ITED Amendment Tracker (2/07/2020)
Summary
An amendment tracker dated 2/07/2020, labeled ITED and prepared by the Office of Program Research (nonpartisan staff). It lists substitute and amendment entries for 2742, concerning the management and oversight of personal data, with the sponsor of each and a bulleted description of its effect. One entry modifies the exemption for data maintained for employment records purposes by expiring the exemption one year after the effective date of the bill. Another allows a controller to offer different prices or rates of service to a consumer who voluntarily participates in a loyalty or reward program.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“ITED Amendment Tracker (2/07/2020).”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2020-02-07-a26544-d214883-ited-amendment-tracker-feb-7-6dc0d61828/
, SHA-256 450b1495bfa1b1468b38c41bc4d5d7906cd407ffe2c18a074904ea13ef8ca4de.Full text
ITED AMENDMENT TRACKER 2/07/2020
BILL
SPONSOR SUBS/AMENDMENTS EFFECT
DESCRIPTION
Makes numerous substantive changes as specified in the summary of the proposed substitute.
■ PS-2742 (H4111.1) by Rep. Hudgins
2742
(Rep. Kloba) • Modifies the exemption for data maintained for employment records purposes by expiring
➢ 2742 AMH ITED H4119.1 by Rep.
the exemption one year after the effective date of the bill.
Slatter
Concerning
the • Specifies that certain data are exempt from the requirements of the bill only to the extent
management ➢ 2742 AMH ITED H4129.1 by Rep. that the collection or processing of that data is in substantial compliance with federal and
and oversight Hudgins state laws to which the data are subject and which are specified in the exemptions.
of personal
data. • Removes from the jurisdictional scope section the thresholds that a business must meet in
order to be subject to the bill to provide that the bill applies to legal entities that conduct
business in Washington or produce products or services that are targeted to residents of
Washington. Exempts from the provisions of the bill legal entities that fall below a certain size
➢ 2742 AMH ITED H4130.1 by Rep.
and annual revenue amount, that control or process personal data of fewer than 20,000
Hudgins
consumers, and that do not disclose or share consumer data other than as necessary to
provide requested products or services or that monetize personal data within the limits set in
the exemption.
Makes the same substantive changes as PS-2742 (H-4411) and additionally:
• Modifies the provision prohibiting discrimination against consumers who exercise personal
data rights and allows a controller to offer different prices or rates of service to a consumer
who voluntarily participates in a loyalty or reward program.
• Provides that making available an application programming interface for accuracy and bias
testing does not require the disclosure of proprietary data, trade secrets, or other
■ PS-2742 (H4322.1) by Rep. Hudgins
information, if doing so would increase the risk of cyberattacks.
• Removes the requirement to remove facial templates that are more than three years old
from any database used by a controller's facial recognition service.
• Modifies the requirement to test a facial recognition service in operational conditions by
making the requirement applicable only to those controllers that use a facial recognition
service to make decisions that produce legal or similarly significant effects on consumers.
1
Prepared by the Office of Program Research (nonpartisan staff)
Makes substantive changes to the jurisdictional scope, consumer rights, responsibilities of
controllers and processors, facial recognition, and liability and enforcement provisions of the bill
as specified in the summary of the proposed substitute. Some of the changes include:
• Modifies the thresholds that a legal entity must meet before the obligations of the bill apply
to that entity.
• Specifies that certain data are exempt from the requirements of the bill only to the extent
that the collection or processing of that data is in substantial compliance with federal and
state laws to which the data are subject and which are specified in the exemptions.
• Modifies the time limit within which controllers must respond to consumer requests, notify
2742 consumers of any extension, or inform consumers of reasons for not taking action on a
(Rep. Kloba) ■ PS-2742 (H-4642.1) by Rep. Hudgins
request from 45 to 21 days.
• Removes the requirement for controllers to conduct data protection assessments for each of
Concerning their processing activities and specifies the activities for which controllers must conduct data
the protection assessments.
management • Provides that violations are enforceable under the Consumer Protection Act; modifies civil
and oversight penalties for violations and adds civil penalties for intentional violations.
of personal • Provides that the bill does not preempt local laws or ordinances regarding facial recognition.
data. • Modifies multiple definitions and requirements by removing the word "reasonable" or
reasonably."
Strikes all the underlying provisions of the bill and does the following provisions from HB 2364 by
Rep. Smith:
• Provides that an individual residing in Washington state has the following rights with regard
to the individual's personal data: (a) The right to know what personal data a business collects
or processes about the individual; (b) the right to access and obtain the individual's personal
data collected or processed by a business; (c) the right to object to and opt out of the selling
or licensing of personal data; (d) the right to correct inaccurate personal data; and (e) the
➢ 2742 AMH ITED H-4689.1 by Rep. right to delete the individual's personal data collected or processed by a business.
Smith • Specifies that a business has the following duties: (a) Provide a prominent and easy-to-read
privacy policy; (b) minimize the collection of personal data; (c) avoid secondary uses of
personal data; (d) obtain an individual's affirmative opt-in consent for any processing outside
of what is necessary to fulfill the individual's request, prevent fraud, comply with legal
requirements, and for other purely operational purposes; (e) secure personal data from
unauthorized acquisition or access; (f) act in good faith and with due diligence when
responding to requests from individuals to exercise personal data rights; and (g) not
discriminate against individuals who choose to exercise their personal data rights.
2
Prepared by the Office of Program Research (nonpartisan staff)
• Provides that a business must require service to process personal data only on documented
instructions from the business on whose behalf service providers are processing personal
data.
• Requires a business to use only those service providers that deliver sufficient guarantees that
processing meets the requirements of this bill and ensures the protection of personal data
rights.
• Exempts employment-related information from the provisions of the bill.
• Makes violations of the bill enforceable under the state Consumer Protection Act.
• Sets forth civil penalties of up to $10,000 per violation in actions brought by the Attorney
2742 General and statutory damages of $10,000 per violation in actions brought by individuals.
(Rep. Kloba) CONFLICT: ALL BAKY AMENDMENTS
Concerning • Modifies the definition of "child" to apply to a natural person under eighteen, rather than
the thirteen, years of age. Eliminates the exemption related to controllers that are in compliance
management ➢ 2742-PS AMH ITED BAKY 107 by with parental consent mechanisms under the federal Children's Online Privacy Protection Act.
and oversight Rep. Van Werven Modifies the provisions related to sensitive data by requiring controllers to obtain parental
of personal consent for processing sensitive data of a known child.
data.
➢ 2742-PS AMH ITED BAKY 094 by • Includes in the definition of "consumer" a natural person acting in a commercial context.
Rep. Van Werven
• Modifies the definition of "deidentified data" by requiring that a controller take reasonable
➢ 2742-PS AMH ITED BAKY 095 by measures to ensure that data cannot be associated with a device or household, as well as a
Rep. Smith natural person.
• Removes facial recognition provisions and related definitions from the bill.
➢ 2742-PS AMH ITED BAKY 096 by
CONFLICT: BAKY 121
Rep. Van Werven
• Adds a definition of "lawful basis for processing." Specifies that the exemptions set forth in
➢ 2742-PS AMH ITED BAKY 122 by the jurisdictional scope section of the bill apply only to the extent that a controller is able to
Rep. Smith demonstrate a lawful basis for processing.
➢ 2742-PS AMH ITED BAKY 097 by • Removes the definition for "personal data" an exemption for publicly available information.
Rep. Smith
• Modifies the definition of "pseudonymous data" provide that the term means a controller or
➢ 2742-PS AMH ITED BAKY 098 by processor cannot in good faith reasonably associate personal data with a specific natural
Rep. Smith person without the use of additional information. Specifies that photographs or other visual
depictions of a person cannot be pseudonymous. s
3
Prepared by the Office of Program Research (nonpartisan staff)
• Modifies the definition of "sale" by specifying several activities that are considered a "sale."
➢ 2742-PS AMH ITED BAKY 099 by Specifies that in order to be considered a "sale," an activity may be done for a commercial
Rep. Smith purpose, as well as for monetary or other valuable consideration.
• Modifies the definition of "sale" by including in the definition disclosure of information made
public by a consumer and disclosure or transfer of personal data as part of certain
➢ 2742-PS AMH ITED BAKY 100 by
transactions where a third party assumes control of a controller's assets.
Rep. Smith
CONFLICT: BAKY 112; BAKY 113
2742 • Modifies the definition of "sale" by including in the definition disclosure of information made
(Rep. Kloba) ➢ 2742-PS AMH ITED BAKY 112 by public by a consumer.
Rep. Smith CONFLICT: BAKY 100
Concerning
the • Modifies the definition of "sale" by including in the definition disclosure or transfer of
management personal data as part of certain transactions where a third party assumes control of a
and oversight ➢ 2742-PS AMH ITED BAKY 113 by
controller's assets.
of personal Rep. Smith
CONFLICT: BAKY 100
data.
• Removes from the right to correction the authorization to take into account the nature of
➢ 2742-PS AMH ITED BAKY 101 by
personal data and the purposes of processing.
Rep. Van Werven
➢ 2742-PS AMH ITED BAKY 102 by • Removes from the right to data portability the reference to the right of access.
Rep. Smith
• Modifies the right to opt out by providing that a consumer has the right to opt out of the
➢ 2742-PS AMH ITED BAKY 103 by
processing of personal data, rather than opt out of the processing for specified purposes.
Rep. Smith
• Requires a controller to communicate a consumer's request to correct or delete personal
➢ 2742-PS AMH ITED BAKY 104 by data, or to opt-out from certain processing to all third parties to whom personal data was
Rep. Van Werven disclosed within one year preceding the consumer's request.
• Modifies the conditions that must be met before a controller is permitted not to comply with
an authenticated consumer request by removing on of the conditions related to using
➢ 2742-PS AMH ITED BAKY 105 by
personal data to recognize or respond to a consumer, or to associate personal data with
Rep. Smith
other personal data of the consumer.
➢ 2742-PS AMH ITED BAKY 106 by • Modifies the responsibility of a controller to minimize data collection by requiring that the
Rep. Smith controller collect personal data only as reasonably necessary for specified purposes, rather
4
Prepared by the Office of Program Research (nonpartisan staff)
than adequate, relevant, and limited to what is necessary for processing purposes, as
disclosed to consumer.
• Adds a prohibition on the commercial use of a consumer's name, voice, signature,
➢ 2742-PS AMH ITED BAKY 108 by photograph, or likeness without the consumer's consent. Specifies that this prohibition does
Rep. Smith not limit the individual property rights in one's likeness under chapter 63.60 RCW.
• Removes the specification that a data protection assessment disclosed by a controller to the
➢ 2742-PS AMH ITED BAKY 109 by
Attorney General be relevant to the Attorney's General investigation of the controller.
2742 Rep. Smith
(Rep. Kloba) • Removes the provision exempting data protection assessments disclosed to the Attorney
➢ 2742-PS AMH ITED BAKY 110 by
General from public inspection under the Public Records Act.
Concerning Rep. Smith
the • Modifies the exemption related to protecting vital interests and allows controllers take
management ➢ 2742-PS AMH ITED BAKY 111 by immediate steps to protect interests essential for the life of the consumer or another person
and oversight Rep. Smith where no other lawful basis for processing applies.
of personal
data. • Removes the exemption related to processing data for reasons of public interest.
➢ 2742-PS AMH ITED BAKY 114 by
CONFLICT: BAKY 118
Rep. Smith
• Modifies the exemption related to the processing of personal data for public interest reasons
to allow processing for certain research that adheres to all other applicable ethics and privacy
➢ 2742-PS AMH ITED BAKY 118 by laws and is regulated by an oversight entity that ensures that certain requirements for the
Rep. Slatter research are met.
CONFLICT: BAKY 114
➢ 2742-PS AMH ITED BAKY 115 by • Removes the exemption related to conducting internal research.
Rep. Smith
• Removes the exemption related to performing internal operations aligned with a consumer's
➢ 2742-PS AMH ITED BAKY 117 by
expectation.
Rep. Smith
• Modifies in the enforcement provisions the civil penalties to not more than $10,000 per
violation. Specifies that a violation of the chapter is an injury. Specifies the remedies available
➢ 2742-PS AMH ITED BAKY 119 by to a consumer, including statutory damages of not less than $10,000 per violation. Requires a
Rep. Smith court to award costs and reasonable attorneys' fees to a prevailing plaintiff. Specifies that
these remedies are in addition to any other rights and remedies provided by law.
5
Prepared by the Office of Program Research (nonpartisan staff)
• Removes the provisions related joint research initiatives with other states and Canadian
➢ 2742-PS AMH ITED BAKY 120 by
provinces.
Rep. Van Werven
• Allows controllers to enroll a consumer's image in a facial recognition service for a security or
➢ 2742-PS AMH ITED BAKY 121 by safety purpose without the consumer's consent if all of the specified requirements are met.
Rep. Tarleton CONFLICT: BAKY 096
6
Prepared by the Office of Program Research (nonpartisan staff)
File and source
- File
- 2020-02-07_a26544_d214883_ited-amendment-tracker-feb-7.pdf
- Size
- 232,040 bytes
- SHA-256
- 450b1495bfa1b1468b38c41bc4d5d7906cd407ffe2c18a074904ea13ef8ca4de
- Original
- No public link identified.