Privacy Comparison: 2SSB 6281 and SHB 2742 — Definitions and Relevant Bill Provisions
Summary
A privacy comparison of 2SSB 6281 and SHB 2742, prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee and dated February 21, 2020. It sets out the provisions of the two bills in side-by-side columns, with a column of relevant bill provisions. The definitions section gives the definition of child as a person under thirteen years of age in one column and under eighteen years of age in the other. A joint research initiatives entry says the governor may enter into agreements with the governments of the Canadian province of British Columbia and the states of California and Oregon for sharing personal data.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Privacy Comparison: 2SSB 6281 and SHB 2742 — Definitions and Relevant Bill Provisions.”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2020-02-26-a26766-d217984-privacy-comparison-2ssb-6281-and-shb-2742-02-92630c8a3f/
, SHA-256 ad716672130b44ea0dcc3eb9c8b1ef45763f17eceee5230ec1a3c8155136c59d.Full text
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Definitions 2SSB 6281 SHB 2742 Relevant bill provisions
Section 3
"Child" means any natural person under "Child" means any natural person under Sec. 3(34)
"Child" thirteen years of age. eighteen years of age. Personal data from a known child is
included in the definition of "sensitive
data"
Sec. 6
In the case of processing personal data
of a known child, the parent or legal
guardian of the known child shall
exercise the consumer personal data
rights on the child's behalf.
Sec. 8(7)
Controllers may not process sensitive
data without consumer consent or
parental consent (in accordance with
COPPA), in the case of processing
personal data of a child.
"Consumer" means a natural person who "Consumer" means a natural person who
"Consumer" is a Washington resident acting only in an is a Washington resident acting only in an Used throughout the bill
individual or household context. It does not individual or household context. It does not
include a natural person acting in a include a natural person acting in an
commercial or employment context. employment context.
"Deidentified data" means data that cannot "Deidentified data" means data that cannot "Personal data" does not include
"Deidentified reasonably be used to infer information be used to infer information about, or deidentified data.
data" about, or otherwise be linked to, an otherwise be linked to, an identified or
identified or identifiable natural person, or identifiable natural person, or a device Sec. 7(1)
a device linked to such person, provided linked to such person, provided that the Controllers or processors are not
that the controller that possesses the data: controller that possesses the data: required to reidentify deidentified data
(a) Takes reasonable measures to ensure (a) Takes measures to ensure that the solely to comply with this act.
that the data cannot be associated with a data cannot be associated with a natural
natural person; person, device, or household; Sec. 7(3)
(b) publicly commits to maintain and use (b) publicly commits to maintain and use Controllers using deidentified data must
the data only in a deidentified fashion and the data only in a deidentified fashion and exercise reasonable oversight to
not attempt to reidentify the data; and not attempt to reidentify the data; and monitor compliance with any contractual
commitments to which deidentified data
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 1 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
(c) contractually obligates any recipients of (c) contractually obligates any recipients of are subject and must take appropriate
the information to comply with all the information to comply with all steps to address any breaches of
"Deidentified provisions of this subsection. provisions of this subsection. contractual commitments.
data"
(cont'd) Sec. 9(2)
The use of deidentified data must be
factored into a data protection
assessment by a controller when
identifying and weighing the benefits
from the processing to the controller,
consumer, other stakeholders, and the
public against the potential risks to
consumer rights.
"Personal data" means any information "Personal data" means any information
"Personal data" that is linked or reasonably linkable to an that is linked or reasonably linkable to an Used throughout the bill
identified or identifiable natural person. identified or identifiable natural person.
"Personal data" does not include "Personal data" does not include
deidentified data or publicly available deidentified data or publicly available
information. information.
"Publicly available information" means "Publicly available information" means
information that is lawfully made available information that is lawfully made available
from federal, state, or local government from federal, state, or local government
records. records and not combined with personal
data obtained from sources other than
federal, state, or local government records.
"Pseudonymous data" means personal "Pseudonymous data" means personal Sec. 7(2)
"Pseudonymous data that cannot be attributed to a specific data that cannot be attributed to a specific Except for the right to opt out, consumer
data" natural person without the use of natural person without the use of personal data rights do not apply to
additional information, provided that such additional information, provided that such pseudonymous data where the
additional information is kept separately additional information is not readily controller is able to demonstrate any
and is subject to appropriate technical and available and is subject to appropriate information necessary to identify the
organizational measures to ensure that the technical and organizational measures to consumer is kept separately and is
personal data are not attributed to an ensure that the personal data cannot subject to effective technical and
identified or identifiable natural person. reasonably be attributed to an identified or organizational controls that prevent the
identifiable natural person. controller from accessing such
information.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 2 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
"Sale," "sell," or "sold" means the "Sale," "sell," or "sold" means selling, Sec. 4(1)(b)
"Sale" exchange of personal data for monetary or renting, releasing, disclosing, A legal entity is subject to the
other valuable consideration by the disseminating, making available, obligations in this act if it derives over
controller to a third party. transferring, or otherwise communicating 50% of gross revenue from the sale of
personal data, orally, in writing, or by personal data and processes or controls
electronic means, for monetary or other personal data of at least 25,000
valuable consideration, or otherwise for a consumers.
commercial purpose by a controller to a
third party. Sec. 4(2)
"Sale" is used in several exemptions.
"Sale" does not include the following: "Sale" does not include the following:
Sec. 6(5)
(i) The disclosure of personal data to a (i) The processing of personal data by a A consumer has the right to opt out of
processor who processes the personal processor who processes the personal the sale of personal data.
data on behalf of the controller; data on behalf of the controller pursuant to
a contract; Sec. 8(1)
Controllers must clearly disclose
(ii) the disclosure of personal data to a (ii) the disclosure of personal data to a whether they sell personal data to third
third party with whom the consumer has a third party with whom the consumer has a parties.
direct relationship for purposes of direct relationship for purposes of
providing a product or service requested providing a product or service requested Sec. 8(6)
by the consumer; by the consumer; A controller may not sell personal data
obtained through a loyalty program,
(iii) the disclosure or transfer of personal (iii) the disclosure or transfer of personal unless specified conditions are met.
data to an affiliate of the controller; data to an affiliate of the controller;
Sec. 9(1)
(iv) the disclosure of information that the (iv) the disclosure of information that the Controllers must conduct and document
consumer (A) intentionally made available consumer (A) intentionally made available a data protection assessment for each
to the general public via a channel of mass to the general public via a channel of mass processing activity related to the sale of
media, and (B) did not restrict to a specific media, and (B) did not restrict to a specific personal data.
audience; or audience; or
(v) the disclosure or transfer of personal (v) the disclosure or transfer of personal
data to a third party as an asset that is part data to a third party as an asset that is part
of a merger, acquisition, bankruptcy, or of a merger, acquisition, bankruptcy, or
other transaction in which the third party other transaction in which the third party
assumes control of all or part of the assumes control of all or part of the
controller's assets. controller's assets.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 3 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Jurisdictional
Scope 2SSB 6281 SBH 2742
Section 4
Legal entities that conduct business in Washington or produce Legal entities that conduct business in Washington or produce
To whom products or services that are targeted to residents of products or services that are targeted to residents of
obligations apply Washington, and that satisfy one or more of the following Washington.
thresholds:
(a) During a calendar year, controls or processes personal
data of 100,000 consumers or more; or
(b) Derives over 50% of gross revenue from the sale of
personal data and processes or controls personal data of
25,000 consumers or more.
Exempt entities (a) State agencies, local governments, or tribes; (a) State and local governments;
(b) Municipal corporations; (b) Municipal corporations;
(c) Legal entities that:
(i) Have fewer than 10 employees;
(ii) Have gross annual revenues of less than $5 million;
(iii) Derive less than 5% of annual gross revenues from the
sale or monetization of personal data at fair market
value;
(iv) Control or process personal data of fewer than 20,000
consumers; AND
(v) Do not disclose or share personal data of consumers
other than:
(A) As necessary for providing products or services
requested by consumers; or
(B) For purposes of selling or monetizing personal data
within the limits set in (c)(iii) of this subsection.
Personal data subject to enumerated federal and state laws, Personal data subject to enumerated federal and state laws,
Exempt such as HIPAA, FCRA, GLBA, and the Farm Credit Act. such as HIPAA, FCRA, GLBA, and the Farm Credit Act.
information
Certain information is exempt only to the extent that its Certain information is exempt only to the extent that its
collection or processing is in compliance with the federal or collection or processing is in substantial compliance with the
state law to which the information is subject. federal or state law to which the information is subject.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 4 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Data maintained for employment record purposes is exempt. Data maintained for employment record purposes is exempt
Exempt until July 31, 2022.
information
(cont'd) Institutions of higher education and nonprofit corporations are
exempt until July 31, 2024.
Other Controllers that are in compliance with the verifiable parental n/a
jurisdictional consent mechanisms under the Children's Online Privacy
provisions Protection Act (COPPA) shall be deemed compliant with any
obligation to obtain parental consent under this chapter
Responsibility
according to role 2SSB 6281 SHB 2742
Section 5
Controllers and processors are responsible for meeting their respective obligations. Whether an entity is a processor or a
Responsibility controller with respect to specific processing of personal data is a fact-based determination.
according to role
Processing by a processor is governed by a contract between the controller and the processor that sets out the processing
instructions and other specified requirements. Processors are responsible for adhering to the instructions of the controller
and assisting the controller in meeting its obligations.
Processors must also implement and maintain reasonable security procedures to protect personal data, ensure
confidentiality of the processing, and engage subcontractors only after certain requirements are met.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 5 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Consumer rights 2SSB 6281 SHB 2742
Section 6
Consumer rights In the case of processing personal data concerning a Where a controller processes personal data concerning a known
generally known child, the parent or legal guardian of the known child, the controller must allow the parent or legal guardian of the
child shall exercise the rights of this chapter on the known child to exercise the rights of this chapter on the child's
child's behalf. behalf.
Where a controller processes personal data concerning a consumer
subject to guardianship, conservatorship, or other protective
arrangement under chapter 11.130 RCW, the controller must allow
the guardian or the conservator to exercise the rights of this chapter
on the consumer's behalf.
Consumer rights The rights of access, correction, deletion, and data portability do not apply to pseudonymous data in cases where the controller
and pseudonymous is able to demonstrate any information necessary to identify the consumer is kept separately and is subject to effective
data technical, contractual, and organizational controls that prevent the controller from accessing such information.
A consumer has the right to confirm whether or not a controller is processing personal data concerning the consumer and
Right of access access such personal data.
A consumer has the right to correct inaccurate personal A consumer has the right to correct inaccurate personal data
Right to correction data concerning the consumer, taking into account the concerning the consumer.
nature of the personal data and the purposes of the
processing of the personal data.
Right to deletion A consumer has the right to delete personal data concerning the consumer.
A consumer has the right to obtain personal data concerning the consumer, which the consumer previously provided to the
Right to data controller, in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the
portability data to another controller without hindrance, where the processing is carried out by automated means.
A consumer has the right to opt out of the processing of A consumer has the right to opt out of the processing of personal
Right to opt out personal data concerning such consumer for purposes of data concerning such consumer.
targeted advertising, the sale of personal data, or
profiling in furtherance of decisions that produce legal
effects concerning a consumer or similarly significant
effects concerning a consumer.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 6 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Responding to A controller must inform a consumer of any action taken A controller must inform a consumer of any action taken on a
consumer requests on a request without undue delay and in any event within request without undue delay and in any event within 21 days of
45 days of receipt of the request. receipt of the request.
That period may be extended once by 45 additional days That period may be extended once by 45 additional days where
where reasonably necessary, taking into account the necessary, taking into account the complexity and number of the
complexity and number of the requests. requests.
The controller must inform the consumer of any such The controller must inform the consumer of any such extension
extension within 45 days of receipt of the request, within 21 days of receipt of the request, together with the reasons
together with the reasons for the delay. for the delay.
If a controller does not take action on the request of a If a controller does not take action on the request of a consumer,
consumer, the controller must inform the consumer the controller must inform the consumer without undue delay and at
without undue delay and at the latest within 45 days of the latest within 21 days of receipt of the request of the reasons for
receipt of the request of the reasons for not taking action not taking action and instructions for how to appeal the decision with
and instructions for how to appeal the decision with the the controller.
controller.
Authenticating a A controller is not required to comply with a request to A controller is not required to comply with a request to exercise any
consumer request exercise any of the rights [other than the right to opt out] of the rights [other than the right to opt out] if the controller is unable
if the controller is unable to authenticate the request to authenticate the request.
using commercially reasonable efforts.
In such cases, the controller may request the provision of In such cases, the controller may request the provision of additional
additional information reasonably necessary to information necessary to authenticate the request.
authenticate the request.
Charging a fee to Information provided under this section must be provided by the controller free of charge, up to twice annually to the consumer.
fulfill a consumer
request Where requests from a consumer are manifestly unfounded or excessive, in particular because of their repetitive character, the
controller may either:
(i) Charge a reasonable fee to cover the administrative costs of complying with the request, or
(ii) Refuse to act on the request.
The controller bears the burden of demonstrating the manifestly unfounded or excessive character of the request.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 7 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Notifying third n/a A controller must take reasonable steps to communicate a
parties of consumer's request to correct, delete, or opt out of the processing of
consumer requests personal data to each third party to whom the controller disclosed,
including through sale, the personal data within one year preceding
the consumer's request, unless this proves functionally impractical,
technically infeasible, or involves disproportionate effort.
Controllers must establish an internal process whereby Controllers must establish an internal process whereby consumers
Internal appeal consumers may appeal a refusal to take action on a may appeal a refusal to take action on a request to exercise any of
process request to exercise any of the rights within a reasonable the rights within 45 days of the consumer's receipt of the notice sent
period of time after the consumer's receipt of the notice by the controller.
sent by the controller.
The appeal process must be conspicuously available and as easy to use as the process for consumer rights requests.
Within 30 days of receipt of an appeal, a controller must inform the consumer of any action taken or not taken in response to the
appeal, along with a written explanation of the reasons in support thereof.
That period may be extended by 60 additional days where necessary, taking into account the complexity and number of the
requests serving as the basis for the appeal. The controller must inform the consumer of any such extension within 30 days of
receipt of the appeal, together with the reasons for the delay.
The controller must also provide the consumer with an email address or other online mechanism through which the consumer
may submit the appeal, along with any action taken or not taken by the controller in response to the appeal and the controller's
written explanation of the reasons in support thereof, to the Attorney General.
When informing a consumer of any action taken or not taken in response to an appeal, the controller must clearly and
prominently ask the consumer whether the consumer consents to having the controller submit the appeal, along with any action
taken or not taken by the controller in response to the appeal and must, upon request, provide the controller's written
explanation of the reasons in support thereof, to the Attorney General. If the consumer provides such consent, the controller
must submit such information to the Attorney General.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 8 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Responsibilities of
Controllers and 2SSB 6281 SHB 2742
Processors
Sections 7 - 9
Controllers shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes:
Transparency
(i) The categories of personal data processed by the controller;
(ii) The purposes for which the categories of personal data are processed;
(iii) How and where consumers may exercise the rights, including how a consumer may appeal a controller's action with
regard to the consumer's request;
(iv) The categories of personal data that the controller shares with third parties, if any; and
(v) The categories of third parties, if any, with whom the controller shares personal data.
If a controller sells personal data to third parties or processes personal data for targeted advertising, it must clearly and
conspicuously disclose such processing, as well as the manner in which a consumer may exercise the right to opt out of
such processing, in a clear and conspicuous manner.
Controllers shall establish, and shall describe in the privacy notice, one or more secure and reliable means for consumers to
submit a request to exercise their rights under this chapter. Such means shall take into account the ways in which
consumers interact with the controller, the need for secure and reliable communication of such requests, and the controller's
ability to authenticate the identity of the consumer making the request.
Controllers shall not require a consumer to create a new account in order to exercise a right, but a controller may require a
consumer to use an existing account to exercise the consumer's rights under this chapter.
Purpose specification A controller's collection of personal data must be limited to what is reasonably necessary in relation to the purposes for
which such data are processed, as disclosed to the consumer.
Data minimization A controller's collection of personal data must be adequate, A controller's collection of personal data must be only as
relevant, and limited to what is reasonably necessary in reasonably necessary to provide services requested by a
relation to the purposes for which such data are processed, as consumer, to conduct an activity that a consumer has
disclosed to the consumer. requested, or to verify [consumer rights] requests.
Except as provided in this chapter, a controller may not process personal data for purposes that are not reasonably
Avoid secondary use necessary to, or compatible with, the purposes for which such personal data are processed, as disclosed to the consumer,
unless the controller obtains the consumer's consent.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 9 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Security A controller shall establish, implement, and maintain reasonable administrative, technical, and physical data security
practices to protect the confidentiality, integrity, and accessibility of personal data. Such data security practices shall be
appropriate to the volume and nature of the personal data at issue.
Nondiscrimination A controller may not process personal data in violation of state and federal laws that prohibit unlawful discrimination against
and responsibilities consumers. A controller shall not discriminate against a consumer for exercising any of the rights contained in this chapter,
related to loyalty including denying goods or services to the consumer, charging different prices or rates for goods or services, and providing
programs a different level of quality of goods and services to the consumer.
This subsection shall not prohibit a controller from offering a different price, rate, level, quality, or selection of goods or
services to a consumer, including offering goods or services for no fee, if the offering is in connection with a consumer's
voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.
A controller may not sell personal data to a third-party controller as part of such a program unless: (a) The sale is reasonably
necessary to enable the third party to provide a benefit to which the consumer is entitled; (b) the sale of personal data to
third parties is clearly disclosed in the terms of the program; and (c) the third party uses the personal data only for purposes
of facilitating such benefit to which the consumer is entitled and does not retain or otherwise use or disclose the personal
data for any other purpose.
A controller may not enroll a consumer in a facial recognition n/a
service in connection with a bona fide loyalty, rewards,
premium features, discounts, or club card program.
Processing sensitive Except as otherwise provided in this act, a controller may not Except as otherwise provided in this act, a controller may
data process sensitive data concerning a consumer without not process sensitive data concerning a consumer without
obtaining the consumer's consent, or, in the case of the obtaining the consumer's consent. Except as otherwise
processing of personal data concerning a known child, without provided in this act, a controller may not process sensitive
obtaining consent from the child's parent or lawful guardian, in data of a known child without obtaining consent from the
accordance with the COPPA requirements. child's parent or lawful guardian.
Nonwaiver of Any provision of a contract or agreement of any kind that purports to waive or limit in any way a consumer's rights under this
consumer rights chapter shall be deemed contrary to public policy and shall be void and unenforceable.
Using deidentified or A controller that uses pseudonymous data or deidentified data must exercise reasonable oversight to monitor compliance
pseudonymous data with any contractual commitments to which the pseudonymous data or deidentified data are subject, and must take
appropriate steps to address any breaches of contractual commitments.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 10 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Controllers must conduct and document a data protection assessment of each of the following processing
Conducting data activities involving personal data:
protection
assessments (a) The processing of personal data for purposes of targeted advertising;
(b) The sale of personal data;
(c) The processing of personal data for purposes of profiling, where such profiling presents a reasonably foreseeable risk of:
(i) Unfair or deceptive treatment of, or disparate impact on, consumers;
(ii) Financial, physical, or reputational injury to consumers;
(iii) Physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where
such intrusion would be offensive to a reasonable person; or
(iv) Other substantial injury to consumers;
(d) The processing of sensitive data; and
(e) Any processing activities involving personal data that present a heightened risk of harm to consumers.
Such data protection assessments must take into account the type of personal data to be processed by the controller,
including the extent to which the personal data are sensitive data, and the context in which the personal data are to be
processed.
Data protection assessments must identify and weigh the benefits that may flow directly and indirectly from the processing to
the controller, consumer, other stakeholders, and the public against the potential risks to the rights of the consumer
associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks.
The use of deidentified data and the reasonable expectations of consumers, as well as the context of the processing and the
relationship between the controller and the consumer whose personal data will be processed, must be factored into this
assessment by the controller.
The Attorney General may evaluate the data protection assessments for compliance with the responsibilities [of the
controllers and processors] and with other laws including, but not limited to, chapter 19.86 RCW.
Data protection assessments are confidential and exempt from public inspection and copying under chapter 42.56 RCW.
Data protection assessments conducted by a controller for the purpose of compliance with other laws or regulations may
qualify under this section if they have a similar scope and effect
The Attorney General may request, in writing, that a controller The Attorney General may request, in writing, that a
disclose any data protection assessment that is relevant to an controller disclose any data protection assessment that is
investigation conducted by the Attorney General. relevant to an investigation of the controller conducted by
the Attorney General.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 11 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Limitations to the
responsibilities of 2SSB 6281 SHB 2742
controllers and
processors
This chapter does not require a controller or processor to do any of the following solely for purposes of complying
with this chapter:
Limitations to the (a) Reidentify deidentified data;
responsibilities of
controllers and (b) Comply with an authenticated consumer request to (b) Comply with an authenticated consumer request to
processors access, correct, delete, or port personal data, if all of the access, correct, delete, or port personal data, if all of the
Sec. 7 following are true: following are true:
(i) (A) The controller is not reasonably capable of (i) (A) The controller is not capable of associating the
associating the request with the personal data, or request with the personal data, or
(B) it would be unreasonably burdensome for the (B) it would be unusually burdensome for the
controller to associate the request with the personal controller to associate the request with the personal
data; data;
(ii) The controller does not use the personal data to (ii) The controller does not use the personal data to
recognize or respond to the specific consumer who recognize or respond to the specific consumer who is
is the subject of the personal data, or associate the the subject of the personal data, or associate the
personal data with other personal data about the personal data with other personal data about the
same specific consumer; and same specific consumer; and
(iii) The controller does not sell the personal data to any (iii) The controller does not sell the personal data to any
third party or otherwise voluntarily disclose the third party or otherwise voluntarily disclose the
personal data to any third party other than a personal data to any third party other than a
processor, except as otherwise permitted in this processor, except as otherwise permitted in this
section; or section; or
(c) Maintain data in identifiable form, or collect, obtain, retain, or access any data or technology, in order to be capable of
associating an authenticated consumer request with personal data.
Limitations to the The obligations imposed on controllers or processors do not restrict a controller's or processor's ability to:
responsibilities of (a) Comply with federal, state, or local laws, rules, or regulations;
controllers and (b) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other
processors governmental authorities;
Sec. 10 (c) Cooperate with law enforcement agencies concerning conduct or activity that the controller or processor reasonably and
in good faith believes may violate federal, state, or local laws, rules, or regulations;
(d) Investigate, establish, exercise, prepare for, or defend legal claims;
(e) Provide a product or service specifically requested by a consumer, perform a contract to which the consumer is a party,
or take steps at the request of the consumer prior to entering into a contract;
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 12 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
The obligations imposed on controllers or processors do not restrict a controller's or processor's ability to:
(f) Take immediate steps to protect an interest that is (f) Protect the vital interests of the consumer or of another
Limitations to the essential for the life of the consumer or of another natural natural person;
responsibilities of person, and where the processing cannot be manifestly
controllers and based on another legal basis;
processors
Sec. 10 (g) Prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive
(cont'd) activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report, or prosecute those
responsible for any such action;
(h) Engage in public or peer-reviewed scientific, historical, or (h) Process personal data to conduct ongoing scientific,
statistical research in the public interest that adheres to all historical, or statistical research in the public interest that
other applicable ethics and privacy laws if the deletion of the adheres to all other applicable ethics and privacy laws and is
information is likely to render impossible or seriously impair approved, monitored, and governed by an institutional review
the achievement of the research and the consumer provided board or a similar independent oversight entity that
consent; or determines that:
(i) The research is likely to provide substantial benefits
that do not exclusively accrue to the controller;
(ii) The expected benefits of the research outweigh the
privacy risks; and
(iii) The controller has implemented reasonable
safeguards to mitigate privacy risks associated with
research, including any risks associated with
reidentification; or
(i) Assist another controller, processor, or third party with any of the obligations under this subsection.
The obligations imposed on controllers or processors under this chapter do not restrict a controller's or
processor's ability to collect, use, or retain data to:
(a) Conduct internal research solely to improve or repair (a) Conduct internal research to improve, repair, or develop
products, services, or technology; products, services, or technology;
(b) Identify and repair technical errors that impair existing or intended functionality; or
(c) Perform solely internal operations that are reasonably (c) Perform internal operations that are aligned with the
aligned with the expectations of the consumer based on the expectations of the consumer based on the consumer's
consumer's existing relationship with the controller, or are existing relationship with the controller, or are otherwise
otherwise compatible with processing in furtherance of the compatible with processing in furtherance of the provision of
provision of a product or service specifically requested by a a product or service specifically requested by a consumer or
consumer or the performance of a contract to which the the performance of a contract to which the consumer is a
consumer is a party. party.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 13 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Requirements for Personal data that are processed by a controller pursuant to this section must not be processed for any purpose other than
processing pursuant those expressly listed in this section.
to an exemption
in Sec. 10
Personal data that are processed by a controller pursuant to Personal data that are processed by a controller pursuant to
this section may be processed solely to the extent that such this section may be processed solely to the extent that such
processing is: processing is:
(i) Necessary, reasonable, and proportionate to the (i) Necessary and proportionate to the purposes listed in
purposes listed in this section; and this section; and
(ii) Adequate, relevant, and limited to what is necessary (ii) Adequate, relevant, and limited to what is necessary
in relation to the specific purpose or purposes listed in relation to the specific purpose or purposes listed
in this section. in this section.
Furthermore, personal data that are collected, used, or Furthermore, personal data that are collected, used, or
retained pursuant to this section must, insofar as possible, retained pursuant to this section must be subjected to
taking into account the nature and purpose or purposes of administrative, technical, and physical measures to protect
such collection, use, or retention, be subjected to the confidentiality, integrity, and accessibility of the personal
reasonable administrative, technical, and physical measures data, and to reduce foreseeable risks of harm to consumers
to protect the confidentiality, integrity, and accessibility of relating to such collection, use, or retention of personal data.
the personal data, and to reduce reasonably foreseeable
risks of harm to consumers relating to such collection, use,
or retention of personal data.
If a controller processes personal data pursuant to an exemption in this section, the controller bears the burden of
demonstrating that such processing qualifies for the exemption and complies with the requirements in subsection (6) of this
section.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 14 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Commercial use of 2SSB 6281 SHB 2742
facial recognition Section 17 Section 16
services
Testing for accuracy Processors that provide facial recognition services must make Prior to deploying a facial recognition service, processors that
and unfair available an application programming interface or other provide facial recognition services must make available an
performance technical capability, chosen by the processor, to enable application programming interface or other technical
differences controllers or third parties to conduct legitimate, independent, capability, chosen by the processor, to enable controllers or
and reasonable tests of those facial recognition services for third parties to conduct legitimate, independent, and
accuracy and unfair performance differences across distinct reasonable tests of those facial recognition services for
subpopulations: accuracy and unfair performance differences across distinct
subpopulations.
PROVIDED, That making such an application programming
interface or other technical capability available does not
require the disclosure of proprietary data, trade secrets,
intellectual property, or other information, or if doing so would
increase the risk of cyberattacks including, without limitation,
cyberattacks related to unique methods of conducting
business, data unique to the product or services, or
determining prices or rates to be charged for services.
Such subpopulations are defined by visually detectable Such subpopulations are defined by visually detectable
characteristics, such as (a) race, skin tone, ethnicity, gender, characteristics, such as (a) race, skin tone, ethnicity, gender,
age, or disability status, or (b) other protected characteristics age, or disability status, or (b) other protected characteristics
that are objectively determinable or self-identified by the that are objectively determinable or self-identified by the
individuals portrayed in the testing dataset. individuals portrayed in the testing dataset.
If the results of that independent testing identify material If the results of that independent testing identify material
unfair performance differences across subpopulations and the unfair performance differences across subpopulations and the
methodology, data, and results are disclosed in a manner that methodology, data, and results are disclosed in a manner that
allow full reproduction of the testing directly to the processor, allow full reproduction of the testing directly to the processor,
who, acting reasonably, determines that the methodology and who determines that the methodology and results of that
results of that testing are valid, then the processor must testing are valid, then the processor must develop and
develop and implement a plan to mitigate the identified implement a plan to mitigate the identified performance
performance differences. differences.
Nothing in this subsection prevents a processor from Nothing in this subsection prevents a processor from
prohibiting the use of the processor's facial recognition service prohibiting the use of the processor's facial recognition service
by a competitor for competitive purposes. by a competitor for competitive purposes.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 15 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Providing Processors that provide facial recognition services must provide documentation that includes general information that:
documentation (a) Explains the capabilities and limitations of the services in plain language; and
about FR (b) Enables testing of the services in accordance with this section.
Prohibiting the use Processors that provide facial recognition services must prohibit the use of facial recognition services by controllers to
of FR to unlawfully unlawfully discriminate under federal or state law against individual consumers or groups of consumers.
discriminate
Controllers must provide a conspicuous and contextually Controllers must provide a conspicuous and contextually
Providing notice of appropriate notice whenever a facial recognition service is appropriate notice whenever a facial recognition service is
the use of FR deployed in a physical premise open to the public that deployed including, at minimum, the following:
includes, at minimum, the following:
(a) The purpose or purposes for which the facial recognition (a) The purpose or purposes for which the facial recognition
service is deployed; and service is deployed;
(b) Notification that controllers must obtain a consumer's
consent prior to enrolling an image of that consumer in a
facial recognition service and that consent is not required in
order to obtain entry to a physical place open to the public, or
to be provided with goods or services without discrimination or
penalty for not consenting; and
(b) Information about where consumers can obtain additional (c) Information about where consumers can obtain additional
information about the facial recognition service including, but information about the facial recognition service including, but
not limited to, a link to any applicable online notice, terms, or not limited to, a link to any applicable online notice, terms, or
policy that provides information about where and how policy that provides information about where and how
consumers can exercise any rights that they have with consumers can exercise any rights that they have with
respect to the facial recognition service. respect to the facial recognition service.
Controllers must obtain consent from a consumer prior to Controllers must obtain consent from a consumer prior to
Obtaining consumer enrolling an image of that consumer in a facial recognition enrolling an image of that consumer in a facial recognition
consent prior to service used in a physical premise open to the public. service.
enrolling an image
Controllers may not deny goods or services, deny entry to a
physical place open to the public, or otherwise discriminate
against or penalize a consumer who does not consent to
enrollment of the consumer's image in a facial recognition
service.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 16 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Controllers may enroll an image of a consumer in a facial recognition service for a security or safety purpose without
Enrolling an image first obtaining consent from that consumer, provided that all the following requirements are met:
without consent
(a) The controller must hold a reasonable suspicion, based on a specific incident, that the consumer has engaged in
criminal activity, which includes, but is not limited to, shoplifting, fraud, stalking, or domestic violence;
(b) Any database used by a facial recognition service for identification, verification, or persistent tracking of consumers for
a security or safety purpose must be used solely for that purpose and maintained separately from any other databases
maintained by the controller;
(c) The controller must review any such database used by the controller's facial recognition service no less than annually
to remove facial templates of consumers whom the controller no longer holds a reasonable suspicion that they have
engaged in criminal activity; and
(d) The controller must establish an internal process whereby a consumer may correct or challenge the decision to enroll
the image of the consumer in a facial recognition service for a security or safety purpose.
Controllers that use a facial recognition service for verification
Notice of image n/a purposes must provide the consumer with notice as to which
used for verification image of the consumer the facial recognition service is
referencing when attempting to verify the consumer's identity.
Controllers using a facial recognition service to make Controllers using a facial recognition service for the purpose
Meaningful human decisions that produce legal effects on consumers or similarly of verification, identification, or to make decisions that
review significant effects on consumers must ensure that those produce legal effects on consumers or similarly significant
decisions are subject to meaningful human review. effects on consumers must ensure that those decisions are
subject to meaningful human review.
Prior to deploying a facial recognition service in the context in which it will be used, controllers using a facial recognition service
Testing in to make decisions that produce legal effects on consumers or similarly significant effects on consumers must test the facial
operational recognition service in operational conditions.
conditions
Controllers must take commercially reasonable steps to Controllers must take steps to ensure best quality results by
Ensuring best ensure best quality results by following all reasonable following all guidance provided by the developer of the facial
quality results guidance provided by the developer of the facial recognition recognition service.
service.
Controllers using a facial recognition service must conduct Controllers using a facial recognition service must conduct
Training periodic training of all individuals that operate a facial annual training of all individuals that operate a facial
recognition service or that process personal data obtained recognition service or that process personal data obtained
from the use of facial recognition services. from the use of facial recognition services.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 17 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Training Such training shall include, but not be limited to, coverage of: Such training shall include, but not be limited to, coverage of:
(cont'd) (a) The capabilities and limitations of the facial recognition (a) The capabilities and limitations of the facial recognition
service; service;
(b) Procedures to interpret and act on the output of the facial (b) Procedures to interpret and act on the output of the facial
recognition service; and recognition service; and
(c) The meaningful human review requirement for decisions (c) The meaningful human review requirement for verification,
that produce legal effects on consumers or similarly significant identification, or decisions that produce legal effects on
effects on consumers, to the extent applicable to the consumers or similarly significant effects on consumers, to the
deployment context. extent applicable to the deployment context.
Controllers shall not knowingly disclose personal data Controllers shall not disclose personal data obtained from a
obtained from a facial recognition service to a law facial recognition service to a law enforcement agency, except
Disclosing personal enforcement agency, except when such disclosure is: when such disclosure is:
data obtained from
FR (a) Pursuant to the consent of the consumer to whom the personal data relates;
(b) Required by federal, state, or local law in response to a court order, court-ordered warrant, or subpoena or summons
issued by a judicial officer or grand jury;
(c) Necessary to prevent or respond to an emergency involving danger of death or serious physical injury to any person, upon
a good faith belief by the controller; or
(d) To the national center for missing and exploited children.
No information obtained from or by the use of a facial
Facial recognition n/a recognition service may be received in evidence in any trial,
data as evidence hearing, or other proceeding in or before any court, grand
jury, department, officer, agency, regulatory body, legislative
committee, or other authority subject to the jurisdiction of the
state of Washington.
Complying with Controllers that deploy a facial recognition service must respond to a consumer request to exercise the rights and fulfill the
other [controller] responsibilities.
responsibilities
Voluntary facial recognition services used to verify an aviation passenger's identity are exempt.
Exemption for
verification of Images captured by an airline must not be retained for more than 24 hours and, upon request of the Attorney General, airlines
aviation passengers must certify that they do not retain the image for more than twenty-four hours. An airline facial recognition service must
disclose and obtain consent from the customer prior to capturing an image.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 18 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Preemption 2SSB 6281 SHB 2742
Preemption of This chapter supersedes and preempts laws, ordinances, This chapter supersedes and preempts laws, ordinances,
local regulations regulations, or the equivalent adopted by any local entity regulations, or the equivalent adopted by any local entity
regarding the processing of personal data by controllers or regarding the processing of personal data by controllers or
processors. processors.
This chapter does not supersede or preempt laws, ordinances,
regulations, or the equivalent adopted by any local entity
regarding facial recognition.
Liability and 2SSB 6281 SHB 2742
Enforcement
Any violation of this chapter shall not serve as the basis for, or be
Liability subject to, a private right of action under this chapter or under any n/a
other law. This does not relieve any party from any duties or
obligations imposed, or to alter any independent rights that
consumers have under other laws, chapter 19.86 RCW, the
Washington state Constitution, or the United States Constitution.
Where more than one controller or processor, or both a controller
and a processor, involved in the same processing, is in violation
of this chapter, the liability must be allocated among the parties
according to principles of comparative fault.
The legislature finds that the practices covered by this chapter
Enforcement The Attorney General has exclusive authority to enforce this are matters vitally affecting the public interest for the purpose of
and penalties chapter by bringing an action in the name of the state, or as applying the consumer protection act, chapter 19.86 RCW. A
parens patriae on behalf of persons residing in the state. violation of this chapter is not reasonable in relation to the
development and preservation of business and is an unfair or
deceptive act in trade or commerce and an unfair method of
competition for the purpose of applying the consumer
protection act, chapter 19.86 RCW.
Any controller or processor that violates this chapter is subject to Any controller or processor that violates this chapter is subject
an injunction and liable for a civil penalty of not more than $7,500 to an injunction and liable for a civil penalty of not more than
for each violation. $50,000 for each violation or $100,000 for each intentional
violation.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 19 February 21, 2020
PRIVACY COMPARISON: 2SSB 6281 and SHB 2742
Reports and
Research 2SSB 6281 SHB 2742
Initiatives
Attorney General The Attorney General shall compile a report evaluating the liability and enforcement provisions of this chapter including, but not
report limited to, the effectiveness of its efforts to enforce this chapter, and any recommendations for changes to such provisions.
The Attorney General shall submit the report to the governor and the appropriate committees of the legislature by July 1, 2022.
Joint research The governor may enter into agreements with the governments of the Canadian province of British Columbia and the states of
initiatives California and Oregon for the purpose of sharing personal data or personal information by public bodies across national and state
borders to enable collaboration for joint data-driven research initiatives. Such agreements must provide reciprocal protections
that the respective governments agree appropriately safeguard the data.
Prepared by Yelena Baker (OPR nonpartisan staff) for the ITED Committee 20 February 21, 2020
File and source
- File
- 2020-02-26_a26766_d217984_privacy-comparison-2ssb-6281-and-shb-2742-02-21-20.pdf
- Size
- 133,802 bytes
- SHA-256
- ad716672130b44ea0dcc3eb9c8b1ef45763f17eceee5230ec1a3c8155136c59d
- Original
- No public link identified.