Second Substitute Senate Bill 6281 - Washington Privacy Act (State of Washington, 66th Legislature)
Summary
Second Substitute Senate Bill 6281 of the State of Washington, 66th Legislature, by Senate Ways & Means, read first time 02/07/20. It is an act relating to the management and oversight of personal data, adding a new chapter to Title 19 RCW, prescribing penalties and providing an effective date. Section 1 states that the act may be known and cited as the Washington privacy act. Section 2 sets out legislative findings, including that the people of Washington regard their privacy as a fundamental right. Section 18 states that the chapter does not apply to institutions of higher education or nonprofit corporations for a period, and Section 20 states that the act takes effect July 31, 2021.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Second Substitute Senate Bill 6281 - Washington Privacy Act (State of Washington, 66th Legislature).”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2020-02-26-a26766-bill-6281-s2-d2b7c519c8/
, SHA-256 b3edfa43f1bdceacda98816ae3a98af954eb4b35cb874828c77e78b6b57cfd58.Full text
S-6225.1
SECOND SUBSTITUTE SENATE BILL 6281
State of Washington 66th Legislature 2020 Regular Session
By Senate Ways & Means (originally sponsored by Senators Carlyle,
Nguyen, Rivers, Short, Sheldon, Wellman, Lovelett, Das, Van De Wege,
Billig, Randall, Pedersen, Dhingra, Hunt, Salomon, Liias, Mullet,
Wilson, C., Frockt, Cleveland, and Keiser)
READ FIRST TIME 02/07/20.
1 AN ACT Relating to the management and oversight of personal data;
2 adding a new chapter to Title 19 RCW; prescribing penalties; and
3 providing an effective date.
4 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:
5 NEW SECTION. Sec. 1. SHORT TITLE. This act may be known and
6 cited as the Washington privacy act.
7 NEW SECTION. Sec. 2. LEGISLATIVE FINDINGS. (1) The legislature
8 finds that the people of Washington regard their privacy as a
9 fundamental right and an essential element of their individual
10 freedom. Washington's Constitution explicitly provides the right to
11 privacy, and fundamental privacy rights have long been and continue
12 to be integral to protecting Washingtonians and to safeguarding our
13 democratic republic.
14 (2) Ongoing advances in technology have produced an exponential
15 growth in the volume and variety of personal data being generated,
16 collected, stored, and analyzed, which presents both promise and
17 potential peril. The ability to harness and use data in positive ways
18 is driving innovation and brings beneficial technologies to society;
19 however, it has also created risks to privacy and freedom. The
20 unregulated and unauthorized use and disclosure of personal
p. 1 2SSB 6281
1 information and loss of privacy can have devastating impacts, ranging
2 from financial fraud, identity theft, and unnecessary costs, to
3 personal time and finances, to destruction of property, harassment,
4 reputational damage, emotional distress, and physical harm.
5 (3) Given that technological innovation and new uses of data can
6 help solve societal problems and improve quality of life, the
7 legislature seeks to shape responsible public policies where
8 innovation and protection of individual privacy coexist. The
9 legislature notes that our federal authorities have not developed or
10 adopted into law regulatory or legislative solutions that give
11 consumers control over their privacy. In contrast, the European
12 Union's general data protection regulation has continued to influence
13 data privacy policies and practices of those businesses competing in
14 global markets. In the absence of federal standards, Washington and
15 other states across the United States are analyzing elements of the
16 European Union's general data protection regulation to enact state-
17 based data privacy regulatory protections.
18 (4) With this act, Washington state will be among the first tier
19 of states giving consumers the ability to protect their own rights to
20 privacy and requiring companies to be responsible custodians of data
21 as technological innovations emerge. This act does so by explicitly
22 providing consumers the right to access, correction, and deletion of
23 personal data, as well as the right to opt out of the collection and
24 use of personal data for certain purposes. These rights will add to,
25 and not subtract from, the consumer protection rights that consumers
26 already have under Washington state law.
27 (5) Additionally, this act imposes affirmative obligations upon
28 companies to safeguard personal data and provide clear,
29 understandable, and transparent information to consumers about how
30 their personal data are used. It strengthens compliance and
31 accountability by requiring data protection assessments in the
32 collection and use of personal data. Finally, it empowers the state
33 attorney general to obtain and evaluate a company's data protection
34 assessments, to impose penalties where violations occur, and to
35 prevent against future violations.
36 (6) The legislature also encourages the state office of privacy
37 and data protection to monitor the development of universal privacy
38 controls that communicate a consumer's affirmative, freely given, and
39 unambiguous choice to opt out of the processing of personal data
40 concerning the consumer for the purposes of targeted advertising, the
p. 2 2SSB 6281
1 sale of personal data, or profiling in furtherance of decisions that
2 produce legal effects concerning the consumer or similarly
3 significant effects concerning consumers.
4 (7) The legislature recognizes the unique business needs of
5 institutions of higher education and nonprofit corporations. However,
6 these entities control and process an extraordinary amount of
7 personal data and consumers should be afforded the rights provided by
8 this act regarding personal data. Therefore, it is the intent of the
9 legislature to delay the date of application for these entities by
10 three years in order to provide sufficient time to develop a plan to
11 comply with the provisions of this act.
12 NEW SECTION. Sec. 3. DEFINITIONS. The definitions in this
13 section apply throughout this chapter unless the context clearly
14 requires otherwise.
15 (1) "Affiliate" means a legal entity that controls, is controlled
16 by, or is under common control with, that other legal entity. For
17 these purposes, "control" or "controlled" means ownership of, or the
18 power to vote, more than fifty percent of the outstanding shares of
19 any class of voting security of a company; control in any manner over
20 the election of a majority of the directors or of individuals
21 exercising similar functions; or the power to exercise a controlling
22 influence over the management of a company.
23 (2) "Authenticate" means to use reasonable means to determine
24 that a request to exercise any of the rights in section 6 (1) through
25 (4) of this act is being made by the consumer who is entitled to
26 exercise such rights with respect to the personal data at issue.
27 (3) "Business associate" has the same meaning as in Title 45
28 C.F.R., established pursuant to the federal health insurance
29 portability and accountability act of 1996.
30 (4) "Child" means any natural person under thirteen years of age.
31 (5) "Consent" means a clear affirmative act signifying a freely
32 given, specific, informed, and unambiguous indication of a consumer's
33 agreement to the processing of personal data relating to the
34 consumer, such as by a written statement, including by electronic
35 means, or other clear affirmative action.
36 (6) "Consumer" means a natural person who is a Washington
37 resident acting only in an individual or household context. It does
38 not include a natural person acting in a commercial or employment
39 context.
p. 3 2SSB 6281
1 (7) "Controller" means the natural or legal person which, alone
2 or jointly with others, determines the purposes and means of the
3 processing of personal data.
4 (8) "Covered entity" has the same meaning as in Title 45 C.F.R.,
5 established pursuant to the federal health insurance portability and
6 accountability act of 1996.
7 (9) "Decisions that produce legal effects concerning a consumer
8 or similarly significant effects concerning a consumer" means
9 decisions that result in the provision or denial of financial and
10 lending services, housing, insurance, education enrollment, criminal
11 justice, employment opportunities, health care services, or access to
12 basic necessities, such as food and water.
13 (10) "Deidentified data" means data that cannot reasonably be
14 used to infer information about, or otherwise be linked to, an
15 identified or identifiable natural person, or a device linked to such
16 person, provided that the controller that possesses the data: (a)
17 Takes reasonable measures to ensure that the data cannot be
18 associated with a natural person; (b) publicly commits to maintain
19 and use the data only in a deidentified fashion and not attempt to
20 reidentify the data; and (c) contractually obligates any recipients
21 of the information to comply with all provisions of this subsection.
22 (11) "Enroll," "enrolled," or "enrolling" means the process by
23 which a facial recognition service creates a facial template from one
24 or more images of a consumer and adds the facial template to a
25 gallery used by the facial recognition service for identification,
26 verification, or persistent tracking of consumers. It also includes
27 the act of adding an existing facial template directly into a gallery
28 used by a facial recognition service.
29 (12) "Facial recognition service" means technology that analyzes
30 facial features and is used for the identification, verification, or
31 persistent tracking of consumers in still or video images.
32 (13) "Facial template" means the machine-interpretable pattern of
33 facial features that is extracted from one or more images of a
34 consumer by a facial recognition service.
35 (14) "Health care facility" has the same meaning as in RCW
36 70.02.010.
37 (15) "Health care information" has the same meaning as in RCW
38 70.02.010.
39 (16) "Health care provider" has the same meaning as in RCW
40 70.02.010.
p. 4 2SSB 6281
1 (17) "Identification" means the use of a facial recognition
2 service by a controller to determine whether an unknown consumer
3 matches any consumer whose identity is known to the controller and
4 who has been enrolled by reference to that identity in a gallery used
5 by the facial recognition service.
6 (18) "Identified or identifiable natural person" means a person
7 who can be readily identified, directly or indirectly.
8 (19) "Institutions of higher education" has the same meaning as
9 in RCW 28B.92.030.
10 (20) "Local government" has the same meaning as in RCW 39.46.020.
11 (21) "Meaningful human review" means review or oversight by one
12 or more individuals who are trained in accordance with section 17(9)
13 of this act and who have the authority to alter the decision under
14 review.
15 (22) "Nonprofit corporation" has the same meaning as in RCW
16 24.03.005.
17 (23) "Ongoing surveillance" means tracking the physical movements
18 of a specified individual through one or more public places over
19 time, whether in real time or through application of a facial
20 recognition service to historical records. It does not include a
21 single recognition or attempted recognition of an individual if no
22 attempt is made to subsequently track that individual's movement over
23 time after the individual has been recognized.
24 (24) "Persistent tracking" means the use of a facial recognition
25 service to track the movements of a consumer on a persistent basis
26 without identification or verification of that consumer. Such
27 tracking becomes persistent as soon as:
28 (a) The facial template that permits the tracking uses a facial
29 recognition service for more than forty-eight hours after the first
30 enrolling of that template; or
31 (b) The data created by the facial recognition service in
32 connection with the tracking of the movements of the consumer are
33 linked to any other data such that the consumer who has been tracked
34 is identified or identifiable.
35 (25)(a) "Personal data" means any information that is linked or
36 reasonably linkable to an identified or identifiable natural person.
37 "Personal data" does not include deidentified data or publicly
38 available information.
p. 5 2SSB 6281
1 (b) For purposes of this subsection, "publicly available
2 information" means information that is lawfully made available from
3 federal, state, or local government records.
4 (26) "Process" or "processing" means any operation or set of
5 operations which are performed on personal data or on sets of
6 personal data, whether or not by automated means, such as the
7 collection, use, storage, disclosure, analysis, deletion, or
8 modification of personal data.
9 (27) "Processor" means a natural or legal person who processes
10 personal data on behalf of a controller.
11 (28) "Profiling" means any form of automated processing of
12 personal data to evaluate, analyze, or predict personal aspects
13 concerning an identified or identifiable natural person's economic
14 situation, health, personal preferences, interests, reliability,
15 behavior, location, or movements.
16 (29) "Protected health information" has the same meaning as in
17 Title 45 C.F.R., established pursuant to the federal health insurance
18 portability and accountability act of 1996.
19 (30) "Pseudonymous data" means personal data that cannot be
20 attributed to a specific natural person without the use of additional
21 information, provided that such additional information is kept
22 separately and is subject to appropriate technical and organizational
23 measures to ensure that the personal data are not attributed to an
24 identified or identifiable natural person.
25 (31) "Recognition" means the use of a facial recognition service
26 to determine whether:
27 (a) An unknown consumer matches any consumer who has been
28 enrolled in a gallery used by the facial recognition service; or
29 (b) An unknown consumer matches a specific consumer who has been
30 enrolled in a gallery used by the facial recognition service.
31 (32)(a) "Sale," "sell," or "sold" means the exchange of personal
32 data for monetary or other valuable consideration by the controller
33 to a third party.
34 (b) "Sale" does not include the following: (i) The disclosure of
35 personal data to a processor who processes the personal data on
36 behalf of the controller; (ii) the disclosure of personal data to a
37 third party with whom the consumer has a direct relationship for
38 purposes of providing a product or service requested by the consumer;
39 (iii) the disclosure or transfer of personal data to an affiliate of
40 the controller; (iv) the disclosure of information that the consumer
p. 6 2SSB 6281
1 (A) intentionally made available to the general public via a channel
2 of mass media, and (B) did not restrict to a specific audience; or
3 (v) the disclosure or transfer of personal data to a third party as
4 an asset that is part of a merger, acquisition, bankruptcy, or other
5 transaction in which the third party assumes control of all or part
6 of the controller's assets.
7 (33) "Security or safety purpose" means physical security,
8 protection of consumer data, safety, fraud prevention, or asset
9 protection.
10 (34) "Sensitive data" means (a) personal data revealing racial or
11 ethnic origin, religious beliefs, mental or physical health condition
12 or diagnosis, sexual orientation, or citizenship or immigration
13 status; (b) the processing of genetic or biometric data for the
14 purpose of uniquely identifying a natural person; (c) the personal
15 data from a known child; or (d) specific geolocation data. "Sensitive
16 data" is a form of personal data.
17 (35) "Serious criminal offense" means any felony under chapter
18 9.94A RCW or an offense enumerated by Title 18 U.S.C. Sec. 2516.
19 (36) "Specific geolocation data" means information derived from
20 technology, including, but not limited to, global positioning system
21 level latitude and longitude coordinates or other mechanisms, that
22 directly identifies the specific location of a natural person with
23 the precision and accuracy below one thousand seven hundred fifty
24 feet. Specific geolocation data excludes the content of
25 communications.
26 (37) "State agency" has the same meaning as in RCW 43.105.020.
27 (38) "Targeted advertising" means displaying advertisements to a
28 consumer where the advertisement is selected based on personal data
29 obtained from a consumer's activities over time and across
30 nonaffiliated web sites or online applications to predict such
31 consumer's preferences or interests. It does not include advertising:
32 (a) Based on activities within a controller's own web sites or online
33 applications; (b) based on the context of a consumer's current search
34 query or visit to a web site or online application; or (c) to a
35 consumer in response to the consumer's request for information or
36 feedback.
37 (39) "Third party" means a natural or legal person, public
38 authority, agency, or body other than the consumer, controller,
39 processor, or an affiliate of the processor or the controller.
p. 7 2SSB 6281
1 (40) "Verification" means the use of a facial recognition service
2 by a controller to determine whether a consumer is a specific
3 consumer whose identity is known to the controller and who has been
4 enrolled by reference to that identity in a gallery used by the
5 facial recognition service.
6 NEW SECTION. Sec. 4. JURISDICTIONAL SCOPE. (1) This chapter
7 applies to legal entities that conduct business in Washington or
8 produce products or services that are targeted to residents of
9 Washington, and that satisfy one or more of the following thresholds:
10 (a) During a calendar year, controls or processes personal data
11 of one hundred thousand consumers or more; or
12 (b) Derives over fifty percent of gross revenue from the sale of
13 personal data and processes or controls personal data of twenty-five
14 thousand consumers or more.
15 (2) This chapter does not apply to:
16 (a) State agencies, local governments, or tribes;
17 (b) Municipal corporations;
18 (c) Information that meets the definition of:
19 (i) Protected health information for purposes of the federal
20 health insurance portability and accountability act of 1996 and
21 related regulations;
22 (ii) Health care information for purposes of chapter 70.02 RCW;
23 (iii) Patient identifying information for purposes of 42 C.F.R.
24 Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2;
25 (iv) Identifiable private information for purposes of the federal
26 policy for the protection of human subjects, 45 C.F.R. Part 46;
27 identifiable private information that is otherwise information
28 collected as part of human subjects research pursuant to the good
29 clinical practice guidelines issued by the international council for
30 harmonisation; the protection of human subjects under 21 C.F.R. Parts
31 50 and 56; or personal data used or shared in research conducted in
32 accordance with one or more of the requirements set forth in this
33 subsection;
34 (v) Information and documents created specifically for, and
35 collected and maintained by:
36 (A) A quality improvement committee for purposes of RCW
37 43.70.510, 70.230.080, or 70.41.200;
38 (B) A peer review committee for purposes of RCW 4.24.250;
p. 8 2SSB 6281
1 (C) A quality assurance committee for purposes of RCW 74.42.640
2 or 18.20.390;
3 (D) A hospital, as defined in RCW 43.70.056, for reporting of
4 health care-associated infections for purposes of RCW 43.70.056, a
5 notification of an incident for purposes of RCW 70.56.040(5), or
6 reports regarding adverse events for purposes of RCW 70.56.020(2)(b);
7 (vi) Information and documents created for purposes of the
8 federal health care quality improvement act of 1986, and related
9 regulations;
10 (vii) Patient safety work product for purposes of 42 C.F.R. Part
11 3, established pursuant to 42 U.S.C. Sec. 299b-21 through 299b-26; or
12 (viii) Information that is (A) deidentified in accordance with
13 the requirements for deidentification set forth in 45 C.F.R. Part
14 164, and (B) derived from any of the health care-related information
15 listed in this subsection (2)(c);
16 (d) Information originating from, and intermingled to be
17 indistinguishable with, information under (c) of this subsection that
18 is maintained by:
19 (i) A covered entity or business associate as defined by the
20 health insurance portability and accountability act of 1996 and
21 related regulations;
22 (ii) A health care facility or health care provider as defined in
23 RCW 70.02.010; or
24 (iii) A program or a qualified service organization as defined by
25 42 C.F.R. Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2;
26 (e) Information used only for public health activities and
27 purposes as described in 45 C.F.R. Sec. 164.512;
28 (f)(i) An activity involving the collection, maintenance,
29 disclosure, sale, communication, or use of any personal information
30 bearing on a consumer's credit worthiness, credit standing, credit
31 capacity, character, general reputation, personal characteristics, or
32 mode of living by a consumer reporting agency, as defined in Title 15
33 U.S.C. Sec. 1681a(f), by a furnisher of information, as set forth in
34 Title 15 U.S.C. Sec. 1681s-2, who provides information for use in a
35 consumer report, as defined in Title 15 U.S.C. Sec. 1681a(d), and by
36 a user of a consumer report, as set forth in Title 15 U.S.C. Sec.
37 1681b.
38 (ii) (f)(i) of this subsection shall apply only to the extent
39 that such activity involving the collection, maintenance, disclosure,
40 sale, communication, or use of such information by that agency,
p. 9 2SSB 6281
1 furnisher, or user is subject to regulation under the fair credit
2 reporting act, Title 15 U.S.C. Sec. 1681 et seq., and the information
3 is not collected, maintained, used, communicated, disclosed, or sold
4 except as authorized by the fair credit reporting act;
5 (g) Personal data collected and maintained for purposes of
6 chapter 43.71 RCW;
7 (h) Personal data collected, processed, sold, or disclosed
8 pursuant to the federal Gramm-Leach-Bliley act (P.L. 106-102), and
9 implementing regulations, if the collection, processing, sale, or
10 disclosure is in compliance with that law;
11 (i) Personal data collected, processed, sold, or disclosed
12 pursuant to the federal driver's privacy protection act of 1994 (18
13 U.S.C. Sec. 2721 et seq.), if the collection, processing, sale, or
14 disclosure is in compliance with that law;
15 (j) Personal data regulated by the federal family educations
16 rights and privacy act, 20 U.S.C. Sec. 1232g and its implementing
17 regulations;
18 (k) Personal data regulated by the student user privacy in
19 education rights act, chapter 28A.604 RCW;
20 (l) Personal data collected, processed, sold, or disclosed
21 pursuant to the federal farm credit act of 1971 (as amended in 12
22 U.S.C. Sec. 2001-2279cc) and its implementing regulations (12 C.F.R.
23 Part 600 et seq.) if the collection, processing, sale, or disclosure
24 is in compliance with that law; or
25 (m) Data maintained for employment records purposes.
26 (3) Controllers that are in compliance with the verifiable
27 parental consent mechanisms under the children's online privacy
28 protection act, Title 15 U.S.C. Sec. 6501 through 6506 and its
29 implementing regulations, shall be deemed compliant with any
30 obligation to obtain parental consent under this chapter.
31 NEW SECTION. Sec. 5. RESPONSIBILITY ACCORDING TO ROLE. (1)
32 Controllers and processors are responsible for meeting their
33 respective obligations established under this chapter.
34 (2) Processors are responsible under this chapter for adhering to
35 the instructions of the controller and assisting the controller to
36 meet its obligations under this chapter. Such assistance shall
37 include the following:
38 (a) Taking into account the nature of the processing, the
39 processor shall assist the controller by appropriate technical and
p. 10 2SSB 6281
1 organizational measures, insofar as this is possible, for the
2 fulfillment of the controller's obligation to respond to consumer
3 requests to exercise their rights pursuant to section 6 of this act;
4 and
5 (b) Taking into account the nature of processing and the
6 information available to the processor, the processor shall assist
7 the controller in meeting the controller's obligations in relation to
8 the security of processing the personal data and in relation to the
9 notification of a breach of the security of the system pursuant to
10 RCW 19.255.010; and shall provide information to the controller
11 necessary to enable the controller to conduct and document any data
12 protection assessments required by section 9 of this act.
13 (3) Notwithstanding the instructions of the controller, a
14 processor shall:
15 (a) Implement and maintain reasonable security procedures and
16 practices to protect personal data, taking into account the context
17 in which the personal data are to be processed;
18 (b) Ensure that each person processing the personal data is
19 subject to a duty of confidentiality with respect to the data; and
20 (c) Engage a subcontractor only after providing the controller
21 with an opportunity to object and pursuant to a written contract in
22 accordance with subsection (5) of this section that requires the
23 subcontractor to meet the obligations of the processor with respect
24 to the personal data.
25 (4) Processing by a processor shall be governed by a contract
26 between the controller and the processor that is binding on both
27 parties and that sets out the processing instructions to which the
28 processor is bound, including the nature and purpose of the
29 processing, the type of personal data subject to the processing, the
30 duration of the processing, and the obligations and rights of both
31 parties. In addition, the contract shall include the requirements
32 imposed by this subsection and subsection (3) of this section, as
33 well as the following requirements:
34 (a) At the choice of the controller, the processor shall delete
35 or return all personal data to the controller as requested at the end
36 of the provision of services, unless retention of the personal data
37 is required by law;
38 (b)(i) The processor shall make available to the controller all
39 information necessary to demonstrate compliance with the obligations
40 in this chapter; and (ii) the processor shall allow for, and
p. 11 2SSB 6281
1 contribute to, reasonable audits and inspections by the controller or
2 the controller's designated auditor; alternatively, the processor
3 may, with the controller's consent, arrange for a qualified and
4 independent auditor to conduct, at least annually and at the
5 processor's expense, an audit of the processor's policies and
6 technical and organizational measures in support of the obligations
7 under this chapter using an appropriate and accepted control standard
8 or framework and audit procedure for such audits as applicable, and
9 shall provide a report of such audit to the controller upon request.
10 (5) In no event shall any contract relieve a controller or a
11 processor from the liabilities imposed on them by virtue of its role
12 in the processing relationship as defined by this chapter.
13 (6) Determining whether a person is acting as a controller or
14 processor with respect to a specific processing of data is a fact-
15 based determination that depends upon the context in which personal
16 data are to be processed. A person that is not limited in its
17 processing of personal data pursuant to a controller's instructions,
18 or that fails to adhere to such instructions, is a controller and not
19 a processor with respect to a specific processing of data. A
20 processor that continues to adhere to a controller's instructions
21 with respect to a specific processing of personal data remains a
22 processor. If a processor begins, alone or jointly with others,
23 determining the purposes and means of the processing of personal
24 data, it is a controller with respect to such processing.
25 NEW SECTION. Sec. 6. CONSUMER PERSONAL DATA RIGHTS. Consumers
26 may exercise the rights set forth in this section by submitting a
27 request, at any time, to a controller specifying which rights the
28 consumer wishes to exercise. In the case of processing personal data
29 concerning a known child, the parent or legal guardian of the known
30 child shall exercise the rights of this chapter on the child's
31 behalf. Except as provided in this chapter, the controller must
32 comply with a request to exercise the rights pursuant to subsections
33 (1) through (5) of this section.
34 (1) Right of access. A consumer has the right to confirm whether
35 or not a controller is processing personal data concerning the
36 consumer and access such personal data.
37 (2) Right to correction. A consumer has the right to correct
38 inaccurate personal data concerning the consumer, taking into account
p. 12 2SSB 6281
1 the nature of the personal data and the purposes of the processing of
2 the personal data.
3 (3) Right to deletion. A consumer has the right to delete
4 personal data concerning the consumer.
5 (4) Right to data portability. A consumer has the right to obtain
6 personal data concerning the consumer, which the consumer previously
7 provided to the controller, in a portable and, to the extent
8 technically feasible, readily usable format that allows the consumer
9 to transmit the data to another controller without hindrance, where
10 the processing is carried out by automated means.
11 (5) Right to opt out. A consumer has the right to opt out of the
12 processing of personal data concerning such consumer for purposes of
13 targeted advertising, the sale of personal data, or profiling in
14 furtherance of decisions that produce legal effects concerning a
15 consumer or similarly significant effects concerning a consumer.
16 (6) Responding to consumer requests. (a) A controller must inform
17 a consumer of any action taken on a request under subsections (1)
18 through (5) of this section without undue delay and in any event
19 within forty-five days of receipt of the request. That period may be
20 extended once by forty-five additional days where reasonably
21 necessary, taking into account the complexity and number of the
22 requests. The controller must inform the consumer of any such
23 extension within forty-five days of receipt of the request, together
24 with the reasons for the delay.
25 (b) If a controller does not take action on the request of a
26 consumer, the controller must inform the consumer without undue delay
27 and at the latest within forty-five days of receipt of the request of
28 the reasons for not taking action and instructions for how to appeal
29 the decision with the controller as described in subsection (7) of
30 this section.
31 (c) Information provided under this section must be provided by
32 the controller free of charge, up to twice annually to the consumer.
33 Where requests from a consumer are manifestly unfounded or excessive,
34 in particular because of their repetitive character, the controller
35 may either: (i) Charge a reasonable fee to cover the administrative
36 costs of complying with the request, or (ii) refuse to act on the
37 request. The controller bears the burden of demonstrating the
38 manifestly unfounded or excessive character of the request.
39 (d) A controller is not required to comply with a request to
40 exercise any of the rights under subsections (1) through (4) of this
p. 13 2SSB 6281
1 section if the controller is unable to authenticate the request using
2 commercially reasonable efforts. In such cases, the controller may
3 request the provision of additional information reasonably necessary
4 to authenticate the request.
5 (7)(a) Controllers must establish an internal process whereby
6 consumers may appeal a refusal to take action on a request to
7 exercise any of the rights under subsections (1) through (5) of this
8 section within a reasonable period of time after the consumer's
9 receipt of the notice sent by the controller under subsection (6)(b)
10 of this section.
11 (b) The appeal process must be conspicuously available and as
12 easy to use as the process for submitting such requests under this
13 section.
14 (c) Within thirty days of receipt of an appeal, a controller must
15 inform the consumer of any action taken or not taken in response to
16 the appeal, along with a written explanation of the reasons in
17 support thereof. That period may be extended by sixty additional days
18 where reasonably necessary, taking into account the complexity and
19 number of the requests serving as the basis for the appeal. The
20 controller must inform the consumer of any such extension within
21 thirty days of receipt of the appeal, together with the reasons for
22 the delay. The controller must also provide the consumer with an
23 email address or other online mechanism through which the consumer
24 may submit the appeal, along with any action taken or not taken by
25 the controller in response to the appeal and the controller's written
26 explanation of the reasons in support thereof, to the attorney
27 general.
28 (d) When informing a consumer of any action taken or not taken in
29 response to an appeal pursuant to (c) of this subsection, the
30 controller must clearly and prominently ask the consumer whether the
31 consumer consents to having the controller submit the appeal, along
32 with any action taken or not taken by the controller in response to
33 the appeal and must, upon request, provide the controller's written
34 explanation of the reasons in support thereof, to the attorney
35 general. If the consumer provides such consent, the controller must
36 submit such information to the attorney general.
37 NEW SECTION. Sec. 7. PROCESSING DEIDENTIFIED DATA OR
38 PSEUDONYMOUS DATA. (1) This chapter does not require a controller or
p. 14 2SSB 6281
1 processor to do any of the following solely for purposes of complying
2 with this chapter:
3 (a) Reidentify deidentified data;
4 (b) Comply with an authenticated consumer request to access,
5 correct, delete, or port personal data pursuant to section 6 (1)
6 through (4) of this act, if all of the following are true:
7 (i)(A) The controller is not reasonably capable of associating
8 the request with the personal data, or (B) it would be unreasonably
9 burdensome for the controller to associate the request with the
10 personal data;
11 (ii) The controller does not use the personal data to recognize
12 or respond to the specific consumer who is the subject of the
13 personal data, or associate the personal data with other personal
14 data about the same specific consumer; and
15 (iii) The controller does not sell the personal data to any third
16 party or otherwise voluntarily disclose the personal data to any
17 third party other than a processor, except as otherwise permitted in
18 this section; or
19 (c) Maintain data in identifiable form, or collect, obtain,
20 retain, or access any data or technology, in order to be capable of
21 associating an authenticated consumer request with personal data.
22 (2) The rights contained in section 6 (1) through (4) of this act
23 do not apply to pseudonymous data in cases where the controller is
24 able to demonstrate any information necessary to identify the
25 consumer is kept separately and is subject to effective technical and
26 organizational controls that prevent the controller from accessing
27 such information.
28 (3) A controller that uses pseudonymous data or deidentified data
29 must exercise reasonable oversight to monitor compliance with any
30 contractual commitments to which the pseudonymous data or
31 deidentified data are subject, and must take appropriate steps to
32 address any breaches of contractual commitments.
33 NEW SECTION. Sec. 8. RESPONSIBILITIES OF CONTROLLERS. (1)
34 Transparency.
35 (a) Controllers shall provide consumers with a reasonably
36 accessible, clear, and meaningful privacy notice that includes:
37 (i) The categories of personal data processed by the controller;
38 (ii) The purposes for which the categories of personal data are
39 processed;
p. 15 2SSB 6281
1 (iii) How and where consumers may exercise the rights contained
2 in section 6 of this act, including how a consumer may appeal a
3 controller's action with regard to the consumer's request;
4 (iv) The categories of personal data that the controller shares
5 with third parties, if any; and
6 (v) The categories of third parties, if any, with whom the
7 controller shares personal data.
8 (b) If a controller sells personal data to third parties or
9 processes personal data for targeted advertising, it must clearly and
10 conspicuously disclose such processing, as well as the manner in
11 which a consumer may exercise the right to opt out of such
12 processing, in a clear and conspicuous manner.
13 (c) Controllers shall establish, and shall describe in the
14 privacy notice, one or more secure and reliable means for consumers
15 to submit a request to exercise their rights under this chapter. Such
16 means shall take into account the ways in which consumers interact
17 with the controller, the need for secure and reliable communication
18 of such requests, and the controller's ability to authenticate the
19 identity of the consumer making the request. Controllers shall not
20 require a consumer to create a new account in order to exercise a
21 right, but a controller may require a consumer to use an existing
22 account to exercise the consumer's rights under this chapter.
23 (2) Purpose specification. A controller's collection of personal
24 data must be limited to what is reasonably necessary in relation to
25 the purposes for which such data are processed, as disclosed to the
26 consumer.
27 (3) Data minimization. A controller's collection of personal data
28 must be adequate, relevant, and limited to what is reasonably
29 necessary in relation to the purposes for which such data are
30 processed, as disclosed to the consumer.
31 (4) Avoid secondary use. Except as provided in this chapter, a
32 controller may not process personal data for purposes that are not
33 reasonably necessary to, or compatible with, the purposes for which
34 such personal data are processed, as disclosed to the consumer,
35 unless the controller obtains the consumer's consent.
36 (5) Security. A controller shall establish, implement, and
37 maintain reasonable administrative, technical, and physical data
38 security practices to protect the confidentiality, integrity, and
39 accessibility of personal data. Such data security practices shall be
40 appropriate to the volume and nature of the personal data at issue.
p. 16 2SSB 6281
1 (6) Nondiscrimination. A controller may not process personal data
2 in violation of state and federal laws that prohibit unlawful
3 discrimination against consumers. A controller shall not discriminate
4 against a consumer for exercising any of the rights contained in this
5 chapter, including denying goods or services to the consumer,
6 charging different prices or rates for goods or services, and
7 providing a different level of quality of goods and services to the
8 consumer. This subsection shall not prohibit a controller from
9 offering a different price, rate, level, quality, or selection of
10 goods or services to a consumer, including offering goods or services
11 for no fee, if the offering is in connection with a consumer's
12 voluntary participation in a bona fide loyalty, rewards, premium
13 features, discounts, or club card program. A controller may not sell
14 personal data to a third-party controller as part of such a program
15 unless: (a) The sale is reasonably necessary to enable the third
16 party to provide a benefit to which the consumer is entitled; (b) the
17 sale of personal data to third parties is clearly disclosed in the
18 terms of the program; and (c) the third party uses the personal data
19 only for purposes of facilitating such benefit to which the consumer
20 is entitled and does not retain or otherwise use or disclose the
21 personal data for any other purpose. A controller may not enroll a
22 consumer in a facial recognition service in connection with a bona
23 fide loyalty, rewards, premium features, discounts, or club card
24 program.
25 (7) Sensitive data. Except as otherwise provided in this act, a
26 controller may not process sensitive data concerning a consumer
27 without obtaining the consumer's consent, or, in the case of the
28 processing of personal data concerning a known child, without
29 obtaining consent from the child's parent or lawful guardian, in
30 accordance with the children's online privacy protection act
31 requirements.
32 (8) Nonwaiver of consumer rights. Any provision of a contract or
33 agreement of any kind that purports to waive or limit in any way a
34 consumer's rights under this chapter shall be deemed contrary to
35 public policy and shall be void and unenforceable.
36 NEW SECTION. Sec. 9. DATA PROTECTION ASSESSMENTS. (1)
37 Controllers must conduct and document a data protection assessment of
38 each of the following processing activities involving personal data:
p. 17 2SSB 6281
1 (a) The processing of personal data for purposes of targeted
2 advertising;
3 (b) The sale of personal data;
4 (c) The processing of personal data for purposes of profiling,
5 where such profiling presents a reasonably foreseeable risk of: (i)
6 Unfair or deceptive treatment of, or disparate impact on, consumers;
7 (ii) financial, physical, or reputational injury to consumers; (iii)
8 a physical or other intrusion upon the solitude or seclusion, or the
9 private affairs or concerns, of consumers, where such intrusion would
10 be offensive to a reasonable person; or (iv) other substantial injury
11 to consumers;
12 (d) The processing of sensitive data; and
13 (e) Any processing activities involving personal data that
14 present a heightened risk of harm to consumers.
15 Such data protection assessments must take into account the type
16 of personal data to be processed by the controller, including the
17 extent to which the personal data are sensitive data, and the context
18 in which the personal data are to be processed.
19 (2) Data protection assessments conducted under subsection (1) of
20 this section must identify and weigh the benefits that may flow
21 directly and indirectly from the processing to the controller,
22 consumer, other stakeholders, and the public against the potential
23 risks to the rights of the consumer associated with such processing,
24 as mitigated by safeguards that can be employed by the controller to
25 reduce such risks. The use of deidentified data and the reasonable
26 expectations of consumers, as well as the context of the processing
27 and the relationship between the controller and the consumer whose
28 personal data will be processed, must be factored into this
29 assessment by the controller.
30 (3) The attorney general may request, in writing, that a
31 controller disclose any data protection assessment that is relevant
32 to an investigation conducted by the attorney general. The controller
33 must make a data protection assessment available to the attorney
34 general upon such a request. The attorney general may evaluate the
35 data protection assessments for compliance with the responsibilities
36 contained in section 8 of this act and with other laws including, but
37 not limited to, chapter 19.86 RCW. Data protection assessments are
38 confidential and exempt from public inspection and copying under
39 chapter 42.56 RCW. The disclosure of a data protection assessment
40 pursuant to a request from the attorney general under this subsection
p. 18 2SSB 6281
1 does not constitute a waiver of the attorney-client privilege or work
2 product protection with respect to the assessment and any information
3 contained in the assessment.
4 (4) Data protection assessments conducted by a controller for the
5 purpose of compliance with other laws or regulations may qualify
6 under this section if they have a similar scope and effect.
7 NEW SECTION. Sec. 10. LIMITATIONS AND APPLICABILITY. (1) The
8 obligations imposed on controllers or processors under this chapter
9 do not restrict a controller's or processor's ability to:
10 (a) Comply with federal, state, or local laws, rules, or
11 regulations;
12 (b) Comply with a civil, criminal, or regulatory inquiry,
13 investigation, subpoena, or summons by federal, state, local, or
14 other governmental authorities;
15 (c) Cooperate with law enforcement agencies concerning conduct or
16 activity that the controller or processor reasonably and in good
17 faith believes may violate federal, state, or local laws, rules, or
18 regulations;
19 (d) Investigate, establish, exercise, prepare for, or defend
20 legal claims;
21 (e) Provide a product or service specifically requested by a
22 consumer, perform a contract to which the consumer is a party, or
23 take steps at the request of the consumer prior to entering into a
24 contract;
25 (f) Take immediate steps to protect an interest that is essential
26 for the life of the consumer or of another natural person, and where
27 the processing cannot be manifestly based on another legal basis;
28 (g) Prevent, detect, protect against, or respond to security
29 incidents, identity theft, fraud, harassment, malicious or deceptive
30 activities, or any illegal activity; preserve the integrity or
31 security of systems; or investigate, report, or prosecute those
32 responsible for any such action;
33 (h) Engage in public or peer-reviewed scientific, historical, or
34 statistical research in the public interest that adheres to all other
35 applicable ethics and privacy laws if the deletion of the information
36 is likely to render impossible or seriously impair the achievement of
37 the research and the consumer provided consent; or
38 (i) Assist another controller, processor, or third party with any
39 of the obligations under this subsection.
p. 19 2SSB 6281
1 (2) The obligations imposed on controllers or processors under
2 this chapter do not restrict a controller's or processor's ability to
3 collect, use, or retain data to:
4 (a) Conduct internal research solely to improve or repair
5 products, services, or technology;
6 (b) Identify and repair technical errors that impair existing or
7 intended functionality; or
8 (c) Perform solely internal operations that are reasonably
9 aligned with the expectations of the consumer based on the consumer's
10 existing relationship with the controller, or are otherwise
11 compatible with processing in furtherance of the provision of a
12 product or service specifically requested by a consumer or the
13 performance of a contract to which the consumer is a party.
14 (3) The obligations imposed on controllers or processors under
15 this chapter do not apply where compliance by the controller or
16 processor with this chapter would violate an evidentiary privilege
17 under Washington law and do not prevent a controller or processor
18 from providing personal data concerning a consumer to a person
19 covered by an evidentiary privilege under Washington law as part of a
20 privileged communication.
21 (4) A controller or processor that discloses personal data to a
22 third-party controller or processor in compliance with the
23 requirements of this chapter is not in violation of this chapter if
24 the recipient processes such personal data in violation of this
25 chapter, provided that, at the time of disclosing the personal data,
26 the disclosing controller or processor did not have actual knowledge
27 that the recipient intended to commit a violation. A third-party
28 controller or processor receiving personal data from a controller or
29 processor in compliance with the requirements of this chapter is
30 likewise not in violation of this chapter for the obligations of the
31 controller or processor from which it receives such personal data.
32 (5) Obligations imposed on controllers and processors under this
33 chapter shall not:
34 (a) Adversely affect the rights or freedoms of any persons, such
35 as exercising the right of free speech pursuant to the First
36 Amendment to the United States Constitution; or
37 (b) Apply to the processing of personal data by a natural person
38 in the course of a purely personal or household activity.
39 (6) Personal data that are processed by a controller pursuant to
40 this section must not be processed for any purpose other than those
p. 20 2SSB 6281
1 expressly listed in this section. Personal data that are processed by
2 a controller pursuant to this section may be processed solely to the
3 extent that such processing is: (i) Necessary, reasonable, and
4 proportionate to the purposes listed in this section; and (ii)
5 adequate, relevant, and limited to what is necessary in relation to
6 the specific purpose or purposes listed in this section. Furthermore,
7 personal data that are collected, used, or retained pursuant to
8 subsection (2) of this section must, insofar as possible, taking into
9 account the nature and purpose or purposes of such collection, use,
10 or retention, be subjected to reasonable administrative, technical,
11 and physical measures to protect the confidentiality, integrity, and
12 accessibility of the personal data, and to reduce reasonably
13 foreseeable risks of harm to consumers relating to such collection,
14 use, or retention of personal data.
15 (7) If a controller processes personal data pursuant to an
16 exemption in this section, the controller bears the burden of
17 demonstrating that such processing qualifies for the exemption and
18 complies with the requirements in subsection (6) of this section.
19 (8) Processing personal data solely for the purposes expressly
20 identified in subsection (1)(a) through (d) or (g) of this section
21 does not, by itself, make an entity a controller with respect to such
22 processing.
23 NEW SECTION. Sec. 11. LIABILITY. (1) Any violation of this
24 chapter shall not serve as the basis for, or be subject to, a private
25 right of action under this chapter or under any other law. This does
26 not relieve any party from any duties or obligations imposed, or to
27 alter any independent rights that consumers have under other laws,
28 chapter 19.86 RCW, the Washington state Constitution, or the United
29 States Constitution.
30 (2) Where more than one controller or processor, or both a
31 controller and a processor, involved in the same processing, is in
32 violation of this chapter, the liability must be allocated among the
33 parties according to principles of comparative fault.
34 NEW SECTION. Sec. 12. ENFORCEMENT. (1) The attorney general has
35 exclusive authority to enforce this chapter by bringing an action in
36 the name of the state, or as parens patriae on behalf of persons
37 residing in the state.
p. 21 2SSB 6281
1 (2) Any controller or processor that violates this chapter is
2 subject to an injunction and liable for a civil penalty of not more
3 than seven thousand five hundred dollars for each violation.
4 NEW SECTION. Sec. 13. CONSUMER PRIVACY ACCOUNT. The consumer
5 privacy account is created in the state treasury. All receipts from
6 the imposition of civil penalties under this chapter must be
7 deposited into the account except for the recovery of costs and
8 attorneys' fees accrued by the attorney general in enforcing this
9 chapter. Moneys in the account may be spent only after appropriation.
10 Moneys in the account may only be used for the purposes of the office
11 of privacy and data protection as created under RCW 43.105.369, and
12 may not be used to supplant general fund appropriations to the
13 agency.
14 NEW SECTION. Sec. 14. PREEMPTION. This chapter supersedes and
15 preempts laws, ordinances, regulations, or the equivalent adopted by
16 any local entity regarding the processing of personal data by
17 controllers or processors.
18 NEW SECTION. Sec. 15. ATTORNEY GENERAL REPORT. (1) The attorney
19 general shall compile a report evaluating the liability and
20 enforcement provisions of this chapter including, but not limited to,
21 the effectiveness of its efforts to enforce this chapter, and any
22 recommendations for changes to such provisions.
23 (2) The attorney general shall submit the report to the governor
24 and the appropriate committees of the legislature by July 1, 2022.
25 NEW SECTION. Sec. 16. JOINT RESEARCH INITIATIVES. The governor
26 may enter into agreements with the governments of the Canadian
27 province of British Columbia and the states of California and Oregon
28 for the purpose of sharing personal data or personal information by
29 public bodies across national and state borders to enable
30 collaboration for joint data-driven research initiatives. Such
31 agreements must provide reciprocal protections that the respective
32 governments agree appropriately safeguard the data.
33 NEW SECTION. Sec. 17. FACIAL RECOGNITION. (1) Processors that
34 provide facial recognition services must make available an
35 application programming interface or other technical capability,
p. 22 2SSB 6281
1 chosen by the processor, to enable controllers or third parties to
2 conduct legitimate, independent, and reasonable tests of those facial
3 recognition services for accuracy and unfair performance differences
4 across distinct subpopulations: PROVIDED, That making such an
5 application programming interface or other technical capability
6 available does not require the disclosure of proprietary data, trade
7 secrets, intellectual property, or other information, or if doing so
8 would increase the risk of cyberattacks including, without
9 limitation, cyberattacks related to unique methods of conducting
10 business, data unique to the product or services, or determining
11 prices or rates to be charged for services. Such subpopulations are
12 defined by visually detectable characteristics, such as (a) race,
13 skin tone, ethnicity, gender, age, or disability status, or (b) other
14 protected characteristics that are objectively determinable or self-
15 identified by the individuals portrayed in the testing dataset. If
16 the results of that independent testing identify material unfair
17 performance differences across subpopulations and the methodology,
18 data, and results are disclosed in a manner that allow full
19 reproduction of the testing directly to the processor, who, acting
20 reasonably, determines that the methodology and results of that
21 testing are valid, then the processor must develop and implement a
22 plan to mitigate the identified performance differences. Nothing in
23 this subsection prevents a processor from prohibiting the use of the
24 processor's facial recognition service by a competitor for
25 competitive purposes.
26 (2) Processors that provide facial recognition services must
27 provide documentation that includes general information that:
28 (a) Explains the capabilities and limitations of the services in
29 plain language; and
30 (b) Enables testing of the services in accordance with this
31 section.
32 (3) Processors that provide facial recognition services must
33 prohibit, in the contract required by section 5 of this act, the use
34 of facial recognition services by controllers to unlawfully
35 discriminate under federal or state law against individual consumers
36 or groups of consumers.
37 (4) Controllers must provide a conspicuous and contextually
38 appropriate notice whenever a facial recognition service is deployed
39 in a physical premise open to the public that includes, at minimum,
40 the following:
p. 23 2SSB 6281
1 (a) The purpose or purposes for which the facial recognition
2 service is deployed; and
3 (b) Information about where consumers can obtain additional
4 information about the facial recognition service including, but not
5 limited to, a link to any applicable online notice, terms, or policy
6 that provides information about where and how consumers can exercise
7 any rights that they have with respect to the facial recognition
8 service.
9 (5) Controllers must obtain consent from a consumer prior to
10 enrolling an image of that consumer in a facial recognition service
11 used in a physical premise open to the public.
12 (6) As an exception to subsection (5) of this section,
13 controllers may enroll an image of a consumer in a facial recognition
14 service for a security or safety purpose without first obtaining
15 consent from that consumer, provided that all of the following
16 requirements are met:
17 (a) The controller must hold a reasonable suspicion, based on a
18 specific incident, that the consumer has engaged in criminal
19 activity, which includes, but is not limited to, shoplifting, fraud,
20 stalking, or domestic violence;
21 (b) Any database used by a facial recognition service for
22 identification, verification, or persistent tracking of consumers for
23 a security or safety purpose must be used solely for that purpose and
24 maintained separately from any other databases maintained by the
25 controller;
26 (c) The controller must review any such database used by the
27 controller's facial recognition service no less than annually to
28 remove facial templates of consumers whom the controller no longer
29 holds a reasonable suspicion that they have engaged in criminal
30 activity; and
31 (d) The controller must establish an internal process whereby a
32 consumer may correct or challenge the decision to enroll the image of
33 the consumer in a facial recognition service for a security or safety
34 purpose.
35 (7) Controllers using a facial recognition service to make
36 decisions that produce legal effects on consumers or similarly
37 significant effects on consumers must ensure that those decisions are
38 subject to meaningful human review.
39 (8) Prior to deploying a facial recognition service in the
40 context in which it will be used, controllers using a facial
p. 24 2SSB 6281
1 recognition service to make decisions that produce legal effects on
2 consumers or similarly significant effects on consumers must test the
3 facial recognition service in operational conditions. Controllers
4 must take commercially reasonable steps to ensure best quality
5 results by following all reasonable guidance provided by the
6 developer of the facial recognition service.
7 (9) Controllers using a facial recognition service must conduct
8 periodic training of all individuals that operate a facial
9 recognition service or that process personal data obtained from the
10 use of facial recognition services. Such training shall include, but
11 not be limited to, coverage of:
12 (a) The capabilities and limitations of the facial recognition
13 service;
14 (b) Procedures to interpret and act on the output of the facial
15 recognition service; and
16 (c) The meaningful human review requirement for decisions that
17 produce legal effects on consumers or similarly significant effects
18 on consumers, to the extent applicable to the deployment context.
19 (10) Controllers shall not knowingly disclose personal data
20 obtained from a facial recognition service to a law enforcement
21 agency, except when such disclosure is:
22 (a) Pursuant to the consent of the consumer to whom the personal
23 data relates;
24 (b) Required by federal, state, or local law in response to a
25 court order, court-ordered warrant, or subpoena or summons issued by
26 a judicial officer or grand jury;
27 (c) Necessary to prevent or respond to an emergency involving
28 danger of death or serious physical injury to any person, upon a good
29 faith belief by the controller; or
30 (d) To the national center for missing and exploited children, in
31 connection with a report submitted thereto under Title 18 U.S.C. Sec.
32 2258A.
33 (11) Controllers that deploy a facial recognition service must
34 respond to a consumer request to exercise the rights specified in
35 section 6 of this act and must fulfill the responsibilities
36 identified in section 8 of this act.
37 (12) Voluntary facial recognition services used to verify an
38 aviation passenger's identity in connection with services regulated
39 by the secretary of transportation under Title 49 U.S.C. Sec. 41712
40 and exempt from state regulation under Title 49 U.S.C. Sec.
p. 25 2SSB 6281
1 41713(b)(1) are exempt from this section. Images captured by an
2 airline must not be retained for more than twenty-four hours and,
3 upon request of the attorney general, airlines must certify that they
4 do not retain the image for more than twenty-four hours. An airline
5 facial recognition service must disclose and obtain consent from the
6 customer prior to capturing an image.
7 NEW SECTION. Sec. 18. This chapter does not apply to
8 institutions of higher education or nonprofit corporations until July
9 31, 2024.
10 NEW SECTION. Sec. 19. Sections 1 through 18 and 20 of this act
11 constitute a new chapter in Title 19 RCW.
12 NEW SECTION. Sec. 20. This act takes effect July 31, 2021.
--- END ---
p. 26 2SSB 6281
File and source
- File
- 2020-02-26_a26766_bill_6281-s2.pdf
- Size
- 188,170 bytes
- SHA-256
- b3edfa43f1bdceacda98816ae3a98af954eb4b35cb874828c77e78b6b57cfd58
- Original
- No public link identified.