H4129.1 by Representative Hudgins — HB 2742 - H COMM AMD, Jurisdictional Scope

Summary

A committee amendment (H COMM AMD) to HB 2742 by Representative Hudgins, offered by the Committee on Innovation, Technology & Economic Development. It strikes all of section 4 and inserts a new section titled JURISDICTIONAL SCOPE. The new section applies to legal entities that do business in Washington or target residents of Washington and either control or process personal data of one hundred thousand consumers or more, or derive over fifty percent of gross revenue from selling personal data. It then lists exemptions, among them state and local governments and municipal corporations.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

     2742 AMH ITED H4129.1

                                                 By Representative Hudgins

     HB 2742 - H COMM AMD
         By Committee on Innovation, Technology & Economic Development




 1       Beginning on page 7, line 18, strike all of section 4 and insert
 2   the following:


 3       "NEW SECTION.   Sec. 4.   JURISDICTIONAL SCOPE. (1) This chapter
 4   applies to legal entities that conduct business in Washington or
 5   produce products or services that are targeted to residents of
 6   Washington, and that satisfy one or more of the following thresholds:
 7       (a) Controls or processes personal data of one hundred thousand
 8   consumers or more; or
 9       (b) Derives over fifty percent of gross revenue from the sale of
10   personal data and processes or controls personal data of twenty-five
11   thousand consumers or more.
12       (2) This chapter does not apply to:
13       (a) State and local governments;
14       (b) Municipal corporations;
15       (c) Information that meets the definition of:
16       (i) Protected health information processed by entities subject
17   to, and in substantial compliance with, the federal health insurance
18   portability and accountability act of 1996 and related regulations
19   for purposes permitted under that law;
20       (ii) Health care information processed by entities subject to,
21   and in substantial compliance with, chapter 70.02 RCW for purposes
22   permitted under that law;
23       (iii) Patient identifying information for purposes of 42 C.F.R.
24   Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2;
25       (iv) Identifiable private information for purposes of the federal
26   policy for the protection of human subjects, 45 C.F.R. Part 46, or
27   identifiable private information that is otherwise information
28   collected as part of human subjects research pursuant to the good
29   clinical practice guidelines issued by the international council for
30   harmonisation, or the protection of human subjects under 21 C.F.R.
31   Parts 50 and 56;

     Code Rev/JO:akl                   1                       H-4129.1/20
 1       (v) Information and documents created specifically for, and
 2   collected and maintained by:
 3       (A) A quality improvement committee for purposes of RCW
 4   43.70.510, 70.230.080, or 70.41.200;
 5       (B) A peer review committee for purposes of RCW 4.24.250;
 6       (C) A quality assurance committee for purposes of RCW 74.42.640
 7   or 18.20.390;
 8       (D) A hospital, as defined in RCW 43.70.056, for reporting of
 9   health care-associated infections for purposes of RCW 43.70.056, a
10   notification of an incident for purposes of RCW 70.56.040(5), or
11   reports regarding adverse events for purposes of RCW 70.56.020(2)(b);
12       (vi) Information and documents created for purposes of the
13   federal health care quality improvement act of 1986, and related
14   regulations; or
15       (vii) Patient safety work product for purposes of 42 C.F.R. Part
16   3, established pursuant to 42 U.S.C. Sec. 299b-21 through 299b-26;
17       (d) Information originating from, and intermingled to be
18   indistinguishable with, information under (c) of this subsection that
19   is maintained by:
20       (i) A covered entity or business associate as defined by the
21   health insurance portability and accountability act of 1996 and
22   related regulations;
23       (ii) A health care facility or health care provider as defined in
24   RCW 70.02.010; or
25       (iii) A program or a qualified service organization as defined by
26   42 C.F.R. Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2;
27       (e)   An   activity   involving   the   collection,   maintenance,
28   disclosure, sale, communication, or use of any personal information
29   bearing on a consumer's credit worthiness, credit standing, credit
30   capacity, character, general reputation, personal characteristics, or
31   mode of living by a consumer reporting agency, as defined in Title 15
32   U.S.C. Sec. 1681a(f), by a furnisher of information, as set forth in
33   Title 15 U.S.C. Sec. 1681s-2, who provides information for use in a
34   consumer report, as defined in Title 15 U.S.C. Sec. 1861a(d), and by
35   a user of a consumer report, as set forth in Title 15 U.S.C. Sec.
36   1681b.
37       Such activity involving the collection, maintenance, disclosure,
38   sale, communication, or use of such information by that agency,
39   furnisher, or user is subject to regulation under the fair credit
40   reporting act, Title 15 U.S.C. Sec. 1681 et seq., and the information
     Code Rev/JO:akl                   2                       H-4129.1/20
 1   may not be used, communicated, disclosed, or sold except as
 2   authorized by the fair credit reporting act;
 3       (f) Personal data collected and maintained for purposes of
 4   chapter 43.71 RCW, if the collection, use, or disclosure is in
 5   substantial compliance with that law;
 6       (g) Personal data collected, processed, sold, or disclosed
 7   pursuant to the federal Gramm-Leach-Bliley act (P.L. 106-102), and
 8   implementing regulations, if the collection, processing, sale, or
 9   disclosure is in substantial compliance with that law;
10       (h) Personal data collected, processed, sold, or disclosed
11   pursuant to the federal driver's privacy protection act of 1994 (18
12   U.S.C. Sec. 2721 et seq.), if the collection, processing, sale, or
13   disclosure is in substantial compliance with that law;
14       (i) Controllers that are in compliance with the verifiable
15   parental consent mechanisms under the children's online privacy
16   protection act, Title 15 U.S.C. Sec. 6501 through 6506 and its
17   implementing regulations. Controllers shall be deemed compliant with
18   any obligation to obtain parental consent under this chapter;
19       (j) Personal data regulated by the federal family educational
20   rights and privacy act, 20 U.S.C. Sec. 1232g and its implementing
21   regulations, if the collection, use, or disclosure is in substantial
22   compliance with that law;
23       (k) Personal data regulated by the student user privacy in
24   education rights act, chapter 28A.604 RCW, if the collection, use, or
25   disclosure is in substantial compliance with that law; or
26       (l) Data maintained for employment records purposes."


         EFFECT: Specifies that certain data are exempt from the
     requirements of the bill only to the extent that the collection or
     processing of that data is in substantial compliance with federal and
     state laws to which the data are subject and which are specified in
     the exemptions.



                                  --- END ---




     Code Rev/JO:akl                   3                       H-4129.1/20


File and source

File

2020-01-22_a26337_d209932_2742-amh-ited-h4129-1.pdf

Size

65,461 bytes

SHA-256

afc971fee6f41ada76912ebc26a1d4aab5c680198d1720772da7cab28fa0dc5a

Our copy

2020-01-22_a26337_d209932_2742-amh-ited-h4129-1.pdf

Original

No public link identified.