit unlawful
27 discrimination against consumers. This subsection shall not prohibit
28 a controller from offering a different price, rate, level, quality,
29 or selection of goods or services to a consumer, including offering
30 goods or services for no fee, if the offering is in connection with a
31 consumer's voluntary participation in a bona fide loyalty, rewards,
32 premium features, discounts, or club card program. A controller may
33 not sell personal data to a third-party controller as part of such a
34 program unless: (a) The sale is reasonably necessary to enable the
35 third party to provide a benefit to which the consumer is entitled;
36 (b) the sale of personal data to third parties is clearly disclosed
37 in the terms of the program; and (c) the third party uses the
38 personal data only for purposes of facilitating such benefit to which
39 the consumer is entitled and does not retain or otherwise use or
40 disclose the personal data for any other purpose.
Code Rev/JO:akl 16 H-4111.1/20
1 (7) Sensitive data. Except as otherwise provided in this act, a
2 controller may not process sensitive data concerning a consumer
3 without obtaining the consumer's consent, or, in the case of the
4 processing of personal data concerning a known child, without
5 obtaining consent from the child's parent or lawful guardian, in
6 accordance with the children's online privacy protection act
7 requirements.
8 (8) Nonwaiver of consumer rights. Any provision of a contract or
9 agreement of any kind that purports to waive or limit in any way a
10 consumer's rights under this chapter shall be deemed contrary to
11 public policy and shall be void and unenforceable.
12 NEW SECTION. Sec. 9. DATA PROTECTION ASSESSMENTS. (1)
13 Controllers must conduct and document a data protection assessment of
14 each of the following processing activities involving personal data:
15 (a) The processing of personal data for purposes of targeted
16 advertising;
17 (b) The sale of personal data;
18 (c) The processing of personal data for purposes of profiling,
19 where such profiling presents a reasonably foreseeable risk of: (i)
20 Unfair or deceptive treatment of, or disparate impact on, consumers;
21 (ii) financial, physical, or reputational injury to consumers; (iii)
22 a physical or other intrusion upon the solitude or seclusion, or the
23 private affairs or concerns, of consumers, where such intrusion would
24 be offensive to a reasonable person; or (iv) other substantial injury
25 to consumers;
26 (d) The processing of sensitive data; and
27 (e) Any processing activities involving personal data that
28 present a heightened risk of harm to consumers.
29 Such data protection assessments must take into account the type
30 of personal data to be processed by the controller, including the
31 extent to which the personal data are sensitive data, and the context
32 in which the personal data are to be processed.
33 (2) Data protection assessments conducted under subsection (1) of
34 this section must identify and weigh the benefits that may flow
35 directly and indirectly from the processing to the controller,
36 consumer, other stakeholders, and the public against the potential
37 risks to the rights of the consumer associated with such processing,
38 as mitigated by safeguards that can be employed by the controller to
39 reduce such risks. The use of deidentified data and the reasonable
Code Rev/JO:akl 17 H-4111.1/20
1 expectations of consumers, as well as the context of the processing
2 and the relationship between the controller and the consumer whose
3 personal data will be processed, must be factored into this
4 assessment by the controller.
5 (3) The attorney general may request, in writing, that a
6 controller disclose any data protection assessment that is relevant
7 to an investigation of the controller conducted by the attorney
8 general. The controller must make a data protection assessment
9 available to the attorney general upon such a request. The attorney
10 general may evaluate the data protection assessments for compliance
11 with the responsibilities contained in section 8 of this act and with
12 other laws including, but not limited to, chapter 19.86 RCW. Data
13 protection assessments are confidential and exempt from public
14 inspection and copying under chapter 42.56 RCW. The disclosure of a
15 data protection assessment pursuant to a request from the attorney
16 general under this subsection does not constitute a waiver of the
17 attorney-client privilege or work product protection with respect to
18 the assessment and any information contained in the assessment.
19 (4) Data protection assessments conducted by a controller for the
20 purpose of compliance with other laws or regulations may qualify
21 under this section if they have a similar scope and effect.
22 NEW SECTION. Sec. 10. LIMITATIONS AND APPLICABILITY. (1) The
23 obligations imposed on controllers or processors under this chapter
24 do not restrict a controller's or processor's ability to:
25 (a) Comply with federal, state, or local laws, rules, or
26 regulations;
27 (b) Comply with a civil, criminal, or regulatory inquiry,
28 investigation, subpoena, or summons by federal, state, local, or
29 other governmental authorities;
30 (c) Cooperate with law enforcement agencies concerning conduct or
31 activity that the controller or processor reasonably and in good
32 faith believes may violate federal, state, or local laws, rules, or
33 regulations;
34 (d) Investigate, establish, exercise, prepare for, or defend
35 legal claims;
36 (e) Provide a product or service specifically requested by a
37 consumer, perform a contract to which the consumer is a party, or
38 take steps at the request of the consumer prior to entering into a
39 contract;
Code Rev/JO:akl 18 H-4111.1/20
1 (f) Protect the vital interests of the consumer or of another
2 natural person;
3 (g) Prevent, detect, protect against, or respond to security
4 incidents, identity theft, fraud, harassment, malicious or deceptive
5 activities, or any illegal activity; preserve the integrity or
6 security of systems; or investigate, report, or prosecute those
7 responsible for any such action;
8 (h) Process personal data for reasons of public interest in the
9 areas of public health, or generalizable scientific, historical, or
10 statistical research, but solely to the extent that the processing is
11 (i) subject to suitable and specific measures to safeguard the rights
12 of the consumer; and (ii) under the responsibility of a professional
13 subject to confidentiality obligations under federal, state, or local
14 law; or
15 (i) Assist another controller, processor, or third party with any
16 of the obligations under this subsection.
17 (2) The obligations imposed on controllers or processors under
18 this chapter do not restrict a controller's or processor's ability to
19 collect, use, or retain data to:
20 (a) Conduct internal research to improve, repair, or develop
21 products, services, or technology;
22 (b) Identify and repair technical errors that impair existing or
23 intended functionality; or
24 (c) Perform internal operations that are reasonably aligned with
25 the expectations of the consumer based on the consumer's existing
26 relationship with the controller, or are otherwise compatible with
27 processing in furtherance of the provision of a product or service
28 specifically requested by a consumer or the performance of a contract
29 to which the consumer is a party.
30 (3) The obligations imposed on controllers or processors under
31 this chapter do not apply where compliance by the controller or
32 processor with this chapter would violate an evidentiary privilege
33 under Washington law and do not prevent a controller or processor
34 from providing personal data concerning a consumer to a person
35 covered by an evidentiary privilege under Washington law as part of a
36 privileged communication.
37 (4) A controller or processor that discloses personal data to a
38 third-party controller or processor in compliance with the
39 requirements of this chapter is not in violation of this chapter if
40 the recipient processes such personal data in violation of this
Code Rev/JO:akl 19 H-4111.1/20
1 chapter, provided that, at the time of disclosing the personal data,
2 the disclosing controller or processor did not have actual knowledge
3 that the recipient intended to commit a violation. A third-party
4 controller or processor receiving personal data from a controller or
5 processor in compliance with the requirements of this chapter is
6 likewise not in violation of this chapter for the obligations of the
7 controller or processor from which it receives such personal data.
8 (5) Obligations imposed on controllers and processors under this
9 chapter shall not:
10 (a) Adversely affect the rights or freedoms of any persons, such
11 as exercising the right of free speech pursuant to the First
12 Amendment to the United States Constitution; or
13 (b) Apply to the processing of personal data by a natural person
14 in the course of a purely personal or household activity.
15 (6) Personal data that are processed by a controller pursuant to
16 this section must not be processed for any purpose other than those
17 expressly listed in this section. Personal data that are processed by
18 a controller pursuant to this section may be processed solely to the
19 extent that such processing is: (i) Necessary, reasonable, and
20 proportionate to the purposes listed in this section; and (ii)
21 adequate, relevant, and limited to what is necessary in relation to
22 the specific purpose or purposes listed in this section. Furthermore,
23 personal data that are collected, used, or retained pursuant to
24 subsection (2) of this section must, insofar as possible, taking into
25 account the nature and purpose or purposes of such collection, use,
26 or retention, be subjected to reasonable administrative, technical,
27 and physical measures to protect the confidentiality, integrity, and
28 accessibility of the personal data, and to reduce reasonably
29 foreseeable risks of harm to consumers relating to such collection,
30 use, or retention of personal data.
31 (7) If a controller processes personal data pursuant to an
32 exemption in this section, the controller bears the burden of
33 demonstrating that such processing qualifies for the exemption and
34 complies with the requirements in subsection (6) of this section.
35 (8) Processing personal data solely for the purposes expressly
36 identified in subsection (1)(a) through (d) or (g) of this section
37 does not, by itself, make an entity a controller with respect to such
38 processing.
Code Rev/JO:akl 20 H-4111.1/20
1 NEW SECTION. Sec. 11. LIABILITY. (1) Any violation of this
2 chapter shall not serve as the basis for, or be subject to, a private
3 right of action under this chapter or under any other law. This does
4 not relieve any party from any duties or obligations imposed, or to
5 alter any independent rights that consumers have under other laws,
6 chapter 19.86 RCW, the Washington state Constitution, or the United
7 States Constitution.
8 (2) Where more than one controller or processor, or both a
9 controller and a processor, involved in the same processing, is in
10 violation of this chapter, the liability must be allocated among the
11 parties according to principles of comparative fault.
12 NEW SECTION. Sec. 12. ENFORCEMENT. (1) The attorney general has
13 exclusive authority to enforce this chapter by bringing an action in
14 the name of the state, or as parens patriae on behalf of persons
15 residing in the state.
16 (2) Any controller or processor that violates this chapter is
17 subject to an injunction and liable for a civil penalty of not more
18 than seven thousand five hundred dollars for each violation.
19 NEW SECTION. Sec. 13. CONSUMER PRIVACY ACCOUNT. The consumer
20 privacy account is created in the state treasury. All receipts from
21 the imposition of civil penalties under this chapter must be
22 deposited into the account except for the recovery of costs and
23 attorneys' fees accrued by the attorney general in enforcing this
24 chapter. Moneys in the account may be spent only after appropriation.
25 Moneys in the account may only be used for the purposes of the office
26 of privacy and data protection as created under RCW 43.105.369, and
27 may not be used to supplant general fund appropriations to the
28 agency.
29 NEW SECTION. Sec. 14. PREEMPTION. This chapter supersedes and
30 preempts laws, ordinances, regulations, or the equivalent adopted by
31 any local entity regarding the processing of personal data by
32 controllers or processors.
33 NEW SECTION. Sec. 15. ATTORNEY GENERAL REPORT. (1) The attorney
34 general shall compile a report evaluating the liability and
35 enforcement provisions of this chapter including, but not limited to,
Code Rev/JO:akl 21 H-4111.1/20
1 the effectiveness of its efforts to enforce this chapter, and any
2 recommendations for changes to such provisions.
3 (2) The attorney general shall submit the report to the governor
4 and the appropriate committees of the legislature by July 1, 2022.
5 NEW SECTION. Sec. 16. JOINT RESEARCH INITIATIVES. The governor
6 may enter into agreements with the governments of the Canadian
7 province of British Columbia and the states of California and Oregon
8 for the purpose of sharing personal data or personal information by
9 public bodies across national and state borders to enable
10 collaboration for joint data-driven research initiatives. Such
11 agreements must provide reciprocal protections that the respective
12 governments agree appropriately safeguard the data.
13 NEW SECTION. Sec. 17. FACIAL RECOGNITION. (1) Processors that
14 provide facial recognition services must make available an
15 application programming interface or other technical capability,
16 chosen by the processor, to enable controllers or third parties to
17 conduct legitimate, independent, and reasonable tests of those facial
18 recognition services for accuracy and unfair performance differences
19 across distinct subpopulations. Such subpopulations are defined by
20 visually detectable characteristics, such as (a) race, skin tone,
21 ethnicity, gender, age, or disability status, or (b) other protected
22 characteristics that are objectively determinable or self-identified
23 by the individuals portrayed in the testing dataset. If the results
24 of that independent testing identify material unfair performance
25 differences across subpopulations and the methodology, data, and
26 results are disclosed in a manner that allow full reproduction of the
27 testing directly to the processor, who, acting reasonably, determines
28 that the methodology and results of that testing are valid, then the
29 processor must develop and implement a plan to mitigate the
30 identified performance differences. Nothing in this subsection
31 prevents a processor from prohibiting the use of the processor's
32 facial recognition service by a competitor for competitive purposes.
33 (2) Processors that provide facial recognition services must
34 provide documentation that includes general information that:
35 (a) Explains the capabilities and limitations of the services in
36 plain language; and
37 (b) Enables testing of the services in accordance with this
38 section.
Code Rev/JO:akl 22 H-4111.1/20
1 (3) Processors that provide facial recognition services must
2 prohibit, in the contract required by section 5 of this act, the use
3 of facial recognition services by controllers to unlawfully
4 discriminate under federal or state law against individual consumers
5 or groups of consumers.
6 (4) Controllers must provide a conspicuous and contextually
7 appropriate notice whenever a facial recognition service is deployed
8 in a physical premise open to the public that includes, at minimum,
9 the following:
10 (a) The purpose or purposes for which the facial recognition
11 service is deployed; and
12 (b) Information about where consumers can obtain additional
13 information about the facial recognition service including, but not
14 limited to, a link to any applicable online notice, terms, or policy
15 that provides information about where and how consumers can exercise
16 any rights that they have with respect to the facial recognition
17 service.
18 (5) Controllers must obtain consent from a consumer prior to
19 enrolling an image of that consumer in a facial recognition service
20 used in a physical premise open to the public.
21 (6) As an exception to subsection (5) of this section,
22 controllers may enroll an image of a consumer in a facial recognition
23 service for a security or safety purpose without first obtaining
24 consent from that consumer, provided that all of the following
25 requirements are met:
26 (a) The controller must hold a reasonable suspicion, based on a
27 specific incident, that the consumer has engaged in criminal
28 activity, which includes, but is not limited to, shoplifting, fraud,
29 stalking, or domestic violence;
30 (b) Any database used by a facial recognition service for
31 identification, verification, or persistent tracking of consumers for
32 a security or safety purpose must be used solely for that purpose and
33 maintained separately from any other databases maintained by the
34 controller;
35 (c) The controller must review any such database used by the
36 controller's facial recognition service no less than biannually to
37 remove facial templates of consumers whom the controller no longer
38 holds a reasonable suspicion that they have engaged in criminal
39 activity or that are more than three years old; and
Code Rev/JO:akl 23 H-4111.1/20
1 (d) The controller must establish an internal process whereby a
2 consumer may correct or challenge the decision to enroll the image of
3 the consumer in a facial recognition service for a security or safety
4 purpose.
5 (7) Controllers using a facial recognition service to make
6 decisions that produce legal effects on consumers or similarly
7 significant effects on consumers must ensure that those decisions are
8 subject to meaningful human review.
9 (8) Prior to deploying a facial recognition service in the
10 context in which it will be used, controllers must test the facial
11 recognition service in operational conditions. Controllers must take
12 commercially reasonable steps to ensure best quality results by
13 following all reasonable guidance provided by the developer of the
14 facial recognition service.
15 (9) Controllers using a facial recognition service must conduct
16 periodic training of all individuals that operate a facial
17 recognition service or that process personal data obtained from the
18 use of facial recognition services. Such training shall include, but
19 not be limited to, coverage of:
20 (a) The capabilities and limitations of the facial recognition
21 service;
22 (b) Procedures to interpret and act on the output of the facial
23 recognition service; and
24 (c) The meaningful human review requirement for decisions that
25 produce legal effects on consumers or similarly significant effects
26 on consumers, to the extent applicable to the deployment context.
27 (10) Controllers shall not knowingly disclose personal data
28 obtained from a facial recognition service to a law enforcement
29 agency, except when such disclosure is:
30 (a) Pursuant to the consent of the consumer to whom the personal
31 data relates;
32 (b) Required by federal, state, or local law in response to a
33 court order, court-ordered warrant, or subpoena or summons issued by
34 a judicial officer or grand jury;
35 (c) Necessary to prevent or respond to an emergency involving
36 danger of death or serious physical injury to any person, upon a good
37 faith belief by the controller; or
38 (d) To the national center for missing and exploited children, in
39 connection with a report submitted thereto under Title 18 U.S.C. Sec.
40 2258A.
Code Rev/JO:akl 24 H-4111.1/20
1 (11) Controllers that deploy a facial recognition service must
2 respond to a consumer request to exercise the rights specified in
3 section 6 of this act and must fulfill the duties identified in
4 section 8 of this act.
5 (12) Voluntary facial recognition services used to verify an
6 aviation passenger's identity in connection with services regulated
7 by the secretary of transportation under Title 49 U.S.C. Sec. 41712
8 and exempt from state regulation under Title 49 U.S.C. Sec.
9 41713(b)(1) are exempt from section 18 of this act. Images captured
10 by an airline must not be retained for more than twenty-four hours
11 and, upon request of the attorney general, airlines must certify that
12 they do not retain the image for more than twenty-four hours. An
13 airline facial recognition service must disclose and obtain consent
14 from the customer prior to capturing an image.
15 NEW SECTION. Sec. 18. Sections 1 through 17 and 19 of this act
16 constitute a new chapter in Title 19 RCW.
17 NEW SECTION. Sec. 19. This act takes effect July 31, 2021.
--- END ---
Code Rev/JO:akl 25 H-4111.1/20
File and source
- File
- 2020-01-22_a26337_d209930_2742-pshb-h-4111-1.pdf
- Size
- 283,188 bytes
- SHA-256
- 53cea43c01366391a35c948da326433d44083239cf10d218411836b43090a957
- Original
- No public link identified.