Proposed Substitute HB 2742 (H-4322.1)
Summary
A summary of Proposed Substitute HB 2742 (H-4322.1), followed by the text of the bill. The summary states that the bill applies to controllers and processors of personal data that conduct business in Washington or produce products or services targeted to residents of Washington and control or process personal data of 100,000 consumers or more, or derive over 50 percent of gross revenue from the sale of personal data and process or control personal data of 25,000 consumers or more. It lists consumer rights to access, correct and delete personal data, data portability, and opting out of processing for targeted advertising, sale or profiling. The bill text ends with the provision that the act takes effect July 31, 2021.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Proposed Substitute HB 2742 (H-4322.1).”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2020-02-05-a26543-d212598-2742-pshb-h-4322-1-f70b727639/
, SHA-256 374db8e8f268969ab3d68a5f1c8d81ec684bab84e2ad2b37e4bf63161cf185c5.Full text
Proposed Substitute HB 2742 (H-4322.1) (Rep. Hudgins)
Current Version of the Bill:
■ Applies to controllers and processors of personal data which are legal entities that conduct business
in Washington or produce products or services that are targeted to residents of Washington and:
▪ Control or process personal data of 100,000 consumers or more; or
▪ Derive over 50 percent of gross revenue from the sale of personal data and process or
control personal data of 25,000 consumers or more.
■ Does not apply to state and local government, municipal corporations, personal data and
information regulated under enumerated state and federal laws, and data maintained for
employment records purposes.
■ Defines responsibilities of controllers and processors in accordance with their roles in processing
personal data.
■ Sets for the following consumer rights with regard to personal data:
▪ The right to confirm if a controller is processing a consumer's data and the right to access
that data;
▪ The right to correct inaccurate personal data;
▪ The right to delete personal data;
▪ The right to data portability;
▪ The right to opt out of the processing of personal data for purposes of targeted advertising,
the sale of personal data, or profiling in furtherance of decisions that produce legal effects
or similarly significant effects concerning a consumer.
■ Requires controllers to take reasonable steps to notify third parties of consumer requests, unless
certain conditions apply.
■ Specifies the process and timeline a controller must follow in taking action on or otherwise
responding to a consumer request for exercising of consumer rights.
■ Requires controllers to establish an internal process by which consumers may appeal a refusal to
act on a request to exercise consumer rights and sets forth certain requirements with regard to the
internal appeal process.
■ Provides a process by which a controller must submit information related to consumer appeals to
the Attorney General.
■ Specifies that controllers and processors are not required to reidentify deidentified data or maintain
data in identifiable form solely for the purpose of complying with this act.
■ Defines the circumstances under which controllers and processors do not have to comply with
authenticated consumer requests to access, correct, delete, or port personal data.
■ Provides that the rights of access, correction, deletion, and data portability do not apply to
pseudonymous data where a controller is able to demonstrate that it is not in a position to identify
the consumer.
■ Requires controllers that use pseudonymous or deidentified data to exercise reasonable oversight
to monitor compliance and to take appropriate steps to address any breaches of contractual
commitments to which pseudonymous or deidentified data are subject.
■ Requires controllers to:
▪ Provide a privacy notice that meets specified requirements;
▪ Limit collection of personal data to what is reasonably necessary to the specified and
express purposes;
▪ Limit collection of personal data to what is adequate, relevant, and reasonably necessary
to the specified and express purposes; and
▪ Establish, implement, and maintain reasonable data security practices.
■ Prohibits controllers from:
▪ Processing personal data for purposes that are not reasonably necessary to or compatible
with the specified and express purposes;
▪ Discriminating against a consumer for exercising personal data rights; or
▪ Processing a consumer's sensitive data without the consumer's consent.
1
Proposed Substitute HB 2742 (H-4322.1) (Rep. Hudgins)
■ Requires controllers to conduct a data protection assessment of each personal data processing
activity and to make data protection assessments available to the Attorney General upon request.
■ Provides several exemptions to the obligations imposed on controllers and processors, such as
complying with state and federal laws and regulations, providing a service requested by a
consumer, conducting internal research and development, and performing internal operations that
are reasonably aligned with consumer expectations.
■ Requires that processing pursuant to an exemption is necessary, reasonable, and proportionate to
the specified exemption
■ Prohibits controllers relying on one of the specified exemptions from processing personal data for
any other purposes.
■ Provides that any violation of this chapter does not serve as the basis for a private right of action
under this act or any other law.
■ Provides that the Attorney General has exclusive authority to enforce these provisions and sets
forth civil penalties of up to $7,500 per violation.
■ Preempts local laws or regulations regarding processing of personal data.
■ Directs the Office of Privacy and Data Protection to conduct a study on the development of global-
opt out technologies and submit a report and recommendations to the Legislature.
■ Directs the Attorney General to compile and submit to the Legislature a report evaluating the
liability and enforcement provisions of this act and the effectiveness of the Attorney General's
efforts to enforce this act.
■ Authorizes the Governor to enter into agreements with British Columbia, California, and Oregon
for the purpose of sharing personal data for joint research initiatives.
■ Sets forth requirements for controllers and processors that use facial recognition services,
including:
▪ Third-party testing of the services for accuracy and unfair performance;
▪ Developing and implementing a plan to address identified performance differences;
▪ Testing of the services in operational conditions prior to deployment;
▪ Providing documentation that explains the capabilities and limitations of the services;
▪ Conspicuous notice where facial recognition services are deployed in a public space;
▪ Consumer consent prior to enrolling an image in a facial recognition service, unless
specified circumstances permit a controller enrolling a consumer's image without the
consumer's consent;
▪ Meaningful human review when using facial recognition services to make decisions that
produce legal effects or similarly significant effects on consumers; and
▪ Periodic training for all operators of facial recognition services.
■ Takes effect July 31, 2021.
Proposed Substitute (H-4322.1) Compared to HB 2742:
■ Modifies the intent language related to the Office of Privacy and Data Protection.
■ Modifies the definitions of "affiliate," "authenticate," "decision that produce legal effects,"
"deidentified data," "identification," "persistent tracking," "sale," "specific geolocation data," and
"verification."
■ Specifies that the bill applies to legal entities that control or process personal data of 100,000 or
more consumers during a calendar year.
■ Exempts personal data used or shared in research, healthcare information regulated by specified
federal laws, and personal data collected or processed pursuant to the federal Farm Credit Act.
■ Clarifies that a processor that continues to adhere to a controller's instructions with respect to
specific processing remains a processor.
■ Removes the requirement for a controller to notify third parties of a consumer's personal data
rights request.
2
Proposed Substitute HB 2742 (H-4322.1) (Rep. Hudgins)
■ Removes the requirement for the Attorney General to make information related to consumer
appeals publicly available on its website.
■ Modifies the provision related to a controller's use of pseudonymous data to state that consumer
personal data rights do not apply to pseudonymous data if the controller is able to demonstrate
that any information necessary to identify the consumer is kept separately and is subject to
technical and organizational controls that prevent the controller from accessing such information.
■ Requires controllers to provide consumers with secure and reliable means of submitting personal
data rights requests.
■ Modifies the provision prohibiting discrimination against consumers who exercise personal data
rights and allows a controller to offer different prices or rates of service to a consumer who
voluntarily participates in a loyalty or reward program.
■ Prohibits the sale of a consumer's personal data collected as part of a loyalty program to a third-
party controller unless:
▪ the sale is reasonably necessary to provide the consumer with a benefit;
▪ the sale is clearly disclosed in the terms of the loyalty program; and
▪ the third party uses the personal data only to facilitate the provision of benefit to which
the consumer is entitled.
■ Removes the requirement for controllers to conduct data protection assessments for each of their
processing activities and specifies the activities for which controllers must conduct data
protection assessments.
■ Removes provisions authorizing processing of personal data pursuant to a consumer's consent
where a data protection assessment determines that the risk of privacy harm to consumer
outweighs the benefits of processing to the controller, other stakeholders, or the public.
■ Permits data protection assessments conducted by a controller for the purpose of complying with
other laws to qualify as the assessments required in this act, if the assessments are similar in
scope and effect.
■ Removes the authorization for controllers and processors to allocate liability by contract.
■ Removes the requirement for the Office of Privacy and Data Protection to conduct a study on opt-
out technology.
■ Provides that making available an application programming interface for accuracy and bias
testing does not require the disclosure of proprietary data, trade secrets, or other information, if
doing so would increase the risk of cyberattacks.
■ Clarifies that facial recognition services must be tested for unfair performance differences across
distinct subpopulations as defined by visually detectable characteristics or other protected
characteristics.
■ Requires disclosure of independent testing methodology and data to a processor in a manner that
allows full reproduction of the testing of a facial recognition service.
■ Requires annual, rather than biannual, review of facial recognition databases used by a
controller's facial recognition service.
■ Removes the requirement to remove facial templates that are more than three years old from any
database used by a controller's facial recognition service.
■ Modifies the requirement to test a facial recognition service in operational conditions by making
the requirement applicable only to those controllers that use a facial recognition service to make
decisions that produce legal or similarly significant effects on consumers.
■ Exempts from the requirements of the bill voluntary facial recognition services used to verify
aviation passengers' identity in connection services regulated by certain federal laws.
■ Requires airlines to disclose and obtain a customer consent prior to capturing an image.
■ Prohibits airlines from retaining any images captured with the exempt facial recognition service
for more than 24 hours
■ Makes grammatical and technical corrections, such as correcting "business" to "controller" and
eliminating the effective date for the removed OPDP study.
3
1 AN ACT Relating to the management and oversight of personal data;
2 adding a new chapter to Title 19 RCW; prescribing penalties; and
3 providing an effective date.
4 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:
5 NEW SECTION. Sec. 1. SHORT TITLE. This act may be known and
6 cited as the Washington privacy act.
7 NEW SECTION. Sec. 2. LEGISLATIVE FINDINGS. (1) The legislature
8 finds that the people of Washington regard their privacy as a
9 fundamental right and an essential element of their individual
10 freedom. Washington's Constitution explicitly provides the right to
11 privacy, and fundamental privacy rights have long been and continue
12 to be integral to protecting Washingtonians and to safeguarding our
13 democratic republic.
14 (2) Ongoing advances in technology have produced an exponential
15 growth in the volume and variety of personal data being generated,
16 collected, stored, and analyzed, which presents both promise and
17 potential peril. The ability to harness and use data in positive ways
18 is driving innovation and brings beneficial technologies to society;
19 however, it has also created risks to privacy and freedom. The
20 unregulated and unauthorized use and disclosure of personal
Code Rev/JO:eab 1 H-4322.1/20
1 information and loss of privacy can have devastating impacts, ranging
2 from financial fraud, identity theft, and unnecessary costs, to
3 personal time and finances, to destruction of property, harassment,
4 reputational damage, emotional distress, and physical harm.
5 (3) Given that technological innovation and new uses of data can
6 help solve societal problems and improve quality of life, the
7 legislature seeks to shape responsible public policies where
8 innovation and protection of individual privacy coexist. The
9 legislature notes that our federal authorities have not developed or
10 adopted into law regulatory or legislative solutions that give
11 consumers control over their privacy. In contrast, the European
12 Union's general data protection regulation has continued to influence
13 data privacy policies and practices of those businesses competing in
14 global markets. In the absence of federal standards, Washington and
15 other states across the United States are analyzing elements of the
16 European Union's general data protection regulation to enact state-
17 based data privacy regulatory protections.
18 (4) With this act, Washington state will be among the first tier
19 of states giving consumers the ability to protect their own rights to
20 privacy and requiring companies to be responsible custodians of data
21 as technological innovations emerge. This act does so by explicitly
22 providing consumers the right to access, correction, and deletion of
23 personal data, as well as the right to opt out of the collection and
24 use of personal data for certain purposes. These rights will add to,
25 and not subtract from, the consumer protection rights that consumers
26 already have under Washington state law.
27 (5) Additionally, this act imposes affirmative obligations upon
28 companies to safeguard personal data and provide clear,
29 understandable, and transparent information to consumers about how
30 their personal data are used. It strengthens compliance and
31 accountability by requiring data protection assessments in the
32 collection and use of personal data. Finally, it empowers the state
33 attorney general to obtain and evaluate a company's data protection
34 assessments, to impose penalties where violations occur, and to
35 prevent against future violations.
36 (6) The legislature also encourages the state office of privacy
37 and data protection to monitor the development of universal privacy
38 controls that communicate a consumer's affirmative, freely given, and
39 unambiguous choice to opt out of the processing of personal data
40 concerning the consumer for the purposes of targeted advertising, the
Code Rev/JO:eab 2 H-4322.1/20
1 sale of personal data, or profiling in furtherance of decisions that
2 produce legal effects concerning the consumer or similarly
3 significant effects concerning consumers.
4 NEW SECTION. Sec. 3. DEFINITIONS. The definitions in this
5 section apply throughout this chapter unless the context clearly
6 requires otherwise.
7 (1) "Affiliate" means a legal entity that controls, is controlled
8 by, or is under common control with, that other legal entity. For
9 these purposes, "control" or "controlled" means ownership of, or the
10 power to vote, more than fifty percent of the outstanding shares of
11 any class of voting security of a company; control in any manner over
12 the election of a majority of the directors or of individuals
13 exercising similar functions; or the power to exercise a controlling
14 influence over the management of a company.
15 (2) "Authenticate" means to use reasonable means to determine
16 that a request to exercise any of the rights in section 6 (1) through
17 (4) of this act is being made by the consumer who is entitled to
18 exercise such rights with respect to the personal data at issue.
19 (3) "Business associate" has the same meaning as in Title 45
20 C.F.R., established pursuant to the federal health insurance
21 portability and accountability act of 1996.
22 (4) "Child" means any natural person under thirteen years of age.
23 (5) "Consent" means a clear affirmative act signifying a freely
24 given, specific, informed, and unambiguous indication of a consumer's
25 agreement to the processing of personal data relating to the
26 consumer, such as by a written statement, including by electronic
27 means, or other clear affirmative action.
28 (6) "Consumer" means a natural person who is a Washington
29 resident acting only in an individual or household context. It does
30 not include a natural person acting in a commercial or employment
31 context.
32 (7) "Controller" means the natural or legal person which, alone
33 or jointly with others, determines the purposes and means of the
34 processing of personal data.
35 (8) "Covered entity" has the same meaning as in Title 45 C.F.R.,
36 established pursuant to the federal health insurance portability and
37 accountability act of 1996.
38 (9) "Decisions that produce legal effects concerning a consumer
39 or similarly significant effects concerning a consumer" means
Code Rev/JO:eab 3 H-4322.1/20
1 decisions that result in the provision or denial of financial and
2 lending services, housing, insurance, education enrollment, criminal
3 justice, employment opportunities, health care services, or access to
4 basic necessities, such as food and water.
5 (10) "Deidentified data" means data that cannot reasonably be
6 used to infer information about, or otherwise be linked to, an
7 identified or identifiable natural person, or a device linked to such
8 person, provided that the controller that possesses the data: (a)
9 Takes reasonable measures to ensure that the data cannot be
10 associated with a natural person; (b) publicly commits to maintain
11 and use the data only in a deidentified fashion and not attempt to
12 reidentify the data; and (c) contractually obligates any recipients
13 of the information to comply with all provisions of this subsection.
14 (11) "Enroll," "enrolled," or "enrolling" means the process by
15 which a facial recognition service creates a facial template from one
16 or more images of a consumer and adds the facial template to a
17 gallery used by the facial recognition service for identification,
18 verification, or persistent tracking of consumers. It also includes
19 the act of adding an existing facial template directly into a gallery
20 used by a facial recognition service.
21 (12) "Facial recognition service" means technology that analyzes
22 facial features and is used for the identification, verification, or
23 persistent tracking of consumers in still or video images.
24 (13) "Facial template" means the machine-interpretable pattern of
25 facial features that is extracted from one or more images of a
26 consumer by a facial recognition service.
27 (14) "Health care facility" has the same meaning as in RCW
28 70.02.010.
29 (15) "Health care information" has the same meaning as in RCW
30 70.02.010.
31 (16) "Health care provider" has the same meaning as in RCW
32 70.02.010.
33 (17) "Identification" means the use of a facial recognition
34 service by a controller to determine whether an unknown consumer
35 matches any consumer whose identity is known to the controller and
36 who has been enrolled by reference to that identity in a gallery used
37 by the facial recognition service.
38 (18) "Identified or identifiable natural person" means a person
39 who can be readily identified, directly or indirectly.
Code Rev/JO:eab 4 H-4322.1/20
1 (19) "Meaningful human review" means review or oversight by one
2 or more individuals who are trained in accordance with section 17(9)
3 of this act and who have the authority to alter the decision under
4 review.
5 (20) "Ongoing surveillance" means tracking the physical movements
6 of a specified individual through one or more public places over
7 time, whether in real time or through application of a facial
8 recognition service to historical records. It does not include a
9 single recognition or attempted recognition of an individual if no
10 attempt is made to subsequently track that individual's movement over
11 time after the individual has been recognized.
12 (21) "Persistent tracking" means the use of a facial recognition
13 service to track the movements of a consumer on a persistent basis
14 without identification or verification of that consumer. Such
15 tracking becomes persistent as soon as:
16 (a) The facial template that permits the tracking uses a facial
17 recognition service for more than forty-eight hours after the first
18 enrolling of that template; or
19 (b) The data created by the facial recognition service in
20 connection with the tracking of the movements of the consumer are
21 linked to any other data such that the consumer who has been tracked
22 is identified or identifiable.
23 (22)(a) "Personal data" means any information that is linked or
24 reasonably linkable to an identified or identifiable natural person.
25 "Personal data" does not include deidentified data or publicly
26 available information.
27 (b) For purposes of this subsection, "publicly available
28 information" means information that is lawfully made available from
29 federal, state, or local government records.
30 (23) "Process" or "processing" means any operation or set of
31 operations which are performed on personal data or on sets of
32 personal data, whether or not by automated means, such as the
33 collection, use, storage, disclosure, analysis, deletion, or
34 modification of personal data.
35 (24) "Processor" means a natural or legal person who processes
36 personal data on behalf of a controller.
37 (25) "Profiling" means any form of automated processing of
38 personal data to evaluate, analyze, or predict personal aspects
39 concerning an identified or identifiable natural person's economic
Code Rev/JO:eab 5 H-4322.1/20
1 situation, health, personal preferences, interests, reliability,
2 behavior, location, or movements.
3 (26) "Protected health information" has the same meaning as in
4 Title 45 C.F.R., established pursuant to the federal health insurance
5 portability and accountability act of 1996.
6 (27) "Pseudonymous data" means personal data that cannot be
7 attributed to a specific natural person without the use of additional
8 information, provided that such additional information is kept
9 separately and is subject to appropriate technical and organizational
10 measures to ensure that the personal data are not attributed to an
11 identified or identifiable natural person.
12 (28) "Recognition" means the use of a facial recognition service
13 to determine whether:
14 (a) An unknown consumer matches any consumer who has been
15 enrolled in a gallery used by the facial recognition service; or
16 (b) An unknown consumer matches a specific consumer who has been
17 enrolled in a gallery used by the facial recognition service.
18 (29)(a) "Sale," "sell," or "sold" means the exchange of personal
19 data for monetary or other valuable consideration by the controller
20 to a third party.
21 (b) "Sale" does not include the following: (i) The disclosure of
22 personal data to a processor who processes the personal data on
23 behalf of the controller; (ii) the disclosure of personal data to a
24 third party with whom the consumer has a direct relationship for
25 purposes of providing a product or service requested by the consumer;
26 (iii) the disclosure or transfer of personal data to an affiliate of
27 the controller; (iv) the disclosure of information that the consumer
28 (A) intentionally made available to the general public via a channel
29 of mass media, and (B) did not restrict to a specific audience; or
30 (v) the disclosure or transfer of personal data to a third party as
31 an asset that is part of a merger, acquisition, bankruptcy, or other
32 transaction in which the third party assumes control of all or part
33 of the controller's assets.
34 (30) "Security or safety purpose" means physical security,
35 protection of consumer data, safety, fraud prevention, or asset
36 protection.
37 (31) "Sensitive data" means (a) personal data revealing racial or
38 ethnic origin, religious beliefs, mental or physical health condition
39 or diagnosis, sexual orientation, or citizenship or immigration
40 status; (b) the processing of genetic or biometric data for the
Code Rev/JO:eab 6 H-4322.1/20
1 purpose of uniquely identifying a natural person; (c) the personal
2 data from a known child; or (d) specific geolocation data. "Sensitive
3 data" is a form of personal data.
4 (32) "Serious criminal offense" means any felony under chapter
5 9.94A RCW or an offense enumerated by Title 18 U.S.C. Sec. 2516.
6 (33) "Specific geolocation data" means information derived from
7 technology, including, but not limited to, global positioning system
8 level latitude and longitude coordinates or other mechanisms, that
9 directly identifies the specific location of a natural person with
10 the precision and accuracy below one thousand seven hundred fifty
11 feet. Specific geolocation data excludes the content of
12 communications.
13 (34) "Targeted advertising" means displaying advertisements to a
14 consumer where the advertisement is selected based on personal data
15 obtained from a consumer's activities over time and across
16 nonaffiliated web sites or online applications to predict such
17 consumer's preferences or interests. It does not include advertising:
18 (a) Based on activities within a controller's own web sites or online
19 applications; (b) based on the context of a consumer's current search
20 query or visit to a web site or online application; or (c) to a
21 consumer in response to the consumer's request for information or
22 feedback.
23 (35) "Third party" means a natural or legal person, public
24 authority, agency, or body other than the consumer, controller,
25 processor, or an affiliate of the processor or the controller.
26 (36) "Verification" means the use of a facial recognition service
27 by a controller to determine whether a consumer is a specific
28 consumer whose identity is known to the controller and who has been
29 enrolled by reference to that identity in a gallery used by the
30 facial recognition service.
31 NEW SECTION. Sec. 4. JURISDICTIONAL SCOPE. (1) This chapter
32 applies to legal entities that conduct business in Washington or
33 produce products or services that are targeted to residents of
34 Washington, and that satisfy one or more of the following thresholds:
35 (a) During a calendar year, controls or processes personal data
36 of one hundred thousand consumers or more; or
37 (b) Derives over fifty percent of gross revenue from the sale of
38 personal data and processes or controls personal data of twenty-five
39 thousand consumers or more.
Code Rev/JO:eab 7 H-4322.1/20
1 (2) This chapter does not apply to:
2 (a) State and local governments;
3 (b) Municipal corporations;
4 (c) Information that meets the definition of:
5 (i) Protected health information for purposes of the federal
6 health insurance portability and accountability act of 1996 and
7 related regulations;
8 (ii) Health care information for purposes of chapter 70.02 RCW;
9 (iii) Patient identifying information for purposes of 42 C.F.R.
10 Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2;
11 (iv) Identifiable private information for purposes of the federal
12 policy for the protection of human subjects, 45 C.F.R. Part 46;
13 identifiable private information that is otherwise information
14 collected as part of human subjects research pursuant to the good
15 clinical practice guidelines issued by the international council for
16 harmonisation; the protection of human subjects under 21 C.F.R. Parts
17 50 and 56; or personal data used or shared in research conducted in
18 accordance with one or more of the requirements set forth in this
19 subsection;
20 (v) Information and documents created specifically for, and
21 collected and maintained by:
22 (A) A quality improvement committee for purposes of RCW
23 43.70.510, 70.230.080, or 70.41.200;
24 (B) A peer review committee for purposes of RCW 4.24.250;
25 (C) A quality assurance committee for purposes of RCW 74.42.640
26 or 18.20.390;
27 (D) A hospital, as defined in RCW 43.70.056, for reporting of
28 health care-associated infections for purposes of RCW 43.70.056, a
29 notification of an incident for purposes of RCW 70.56.040(5), or
30 reports regarding adverse events for purposes of RCW 70.56.020(2)(b);
31 (vi) Information and documents created for purposes of the
32 federal health care quality improvement act of 1986, and related
33 regulations;
34 (vii) Patient safety work product for purposes of 42 C.F.R. Part
35 3, established pursuant to 42 U.S.C. Sec. 299b-21 through 299b-26; or
36 (viii) Information that is (A) deidentified in accordance with
37 the requirements for deidentification set forth in 45 C.F.R. Part
38 164, and (B) derived from any of the health care-related information
39 listed in this subsection (2)(c);
Code Rev/JO:eab 8 H-4322.1/20
1 (d) Information originating from, and intermingled to be
2 indistinguishable with, information under (c) of this subsection that
3 is maintained by:
4 (i) A covered entity or business associate as defined by the
5 health insurance portability and accountability act of 1996 and
6 related regulations;
7 (ii) A health care facility or health care provider as defined in
8 RCW 70.02.010; or
9 (iii) A program or a qualified service organization as defined by
10 42 C.F.R. Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2;
11 (e) Information used only for public health activities and
12 purposes as described in 45 C.F.R. Sec. 164.512;
13 (f)(i) An activity involving the collection, maintenance,
14 disclosure, sale, communication, or use of any personal information
15 bearing on a consumer's credit worthiness, credit standing, credit
16 capacity, character, general reputation, personal characteristics, or
17 mode of living by a consumer reporting agency, as defined in Title 15
18 U.S.C. Sec. 1681a(f), by a furnisher of information, as set forth in
19 Title 15 U.S.C. Sec. 1681s-2, who provides information for use in a
20 consumer report, as defined in Title 15 U.S.C. Sec. 1681a(d), and by
21 a user of a consumer report, as set forth in Title 15 U.S.C. Sec.
22 1681b.
23 (ii) (f)(i) of this subsection shall apply only to the extent
24 that such activity involving the collection, maintenance, disclosure,
25 sale, communication, or use of such information by that agency,
26 furnisher, or user is subject to regulation under the fair credit
27 reporting act, Title 15 U.S.C. Sec. 1681 et seq., and the information
28 is not collected, maintained, used, communicated, disclosed, or sold
29 except as authorized by the fair credit reporting act;
30 (g) Personal data collected and maintained for purposes of
31 chapter 43.71 RCW;
32 (h) Personal data collected, processed, sold, or disclosed
33 pursuant to the federal Gramm-Leach-Bliley act (P.L. 106-102), and
34 implementing regulations, if the collection, processing, sale, or
35 disclosure is in compliance with that law;
36 (i) Personal data collected, processed, sold, or disclosed
37 pursuant to the federal driver's privacy protection act of 1994 (18
38 U.S.C. Sec. 2721 et seq.), if the collection, processing, sale, or
39 disclosure is in compliance with that law;
Code Rev/JO:eab 9 H-4322.1/20
1 (j) Personal data regulated by the federal family educations
2 rights and privacy act, 20 U.S.C. Sec. 1232g and its implementing
3 regulations;
4 (k) Personal data regulated by the student user privacy in
5 education rights act, chapter 28A.604 RCW;
6 (l) Personal data collected, processed, sold, or disclosed
7 pursuant to the federal farm credit act of 1971 (as amended in 12
8 U.S.C. Sec. 2001-2279cc) and its implementing regulations (12 C.F.R.
9 Part 600 et seq.) if the collection, processing, sale, or disclosure
10 is in compliance with that law; or
11 (m) Data maintained for employment records purposes.
12 (3) Controllers that are in compliance with the verifiable
13 parental consent mechanisms under the children's online privacy
14 protection act, Title 15 U.S.C. Sec. 6501 through 6506 and its
15 implementing regulations, shall be deemed compliant with any
16 obligation to obtain parental consent under this chapter.
17 NEW SECTION. Sec. 5. RESPONSIBILITY ACCORDING TO ROLE. (1)
18 Controllers and processors are responsible for meeting their
19 respective obligations established under this chapter.
20 (2) Processors are responsible under this chapter for adhering to
21 the instructions of the controller and assisting the controller to
22 meet its obligations under this chapter. Such assistance shall
23 include the following:
24 (a) Taking into account the nature of the processing, the
25 processor shall assist the controller by appropriate technical and
26 organizational measures, insofar as this is possible, for the
27 fulfillment of the controller's obligation to respond to consumer
28 requests to exercise their rights pursuant to section 6 of this act;
29 and
30 (b) Taking into account the nature of processing and the
31 information available to the processor, the processor shall assist
32 the controller in meeting the controller's obligations in relation to
33 the security of processing the personal data and in relation to the
34 notification of a breach of the security of the system pursuant to
35 RCW 19.255.010; and shall provide information to the controller
36 necessary to enable the controller to conduct and document any data
37 protection assessments required by section 9 of this act.
38 (3) Notwithstanding the instructions of the controller, a
39 processor shall:
Code Rev/JO:eab 10 H-4322.1/20
1 (a) Implement and maintain reasonable security procedures and
2 practices to protect personal data, taking into account the context
3 in which the personal data are to be processed;
4 (b) Ensure that each person processing the personal data is
5 subject to a duty of confidentiality with respect to the data; and
6 (c) Engage a subcontractor only after providing the controller
7 with an opportunity to object and pursuant to a written contract in
8 accordance with subsection (5) of this section that requires the
9 subcontractor to meet the obligations of the processor with respect
10 to the personal data.
11 (4) Processing by a processor shall be governed by a contract
12 between the controller and the processor that is binding on both
13 parties and that sets out the processing instructions to which the
14 processor is bound, including the nature and purpose of the
15 processing, the type of personal data subject to the processing, the
16 duration of the processing, and the obligations and rights of both
17 parties. In addition, the contract shall include the requirements
18 imposed by this subsection and subsection (3) of this section, as
19 well as the following requirements:
20 (a) At the choice of the controller, the processor shall delete
21 or return all personal data to the controller as requested at the end
22 of the provision of services, unless retention of the personal data
23 is required by law;
24 (b)(i) The processor shall make available to the controller all
25 information necessary to demonstrate compliance with the obligations
26 in this chapter; and (ii) the processor shall allow for, and
27 contribute to, reasonable audits and inspections by the controller or
28 the controller's designated auditor; alternatively, the processor
29 may, with the controller's consent, arrange for a qualified and
30 independent auditor to conduct, at least annually and at the
31 processor's expense, an audit of the processor's policies and
32 technical and organizational measures in support of the obligations
33 under this chapter using an appropriate and accepted control standard
34 or framework and audit procedure for such audits as applicable, and
35 shall provide a report of such audit to the controller upon request.
36 (5) In no event shall any contract relieve a controller or a
37 processor from the liabilities imposed on them by virtue of its role
38 in the processing relationship as defined by this chapter.
39 (6) Determining whether a person is acting as a controller or
40 processor with respect to a specific processing of data is a fact-
Code Rev/JO:eab 11 H-4322.1/20
1 based determination that depends upon the context in which personal
2 data are to be processed. A person that is not limited in its
3 processing of personal data pursuant to a controller's instructions,
4 or that fails to adhere to such instructions, is a controller and not
5 a processor with respect to a specific processing of data. A
6 processor that continues to adhere to a controller's instructions
7 with respect to a specific processing of personal data remains a
8 processor. If a processor begins, alone or jointly with others,
9 determining the purposes and means of the processing of personal
10 data, it is a controller with respect to such processing.
11 NEW SECTION. Sec. 6. CONSUMER PERSONAL DATA RIGHTS. Consumers
12 may exercise the rights set forth in this section by submitting a
13 request, at any time, to a controller specifying which rights the
14 consumer wishes to exercise. In the case of processing personal data
15 concerning a known child, the parent or legal guardian of the known
16 child shall exercise the rights of this chapter on the child's
17 behalf. Except as provided in this chapter, the controller must
18 comply with a request to exercise the rights pursuant to subsections
19 (1) through (5) of this section.
20 (1) Right of access. A consumer has the right to confirm whether
21 or not a controller is processing personal data concerning the
22 consumer and access such personal data.
23 (2) Right to correction. A consumer has the right to correct
24 inaccurate personal data concerning the consumer, taking into account
25 the nature of the personal data and the purposes of the processing of
26 the personal data.
27 (3) Right to deletion. A consumer has the right to delete
28 personal data concerning the consumer.
29 (4) Right to data portability. When exercising the right to
30 access personal data pursuant to subsection (1) of this section, a
31 consumer has the right to obtain personal data concerning the
32 consumer, which the consumer previously provided to the controller,
33 in a portable and, to the extent technically feasible, readily usable
34 format that allows the consumer to transmit the data to another
35 controller without hindrance, where the processing is carried out by
36 automated means.
37 (5) Right to opt out. A consumer has the right to opt out of the
38 processing of personal data concerning such consumer for purposes of
39 targeted advertising, the sale of personal data, or profiling in
Code Rev/JO:eab 12 H-4322.1/20
1 furtherance of decisions that produce legal effects concerning a
2 consumer or similarly significant effects concerning a consumer.
3 (6) Responding to consumer requests. (a) A controller must inform
4 a consumer of any action taken on a request under subsections (1)
5 through (5) of this section without undue delay and in any event
6 within forty-five days of receipt of the request. That period may be
7 extended once by forty-five additional days where reasonably
8 necessary, taking into account the complexity and number of the
9 requests. The controller must inform the consumer of any such
10 extension within forty-five days of receipt of the request, together
11 with the reasons for the delay.
12 (b) If a controller does not take action on the request of a
13 consumer, the controller must inform the consumer without undue delay
14 and at the latest within forty-five days of receipt of the request of
15 the reasons for not taking action and instructions for how to appeal
16 the decision with the controller as described in subsection (7) of
17 this section.
18 (c) Information provided under this section must be provided by
19 the controller free of charge, up to twice annually to the consumer.
20 Where requests from a consumer are manifestly unfounded or excessive,
21 in particular because of their repetitive character, the controller
22 may either: (i) Charge a reasonable fee to cover the administrative
23 costs of complying with the request, or (ii) refuse to act on the
24 request. The controller bears the burden of demonstrating the
25 manifestly unfounded or excessive character of the request.
26 (d) A controller is not required to comply with a request to
27 exercise any of the rights under subsections (1) through (4) of this
28 section if the controller is unable to authenticate the request using
29 commercially reasonable efforts. In such cases, the controller may
30 request the provision of additional information reasonably necessary
31 to authenticate the request.
32 (7)(a) Controllers must establish an internal process whereby
33 consumers may appeal a refusal to take action on a request to
34 exercise any of the rights under subsections (1) through (5) of this
35 section within a reasonable period of time after the consumer's
36 receipt of the notice sent by the controller under subsection (6)(b)
37 of this section.
38 (b) The appeal process must be conspicuously available and as
39 easy to use as the process for submitting such requests under this
40 section.
Code Rev/JO:eab 13 H-4322.1/20
1 (c) Within thirty days of receipt of an appeal, a controller must
2 inform the consumer of any action taken or not taken in response to
3 the appeal, along with a written explanation of the reasons in
4 support thereof. That period may be extended by sixty additional days
5 where reasonably necessary, taking into account the complexity and
6 number of the requests serving as the basis for the appeal. The
7 controller must inform the consumer of any such extension within
8 thirty days of receipt of the appeal, together with the reasons for
9 the delay. The controller must also provide the consumer with an
10 email address or other online mechanism through which the consumer
11 may submit the appeal, along with any action taken or not taken by
12 the controller in response to the appeal and the controller's written
13 explanation of the reasons in support thereof, to the attorney
14 general.
15 (d) When informing a consumer of any action taken or not taken in
16 response to an appeal pursuant to (c) of this subsection, the
17 controller must clearly and prominently ask the consumer whether the
18 consumer consents to having the controller submit the appeal, along
19 with any action taken or not taken by the controller in response to
20 the appeal and must, upon request, provide the controller's written
21 explanation of the reasons in support thereof, to the attorney
22 general. If the consumer provides such consent, the controller must
23 submit such information to the attorney general.
24 NEW SECTION. Sec. 7. PROCESSING DEIDENTIFIED DATA OR
25 PSEUDONYMOUS DATA. (1) This chapter does not require a controller or
26 processor to do any of the following solely for purposes of complying
27 with this chapter:
28 (a) Reidentify deidentified data;
29 (b) Comply with an authenticated consumer request to access,
30 correct, delete, or port personal data pursuant to section 6 (1)
31 through (4) of this act, if all of the following are true:
32 (i)(A) The controller is not reasonably capable of associating
33 the request with the personal data, or (B) it would be unreasonably
34 burdensome for the controller to associate the request with the
35 personal data;
36 (ii) The controller does not use the personal data to recognize
37 or respond to the specific consumer who is the subject of the
38 personal data, or associate the personal data with other personal
39 data about the same specific consumer; and
Code Rev/JO:eab 14 H-4322.1/20
1 (iii) The controller does not sell the personal data to any third
2 party or otherwise voluntarily disclose the personal data to any
3 third party other than a processor, except as otherwise permitted in
4 this section; or
5 (c) Maintain data in identifiable form, or collect, obtain,
6 retain, or access any data or technology, in order to be capable of
7 associating an authenticated consumer request with personal data.
8 (2) The rights contained in section 6 (1) through (4) of this act
9 do not apply to pseudonymous data in cases where the controller is
10 able to demonstrate any information necessary to identify the
11 consumer is kept separately and is subject to effective technical and
12 organizational controls that prevent the controller from accessing
13 such information.
14 (3) A controller that uses pseudonymous data or deidentified data
15 must exercise reasonable oversight to monitor compliance with any
16 contractual commitments to which the pseudonymous data or
17 deidentified data are subject, and must take appropriate steps to
18 address any breaches of contractual commitments.
19 NEW SECTION. Sec. 8. RESPONSIBILITIES OF CONTROLLERS. (1)
20 Transparency.
21 (a) Controllers shall provide consumers with a reasonably
22 accessible, clear, and meaningful privacy notice that includes:
23 (i) The categories of personal data processed by the controller;
24 (ii) The purposes for which the categories of personal data are
25 processed;
26 (iii) How and where consumers may exercise the rights contained
27 in section 6 of this act, including how a consumer may appeal a
28 controller's action with regard to the consumer's request;
29 (iv) The categories of personal data that the controller shares
30 with third parties, if any; and
31 (v) The categories of third parties, if any, with whom the
32 controller shares personal data.
33 (b) If a controller sells personal data to third parties or
34 processes personal data for targeted advertising, it must clearly and
35 conspicuously disclose such processing, as well as the manner in
36 which a consumer may exercise the right to opt out of such
37 processing, in a clear and conspicuous manner.
38 (c) Controllers shall establish, and shall describe in the
39 privacy notice, one or more secure and reliable means for consumers
Code Rev/JO:eab 15 H-4322.1/20
1 to submit a request to exercise their rights under this chapter. Such
2 means shall take into account the ways in which consumers interact
3 with the controller, the need for secure and reliable communication
4 of such requests, and the controller's ability to authenticate the
5 identity of the consumer making the request. Controllers shall not
6 require a consumer to create a new account in order to exercise a
7 right, but a controller may require a consumer to use an existing
8 account to exercise the consumer's rights under this chapter.
9 (2) Purpose specification. A controller's collection of personal
10 data must be limited to what is reasonably necessary in relation to
11 the purposes for which such data are processed, as disclosed to the
12 consumer.
13 (3) Data minimization. A controller's collection of personal data
14 must be adequate, relevant, and limited to what is reasonably
15 necessary in relation to the purposes for which such data are
16 processed, as disclosed to the consumer.
17 (4) Avoid secondary use. Except as provided in this chapter, a
18 controller may not process personal data for purposes that are not
19 reasonably necessary to, or compatible with, the purposes for which
20 such personal data are processed, as disclosed to the consumer,
21 unless the controller obtains the consumer's consent.
22 (5) Security. A controller shall establish, implement, and
23 maintain reasonable administrative, technical, and physical data
24 security practices to protect the confidentiality, integrity, and
25 accessibility of personal data. Such data security practices shall be
26 appropriate to the volume and nature of the personal data at issue.
27 (6) Nondiscrimination. A controller may not process personal data
28 in violation of state and federal laws that prohibit unlawful
29 discrimination against consumers. A controller shall not discriminate
30 against a consumer for exercising any of the rights contained in this
31 chapter, including denying goods or services to the consumer,
32 charging different prices or rates for goods or services, and
33 providing a different level of quality of goods and services to the
34 consumer. This subsection shall not prohibit a controller from
35 offering a different price, rate, level, quality, or selection of
36 goods or services to a consumer, including offering goods or services
37 for no fee, if the offering is in connection with a consumer's
38 voluntary participation in a bona fide loyalty, rewards, premium
39 features, discounts, or club card program. A controller may not sell
40 personal data to a third-party controller as part of such a program
Code Rev/JO:eab 16 H-4322.1/20
1 unless: (a) The sale is reasonably necessary to enable the third
2 party to provide a benefit to which the consumer is entitled; (b) the
3 sale of personal data to third parties is clearly disclosed in the
4 terms of the program; and (c) the third party uses the personal data
5 only for purposes of facilitating such benefit to which the consumer
6 is entitled and does not retain or otherwise use or disclose the
7 personal data for any other purpose.
8 (7) Sensitive data. Except as otherwise provided in this act, a
9 controller may not process sensitive data concerning a consumer
10 without obtaining the consumer's consent, or, in the case of the
11 processing of personal data concerning a known child, without
12 obtaining consent from the child's parent or lawful guardian, in
13 accordance with the children's online privacy protection act
14 requirements.
15 (8) Nonwaiver of consumer rights. Any provision of a contract or
16 agreement of any kind that purports to waive or limit in any way a
17 consumer's rights under this chapter shall be deemed contrary to
18 public policy and shall be void and unenforceable.
19 NEW SECTION. Sec. 9. DATA PROTECTION ASSESSMENTS. (1)
20 Controllers must conduct and document a data protection assessment of
21 each of the following processing activities involving personal data:
22 (a) The processing of personal data for purposes of targeted
23 advertising;
24 (b) The sale of personal data;
25 (c) The processing of personal data for purposes of profiling,
26 where such profiling presents a reasonably foreseeable risk of: (i)
27 Unfair or deceptive treatment of, or disparate impact on, consumers;
28 (ii) financial, physical, or reputational injury to consumers; (iii)
29 a physical or other intrusion upon the solitude or seclusion, or the
30 private affairs or concerns, of consumers, where such intrusion would
31 be offensive to a reasonable person; or (iv) other substantial injury
32 to consumers;
33 (d) The processing of sensitive data; and
34 (e) Any processing activities involving personal data that
35 present a heightened risk of harm to consumers.
36 Such data protection assessments must take into account the type
37 of personal data to be processed by the controller, including the
38 extent to which the personal data are sensitive data, and the context
39 in which the personal data are to be processed.
Code Rev/JO:eab 17 H-4322.1/20
1 (2) Data protection assessments conducted under subsection (1) of
2 this section must identify and weigh the benefits that may flow
3 directly and indirectly from the processing to the controller,
4 consumer, other stakeholders, and the public against the potential
5 risks to the rights of the consumer associated with such processing,
6 as mitigated by safeguards that can be employed by the controller to
7 reduce such risks. The use of deidentified data and the reasonable
8 expectations of consumers, as well as the context of the processing
9 and the relationship between the controller and the consumer whose
10 personal data will be processed, must be factored into this
11 assessment by the controller.
12 (3) The attorney general may request, in writing, that a
13 controller disclose any data protection assessment that is relevant
14 to an investigation of the controller conducted by the attorney
15 general. The controller must make a data protection assessment
16 available to the attorney general upon such a request. The attorney
17 general may evaluate the data protection assessments for compliance
18 with the responsibilities contained in section 8 of this act and with
19 other laws including, but not limited to, chapter 19.86 RCW. Data
20 protection assessments are confidential and exempt from public
21 inspection and copying under chapter 42.56 RCW. The disclosure of a
22 data protection assessment pursuant to a request from the attorney
23 general under this subsection does not constitute a waiver of the
24 attorney-client privilege or work product protection with respect to
25 the assessment and any information contained in the assessment.
26 (4) Data protection assessments conducted by a controller for the
27 purpose of compliance with other laws or regulations may qualify
28 under this section if they have a similar scope and effect.
29 NEW SECTION. Sec. 10. LIMITATIONS AND APPLICABILITY. (1) The
30 obligations imposed on controllers or processors under this chapter
31 do not restrict a controller's or processor's ability to:
32 (a) Comply with federal, state, or local laws, rules, or
33 regulations;
34 (b) Comply with a civil, criminal, or regulatory inquiry,
35 investigation, subpoena, or summons by federal, state, local, or
36 other governmental authorities;
37 (c) Cooperate with law enforcement agencies concerning conduct or
38 activity that the controller or processor reasonably and in good
Code Rev/JO:eab 18 H-4322.1/20
1 faith believes may violate federal, state, or local laws, rules, or
2 regulations;
3 (d) Investigate, establish, exercise, prepare for, or defend
4 legal claims;
5 (e) Provide a product or service specifically requested by a
6 consumer, perform a contract to which the consumer is a party, or
7 take steps at the request of the consumer prior to entering into a
8 contract;
9 (f) Protect the vital interests of the consumer or of another
10 natural person;
11 (g) Prevent, detect, protect against, or respond to security
12 incidents, identity theft, fraud, harassment, malicious or deceptive
13 activities, or any illegal activity; preserve the integrity or
14 security of systems; or investigate, report, or prosecute those
15 responsible for any such action;
16 (h) Process personal data for reasons of public interest in the
17 areas of public health, or generalizable scientific, historical, or
18 statistical research, but solely to the extent that the processing is
19 (i) subject to suitable and specific measures to safeguard the rights
20 of the consumer; and (ii) under the responsibility of a professional
21 subject to confidentiality obligations under federal, state, or local
22 law; or
23 (i) Assist another controller, processor, or third party with any
24 of the obligations under this subsection.
25 (2) The obligations imposed on controllers or processors under
26 this chapter do not restrict a controller's or processor's ability to
27 collect, use, or retain data to:
28 (a) Conduct internal research to improve, repair, or develop
29 products, services, or technology;
30 (b) Identify and repair technical errors that impair existing or
31 intended functionality; or
32 (c) Perform internal operations that are reasonably aligned with
33 the expectations of the consumer based on the consumer's existing
34 relationship with the controller, or are otherwise compatible with
35 processing in furtherance of the provision of a product or service
36 specifically requested by a consumer or the performance of a contract
37 to which the consumer is a party.
38 (3) The obligations imposed on controllers or processors under
39 this chapter do not apply where compliance by the controller or
40 processor with this chapter would violate an evidentiary privilege
Code Rev/JO:eab 19 H-4322.1/20
1 under Washington law and do not prevent a controller or processor
2 from providing personal data concerning a consumer to a person
3 covered by an evidentiary privilege under Washington law as part of a
4 privileged communication.
5 (4) A controller or processor that discloses personal data to a
6 third-party controller or processor in compliance with the
7 requirements of this chapter is not in violation of this chapter if
8 the recipient processes such personal data in violation of this
9 chapter, provided that, at the time of disclosing the personal data,
10 the disclosing controller or processor did not have actual knowledge
11 that the recipient intended to commit a violation. A third-party
12 controller or processor receiving personal data from a controller or
13 processor in compliance with the requirements of this chapter is
14 likewise not in violation of this chapter for the obligations of the
15 controller or processor from which it receives such personal data.
16 (5) Obligations imposed on controllers and processors under this
17 chapter shall not:
18 (a) Adversely affect the rights or freedoms of any persons, such
19 as exercising the right of free speech pursuant to the First
20 Amendment to the United States Constitution; or
21 (b) Apply to the processing of personal data by a natural person
22 in the course of a purely personal or household activity.
23 (6) Personal data that are processed by a controller pursuant to
24 this section must not be processed for any purpose other than those
25 expressly listed in this section. Personal data that are processed by
26 a controller pursuant to this section may be processed solely to the
27 extent that such processing is: (i) Necessary, reasonable, and
28 proportionate to the purposes listed in this section; and (ii)
29 adequate, relevant, and limited to what is necessary in relation to
30 the specific purpose or purposes listed in this section. Furthermore,
31 personal data that are collected, used, or retained pursuant to
32 subsection (2) of this section must, insofar as possible, taking into
33 account the nature and purpose or purposes of such collection, use,
34 or retention, be subjected to reasonable administrative, technical,
35 and physical measures to protect the confidentiality, integrity, and
36 accessibility of the personal data, and to reduce reasonably
37 foreseeable risks of harm to consumers relating to such collection,
38 use, or retention of personal data.
39 (7) If a controller processes personal data pursuant to an
40 exemption in this section, the controller bears the burden of
Code Rev/JO:eab 20 H-4322.1/20
1 demonstrating that such processing qualifies for the exemption and
2 complies with the requirements in subsection (6) of this section.
3 (8) Processing personal data solely for the purposes expressly
4 identified in subsection (1)(a) through (d) or (g) of this section
5 does not, by itself, make an entity a controller with respect to such
6 processing.
7 NEW SECTION. Sec. 11. LIABILITY. (1) Any violation of this
8 chapter shall not serve as the basis for, or be subject to, a private
9 right of action under this chapter or under any other law. This does
10 not relieve any party from any duties or obligations imposed, or to
11 alter any independent rights that consumers have under other laws,
12 chapter 19.86 RCW, the Washington state Constitution, or the United
13 States Constitution.
14 (2) Where more than one controller or processor, or both a
15 controller and a processor, involved in the same processing, is in
16 violation of this chapter, the liability must be allocated among the
17 parties according to principles of comparative fault.
18 NEW SECTION. Sec. 12. ENFORCEMENT. (1) The attorney general has
19 exclusive authority to enforce this chapter by bringing an action in
20 the name of the state, or as parens patriae on behalf of persons
21 residing in the state.
22 (2) Any controller or processor that violates this chapter is
23 subject to an injunction and liable for a civil penalty of not more
24 than seven thousand five hundred dollars for each violation.
25 NEW SECTION. Sec. 13. CONSUMER PRIVACY ACCOUNT. The consumer
26 privacy account is created in the state treasury. All receipts from
27 the imposition of civil penalties under this chapter must be
28 deposited into the account except for the recovery of costs and
29 attorneys' fees accrued by the attorney general in enforcing this
30 chapter. Moneys in the account may be spent only after appropriation.
31 Moneys in the account may only be used for the purposes of the office
32 of privacy and data protection as created under RCW 43.105.369, and
33 may not be used to supplant general fund appropriations to the
34 agency.
35 NEW SECTION. Sec. 14. PREEMPTION. This chapter supersedes and
36 preempts laws, ordinances, regulations, or the equivalent adopted by
Code Rev/JO:eab 21 H-4322.1/20
1 any local entity regarding the processing of personal data by
2 controllers or processors.
3 NEW SECTION. Sec. 15. ATTORNEY GENERAL REPORT. (1) The attorney
4 general shall compile a report evaluating the liability and
5 enforcement provisions of this chapter including, but not limited to,
6 the effectiveness of its efforts to enforce this chapter, and any
7 recommendations for changes to such provisions.
8 (2) The attorney general shall submit the report to the governor
9 and the appropriate committees of the legislature by July 1, 2022.
10 NEW SECTION. Sec. 16. JOINT RESEARCH INITIATIVES. The governor
11 may enter into agreements with the governments of the Canadian
12 province of British Columbia and the states of California and Oregon
13 for the purpose of sharing personal data or personal information by
14 public bodies across national and state borders to enable
15 collaboration for joint data-driven research initiatives. Such
16 agreements must provide reciprocal protections that the respective
17 governments agree appropriately safeguard the data.
18 NEW SECTION. Sec. 17. FACIAL RECOGNITION. (1) Processors that
19 provide facial recognition services must make available an
20 application programming interface or other technical capability,
21 chosen by the processor, to enable controllers or third parties to
22 conduct legitimate, independent, and reasonable tests of those facial
23 recognition services for accuracy and unfair performance differences
24 across distinct subpopulations: PROVIDED, That making such an
25 application programming interface or other technical capability
26 available does not require the disclosure of proprietary data, trade
27 secrets, intellectual property, or other information, or if doing so
28 would increase the risk of cyberattacks including, without
29 limitation, cyberattacks related to unique methods of conducting
30 business, data unique to the product or services, or determining
31 prices or rates to be charged for services. Such subpopulations are
32 defined by visually detectable characteristics, such as (a) race,
33 skin tone, ethnicity, gender, age, or disability status, or (b) other
34 protected characteristics that are objectively determinable or self-
35 identified by the individuals portrayed in the testing dataset. If
36 the results of that independent testing identify material unfair
37 performance differences across subpopulations and the methodology,
Code Rev/JO:eab 22 H-4322.1/20
1 data, and results are disclosed in a manner that allow full
2 reproduction of the testing directly to the processor, who, acting
3 reasonably, determines that the methodology and results of that
4 testing are valid, then the processor must develop and implement a
5 plan to mitigate the identified performance differences. Nothing in
6 this subsection prevents a processor from prohibiting the use of the
7 processor's facial recognition service by a competitor for
8 competitive purposes.
9 (2) Processors that provide facial recognition services must
10 provide documentation that includes general information that:
11 (a) Explains the capabilities and limitations of the services in
12 plain language; and
13 (b) Enables testing of the services in accordance with this
14 section.
15 (3) Processors that provide facial recognition services must
16 prohibit, in the contract required by section 5 of this act, the use
17 of facial recognition services by controllers to unlawfully
18 discriminate under federal or state law against individual consumers
19 or groups of consumers.
20 (4) Controllers must provide a conspicuous and contextually
21 appropriate notice whenever a facial recognition service is deployed
22 in a physical premise open to the public that includes, at minimum,
23 the following:
24 (a) The purpose or purposes for which the facial recognition
25 service is deployed; and
26 (b) Information about where consumers can obtain additional
27 information about the facial recognition service including, but not
28 limited to, a link to any applicable online notice, terms, or policy
29 that provides information about where and how consumers can exercise
30 any rights that they have with respect to the facial recognition
31 service.
32 (5) Controllers must obtain consent from a consumer prior to
33 enrolling an image of that consumer in a facial recognition service
34 used in a physical premise open to the public.
35 (6) As an exception to subsection (5) of this section,
36 controllers may enroll an image of a consumer in a facial recognition
37 service for a security or safety purpose without first obtaining
38 consent from that consumer, provided that all of the following
39 requirements are met:
Code Rev/JO:eab 23 H-4322.1/20
1 (a) The controller must hold a reasonable suspicion, based on a
2 specific incident, that the consumer has engaged in criminal
3 activity, which includes, but is not limited to, shoplifting, fraud,
4 stalking, or domestic violence;
5 (b) Any database used by a facial recognition service for
6 identification, verification, or persistent tracking of consumers for
7 a security or safety purpose must be used solely for that purpose and
8 maintained separately from any other databases maintained by the
9 controller;
10 (c) The controller must review any such database used by the
11 controller's facial recognition service no less than annually to
12 remove facial templates of consumers whom the controller no longer
13 holds a reasonable suspicion that they have engaged in criminal
14 activity; and
15 (d) The controller must establish an internal process whereby a
16 consumer may correct or challenge the decision to enroll the image of
17 the consumer in a facial recognition service for a security or safety
18 purpose.
19 (7) Controllers using a facial recognition service to make
20 decisions that produce legal effects on consumers or similarly
21 significant effects on consumers must ensure that those decisions are
22 subject to meaningful human review.
23 (8) Prior to deploying a facial recognition service in the
24 context in which it will be used, controllers using a facial
25 recognition service to make decisions that produce legal effects on
26 consumers or similarly significant effects on consumers must test the
27 facial recognition service in operational conditions. Controllers
28 must take commercially reasonable steps to ensure best quality
29 results by following all reasonable guidance provided by the
30 developer of the facial recognition service.
31 (9) Controllers using a facial recognition service must conduct
32 periodic training of all individuals that operate a facial
33 recognition service or that process personal data obtained from the
34 use of facial recognition services. Such training shall include, but
35 not be limited to, coverage of:
36 (a) The capabilities and limitations of the facial recognition
37 service;
38 (b) Procedures to interpret and act on the output of the facial
39 recognition service; and
Code Rev/JO:eab 24 H-4322.1/20
1 (c) The meaningful human review requirement for decisions that
2 produce legal effects on consumers or similarly significant effects
3 on consumers, to the extent applicable to the deployment context.
4 (10) Controllers shall not knowingly disclose personal data
5 obtained from a facial recognition service to a law enforcement
6 agency, except when such disclosure is:
7 (a) Pursuant to the consent of the consumer to whom the personal
8 data relates;
9 (b) Required by federal, state, or local law in response to a
10 court order, court-ordered warrant, or subpoena or summons issued by
11 a judicial officer or grand jury;
12 (c) Necessary to prevent or respond to an emergency involving
13 danger of death or serious physical injury to any person, upon a good
14 faith belief by the controller; or
15 (d) To the national center for missing and exploited children, in
16 connection with a report submitted thereto under Title 18 U.S.C. Sec.
17 2258A.
18 (11) Controllers that deploy a facial recognition service must
19 respond to a consumer request to exercise the rights specified in
20 section 6 of this act and must fulfill the duties identified in
21 section 8 of this act.
22 (12) Voluntary facial recognition services used to verify an
23 aviation passenger's identity in connection with services regulated
24 by the secretary of transportation under Title 49 U.S.C. Sec. 41712
25 and exempt from state regulation under Title 49 U.S.C. Sec.
26 41713(b)(1) are exempt from section 18 of this act. Images captured
27 by an airline must not be retained for more than twenty-four hours
28 and, upon request of the attorney general, airlines must certify that
29 they do not retain the image for more than twenty-four hours. An
30 airline facial recognition service must disclose and obtain consent
31 from the customer prior to capturing an image.
32 NEW SECTION. Sec. 18. Sections 1 through 17 and 19 of this act
33 constitute a new chapter in Title 19 RCW.
34 NEW SECTION. Sec. 19. This act takes effect July 31, 2021.
--- END ---
Code Rev/JO:eab 25 H-4322.1/20
File and source
- File
- 2020-02-05_a26543_d212598_2742-pshb-h-4322-1.pdf
- Size
- 285,387 bytes
- SHA-256
- 374db8e8f268969ab3d68a5f1c8d81ec684bab84e2ad2b37e4bf63161cf185c5
- Original
- No public link identified.