House Bill 1671, Personal Data Privacy, State of Washington (2025 Regular Session)
Summary
House Bill 1671, State of Washington, 69th Legislature, 2025 Regular Session, by Representatives Kloba, Fosse, Doglio, Parshley, Berry, Ramel, Scott, Taylor, and Simmons, read first time 01/28/25 and referred to Committee on Technology, Economic Development, & Veterans. The act relates to personal data privacy, adding a new section to chapter 19.373 RCW and a new chapter to Title 19 RCW, and providing an effective date. Section 1 sets out definitions, including affirmative consent, biometric data, child, and consumer health data. Later sections include other enforcement precluded and waiver of rights, and a closing section says Section 12 takes effect August 1, 2026.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“House Bill 1671, Personal Data Privacy, State of Washington (2025 Regular Session).”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2025-02-04-a32657-bill-1671-13b5e59326/
, SHA-256 54dbaa853c1b94977e976cfedf23d2cf7a7403d1e32bed1e8970696199eb04dc.Full text
H-0779.1
HOUSE BILL 1671
State of Washington 69th Legislature 2025 Regular Session
By Representatives Kloba, Fosse, Doglio, Parshley, Berry, Ramel,
Scott, Taylor, and Simmons
Read first time 01/28/25. Referred to Committee on Technology,
Economic Development, & Veterans.
1 AN ACT Relating to personal data privacy; adding a new section to
2 chapter 19.373 RCW; adding a new chapter to Title 19 RCW; and
3 providing an effective date.
4 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:
5 NEW SECTION. Sec. 1. DEFINITIONS. The definitions in this
6 section apply throughout this chapter unless the context clearly
7 requires otherwise.
8 (1) "Affiliate" has the same meaning as defined in RCW
9 19.373.010.
10 (2)(a) "Affirmative consent" or "consent" means a clear
11 affirmative act signifying a consumer's freely given, specific,
12 informed, revokable, and unambiguous authorization for an act or
13 practice after having been informed, in response to a specific
14 request from a controller, provided that:
15 (i) The request is provided to the consumer in a clear and
16 conspicuous stand-alone disclosure;
17 (ii) The request includes a description of the processing purpose
18 for which the consumer's consent is sought and (A) clearly
19 distinguishes between an act or practice that is necessary to fulfill
20 a request of the consumer and an act or practice that is for another
21 purpose, (B) clearly states the specific categories of personal data
p. 1 HB 1671
1 that the controller intends to collect, process, or transfer under
2 each act or practice, and (C) is written in easy to understand
3 language and includes a prominent heading that would enable a
4 reasonable consumer to identify and understand each act or practice;
5 (iii) The request clearly explains the consumer's rights related
6 to consent;
7 (iv) The request is made in a manner reasonably accessible to and
8 usable by consumers with disabilities;
9 (v) The request is made available to the consumer in each
10 language in which the controller provides a product or service for
11 which authorization is sought;
12 (vi) The option to refuse to give consent is at least as
13 prominent and takes the same number of steps or fewer as the option
14 to give consent; and
15 (vii) Affirmative consent to an act or practice is not inferred
16 from the inaction of the consumer or the consumer's continued use of
17 a service or product provided by the controller.
18 (b) "Affirmative consent" does not include:
19 (i) Acceptance of a general or broad terms of use or similar
20 document that contains descriptions of personal data processing along
21 with other, unrelated information;
22 (ii) Hovering over, muting, pausing, or closing a given piece of
23 content;
24 (iii) Agreement obtained through the use of a false, fraudulent,
25 or materially misleading statement or representation; or
26 (iv) Agreement obtained through the use of dark patterns.
27 (3) "Authenticate" means to use reasonable means to determine
28 that a request to exercise any of the rights afforded in this chapter
29 is being made by, or on behalf of, the consumer who is entitled to
30 exercise such rights with respect to the personal data at issue.
31 (4) "Biometric data" has the same meaning as defined in RCW
32 19.373.010.
33 (5) "Child" means a consumer under the age of 13 years old.
34 (6) "Collect" means buying, renting, gathering, obtaining,
35 receiving, accessing, or otherwise acquiring personal data by any
36 means.
37 (7) "Consumer" means a natural person: (a)(i) Who is a Washington
38 resident or (ii) whose personal data is collected in Washington
39 state, and (b) who acts only in an individual or household context,
p. 2 HB 1671
1 however identified, including by any unique identifier. "Consumer"
2 does not include an individual acting in an employment context.
3 (8)(a) "Consumer health data" means personal data that is linked
4 or reasonably linkable to a consumer and that identifies the
5 consumer's past, present, or future physical or mental health status.
6 (b) For the purposes of this definition, physical or mental
7 health status includes, but is not limited to:
8 (i) Individual health conditions, treatment, diseases, or
9 diagnosis;
10 (ii) Social, psychological, behavioral, and medical
11 interventions;
12 (iii) Health-related surgeries or procedures;
13 (iv) Use or purchase of prescribed medication;
14 (v) Bodily functions, vital signs, symptoms, or measurements of
15 such information;
16 (vi) Diagnoses or diagnostic testing, treatment, or medication;
17 (vii) Gender-affirming care information;
18 (viii) Reproductive or sexual health information;
19 (ix) Biometric data;
20 (x) Genetic data;
21 (xi) Precise geolocation information that could reasonably
22 indicate a consumer's attempt to acquire or receive health services
23 or supplies;
24 (xii) Data that identifies a consumer seeking health care
25 services; or
26 (xiii) Any information that a controller or processor processes
27 to associate or identify a consumer with the data described in (b)(i)
28 through (xii) of this subsection that is derived or extrapolated from
29 nonhealth information (such as proxy, derivative, inferred, or
30 emergent data by any means, including algorithms or machine
31 learning).
32 (c) "Consumer health data" does not include personal data that is
33 used to engage in public or peer-reviewed scientific, historical, or
34 statistical research in the public interest that adheres to all other
35 applicable ethics and privacy laws and is approved, monitored, and
36 governed by an institutional review board, human subjects research
37 ethics review board, or a similar independent oversight entity that
38 determines that the controller or processor has implemented
39 reasonable safeguards to mitigate privacy risks associated with
40 research, including any risks associated with reidentification.
p. 3 HB 1671
1 (9)(a) "Contextual advertising" means displaying or presenting an
2 advertisement that does not vary based on the identity of the
3 individual recipient and is based solely on the immediate content of
4 a web page or online service within which the advertisement appears,
5 or on a specific request of the consumer for information or feedback,
6 if displayed in proximity to the results of such request for
7 information.
8 (b) A controller may use the following types of personal data to
9 display a contextual advertisement, provided that the personal data
10 is not used to make inferences about the consumer, profile the
11 consumer, or for any other purpose, and that the consumer may use
12 technical means to obfuscate or change the consumer's physical
13 location and specify a language preference:
14 (i) Technical specifications that are necessary for the ad to be
15 delivered and displayed properly on a given device;
16 (ii) A consumer's immediate presence in a geographic area with a
17 radius no smaller than 10 miles, or an area reasonably estimated to
18 include online activity from at least 5,000 users, but not including
19 precise geolocation data; or
20 (iii) The consumer's language preferences, as inferred from
21 context, browser settings, or user settings.
22 (10) "Controller" means the natural or legal person who, alone or
23 jointly with others, determines the purposes and means of collecting
24 or processing of personal data.
25 (11) "Dark pattern" means a user interface designed or
26 manipulated with the substantial effect of subverting or impairing
27 user autonomy, decision making or choice and includes, but is not
28 limited to, any practice the federal trade commission refers to as a
29 "dark pattern."
30 (12) "Decisions that produce legal or similarly significant
31 effects concerning the consumer" means decisions that result in
32 access to, or the provision or denial by the controller of financial
33 and lending services, housing, insurance, education enrollment,
34 criminal justice, employment opportunities, health care services, or
35 access to essential goods or services.
36 (13) "Deidentified data" means data that does not identify and
37 cannot reasonably be used to infer information about, or otherwise be
38 linked to, an identified or identifiable individual, or a device
39 linked to such individual, if the controller that possesses the data:
p. 4 HB 1671
1 (a) Takes reasonable physical, administrative, and technical
2 measures to ensure that the data cannot be associated with an
3 individual, or be used to reidentify an individual or device that
4 identifies or is linked or reasonably linkable to an individual;
5 (b) Publicly commits to process the data only in a deidentified
6 fashion and not attempt to reidentify the data; and
7 (c) Contractually obligates any recipients of the data to comply
8 with (a) and (b) of this subsection.
9 (14) "First party" means a consumer-facing controller with which
10 the consumer intends or expects to interact.
11 (15)(a) "First-party advertising" means processing by a first
12 party of its own first-party data for the purposes of advertising and
13 marketing and is carried out:
14 (i) Through direct communications with a consumer, such as direct
15 mail, email, or text message communications;
16 (ii) In a physical location operated by the first party; or
17 (iii) Through display or presentation of an advertisement on the
18 first party's own website, application, or its other online content.
19 (b) "First-party advertising" includes marketing measurement
20 related to such advertising and marketing.
21 (16) "First-party data" means personal data collected directly
22 from a consumer by a first party, including based on a visit by the
23 consumer to or use by the consumer of a website, a physical location,
24 or an online service operated by the first party.
25 (17) "Gender-affirming care information" means personal data
26 relating to seeking or obtaining past, present, or future gender-
27 affirming care services. "Gender-affirming care information"
28 includes, but is not limited to:
29 (a) Precise geolocation information that could reasonably
30 indicate a consumer's attempt to acquire or receive gender-affirming
31 care services;
32 (b) Efforts to research or obtain gender-affirming care services;
33 or
34 (c) Any gender-affirming care information that is derived,
35 extrapolated, or inferred, including from nonhealth information, such
36 as proxy, derivative, inferred, emergent, or algorithmic data.
37 (18) "Gender-affirming care services" has the same meaning as in
38 RCW 19.373.010.
39 (19) "Identified or identifiable individual" means an individual
40 who can be readily identified, directly or indirectly.
p. 5 HB 1671
1 (20) "Marketing measurement" means measuring and reporting on
2 marketing performance or media performance by the controller,
3 including processing personal data for measurement and reporting of
4 frequency, attribution, and performance.
5 (21) "Minor" means any consumer who is younger than 18 years of
6 age.
7 (22) "Person" means an individual, association, company, limited
8 liability company, corporation, partnership, sole proprietorship,
9 trust, or any other legal entity.
10 (23) "Personal data" means any information that identifies or is
11 reasonably capable of being associated or linked, directly or
12 indirectly, with a particular consumer. "Personal data" includes, but
13 is not limited to, derived data and data associated with a persistent
14 unique identifier, such as a cookie ID, an IP address, a device
15 identifier, or any other form of persistent unique identifier.
16 "Personal data" does not include publicly available information or
17 deidentified data.
18 (24)(a) "Precise geolocation data" means information derived from
19 technology including, but not limited to, latitude and longitude
20 coordinates from global positioning system mechanisms or other
21 similar positional data, that reveals the past or present physical
22 location of an individual or device that identifies or is linked or
23 reasonably linkable to one or more individuals with precision and
24 accuracy within a radius of 1,750 feet.
25 (b) "Precise geolocation information" does not include the
26 content of communications, a photograph or video, metadata associated
27 with a photograph or video that cannot be linked to an individual, or
28 any data generated by or connected to advanced utility metering
29 infrastructure systems or equipment for use by a utility.
30 (25) "Process" or "processing" means any operation or set of
31 operations performed, whether by manual or automated means, on
32 personal data or on sets of personal data, such as the use, storage,
33 disclosure, analysis, deletion, or modification of personal data.
34 (26) "Processor" means a person that collects, processes, or
35 transfers personal data on behalf of, and at the direction of, a
36 controller or another processor, or a federal, state, tribal, or
37 local government entity.
38 (27) "Profiling" means any form of processing performed on
39 personal data to evaluate, analyze, or predict personal aspects,
40 including an individual's economic situation, health, personal
p. 6 HB 1671
1 preferences, interests, reliability, behavior, location, or
2 movements.
3 (28)(a) "Publicly available information" means information that
4 has been lawfully made available to the general public from:
5 (i) Federal, state, or municipal government records, if the
6 person collects, processes, and transfers such information in
7 accordance with any restrictions or terms of use placed on the
8 information by the relevant government entity;
9 (ii) Widely distributed media; or
10 (iii) A disclosure to the general public as required by federal,
11 state, or local law.
12 (b) "Publicly available information" does not include:
13 (i) Any obscene visual depiction, as defined in 18 U.S.C. Sec.
14 1460;
15 (ii) Any inference made exclusively from multiple independent
16 sources of publicly available information that reveals sensitive data
17 with respect to a consumer;
18 (iii) Biometric data;
19 (iv) Personal data that is created through the combination of
20 personal data with publicly available information;
21 (v) Genetic data, unless otherwise made publicly available by the
22 individual to whom the information pertains;
23 (vi) Information made available by a consumer on a website or
24 online service made available to all members of the public, for free
25 or for a fee, where the consumer has restricted the information to a
26 specific audience; or
27 (vii) Intimate images and fabricated intimate images disclosed
28 without consent of the depicted individual. For the purposes of this
29 subsection, "intimate image," "fabricated intimate image," and
30 "depicted individual" have the same meaning as defined in RCW
31 7.110.010.
32 (29) "Reproductive or sexual health information" means personal
33 data relating to seeking or obtaining past, present, or future
34 reproductive or sexual health services. "Reproductive or sexual
35 health information" includes, but is not limited to:
36 (a) Precise geolocation information that could reasonably
37 indicate a consumer's attempt to acquire or receive reproductive or
38 sexual health services;
39 (b) Efforts to research or obtain reproductive or sexual health
40 services; or
p. 7 HB 1671
1 (c) Any reproductive or sexual health information that is
2 derived, extrapolated, or inferred, including from nonhealth
3 information, such as proxy, derivative, inferred, emergent, or
4 algorithmic data.
5 (30) "Reproductive or sexual health services" has the same
6 meaning as defined in RCW 19.373.010.
7 (31)(a) "Sale of personal data" means the exchange of personal
8 data for monetary or other valuable consideration by the controller
9 to a third party.
10 (b) "Sale of personal data" does not include:
11 (i) The disclosure of personal data to a processor that processes
12 the personal data on behalf of the controller;
13 (ii) The disclosure of personal data to a third party for
14 purposes of providing a product or service requested by the consumer;
15 (iii) The disclosure or transfer of personal data to an affiliate
16 of the controller;
17 (iv) With the consumer's affirmative consent, the disclosure of
18 personal data where the consumer affirmatively directs the controller
19 to disclose the personal data or intentionally uses the controller to
20 interact with a third party; or
21 (v) The disclosure of personal data that the consumer
22 intentionally made available to the general public via a channel of
23 mass media and did not restrict to a specific audience.
24 (32) "Sensitive data" means personal data that includes:
25 (a) Data revealing racial or ethnic origin, religious beliefs,
26 mental or physical health condition or diagnosis, status as pregnant,
27 sex life, sexual orientation, status as transgender or nonbinary,
28 union membership, income level or indebtedness, or citizenship or
29 immigration status;
30 (b) Consumer health data;
31 (c) Genetic or biometric data;
32 (d) Personal data of a consumer that a controller knows, or
33 willfully disregards, is a minor;
34 (e) Precise geolocation data;
35 (f) A government-issued identifier, including a social security
36 number, passport number, or driver's license number, that is not
37 required by law to be displayed in public; or
38 (g) The online activities of a consumer or device linked or
39 reasonably linkable to a consumer over time and across websites,
p. 8 HB 1671
1 online applications, or mobile applications that do not share common
2 branding, or data generated by profiling performed on such data.
3 (33)(a) "Targeted advertising" means presenting an online
4 advertisement to a consumer, to a device identified by a unique
5 persistent identifier, or to a group of consumers or devices
6 identified by unique persistent identifiers, if the advertisement is
7 selected based, in whole or in part, on known or predicted
8 preferences, characteristics, behavior, or interests associated with
9 the consumer or a device identified by a unique persistent
10 identifier.
11 (b) "Targeted advertising" includes displaying or presenting an
12 online advertisement for a product or service based on the previous
13 interaction of a consumer or a device identified by a unique
14 persistent identifier with such product or service on a website or
15 online service that does not share common branding with the website
16 or online service displaying or presenting the advertisement, and
17 marketing measurement related to such advertisements.
18 (c) "Targeted advertising" does not include first-party
19 advertising or contextual advertising.
20 (34) "Third party" means a person that collects personal data
21 from another person that is not the consumer to whom the data
22 pertains and is not a processor with respect to such data. "Third
23 party" does not include a person that collects personal data from
24 another entity if the two entities are affiliates.
25 (35) "Transfer" means to disclose, release, disseminate, make
26 available, license, rent, or share personal data to a third party
27 orally, in writing, electronically, or by any other means.
28 (36)(a) "Unique persistent identifier" means a technologically
29 created identifier to the extent that such identifier is reasonably
30 linkable to a consumer or a device that identifies or is linked or
31 reasonably linkable to one or more consumers.
32 (b) "Unique persistent identifier" includes device identifiers,
33 internet protocol addresses, cookies, beacons, pixel tags, mobile ad
34 identifiers or similar technology customer numbers, unique
35 pseudonyms, user aliases, telephone numbers, or other forms of
36 persistent or probabilistic identifiers that are linked or reasonably
37 linkable to one or more consumers or devices.
38 (c) "Unique persistent identifier" does not include an identifier
39 assigned by a controller for the sole purpose of giving effect to the
40 exercise of affirmative consent or opt out by a consumer with respect
p. 9 HB 1671
1 to the collecting, processing, and transfer of personal data, or with
2 respect to otherwise limiting the collecting, processing, or transfer
3 of personal data.
4 NEW SECTION. Sec. 2. APPLICABILITY AND SCOPE. (1) This chapter
5 applies to persons that conduct business in Washington state or
6 produce products or services that are targeted to residents of
7 Washington state, and that collect or process the personal data of
8 consumers.
9 (2) This chapter does not apply to any federal, state, tribal,
10 territorial, or local government entity, such as a body, authority,
11 board, bureau, commission, district, or agency, of this state or of
12 any political subdivision of this state.
13 (3) This chapter does not apply to the following information and
14 data:
15 (a) Protected health information that a covered entity or
16 business associate collects or processes in accordance with, or
17 documents that a covered entity or business associate creates for the
18 purpose of complying with, the federal health insurance portability
19 and accountability act of 1996 and its implementing regulations;
20 (b) Health care information collected, used, or disclosed in
21 accordance with chapter 70.02 RCW;
22 (c) Patient identifying information as defined by 42 C.F.R. Part
23 2, established pursuant to 42 U.S.C. Sec. 290dd-2;
24 (d) Identifiable private information for purposes of: The federal
25 policy for the protection of human subjects under 45 C.F.R. Part 46,
26 identifiable private information that is otherwise information
27 collected as part of human subjects research pursuant to the good
28 clinical practice guidelines issued by the international council for
29 harmonization of technical requirements for pharmaceuticals for human
30 use, the protection of human subjects under 21 C.F.R. Parts 6, 50,
31 and 56, personal data used or shared in research as defined in 45
32 C.F.R. 164.501 that is conducted in accordance with one or more of
33 the requirements set forth in this subsection, or other research
34 conducted in accordance with applicable law;
35 (e) Information and documents created specifically for, and
36 collected and maintained by:
37 (i) A quality improvement committee for purposes of RCW
38 43.70.510, 70.230.080, or 70.41.200;
39 (ii) A peer review committee for purposes of RCW 4.24.250;
p. 10 HB 1671
1 (iii) A quality assurance committee for purposes of RCW 74.42.640
2 or 18.20.390;
3 (iv) A hospital, as defined in RCW 43.70.056, for reporting of
4 health care-associated infections for purposes of RCW 43.70.056, a
5 notification of an incident for purposes of RCW 70.56.040(5), or
6 reports regarding adverse events for purposes of RCW 70.56.020(2)(b);
7 or
8 (v) A manufacturer, as defined in 21 C.F.R. Sec. 820.3(o), when
9 collected, used, or disclosed for purposes specified in chapter 70.02
10 RCW;
11 (f) Information and documents created for purposes of the federal
12 health care quality improvement act of 1986, and related regulations;
13 (g) Patient safety work product for purposes of the federal
14 patient safety and quality improvement act, 42 U.S.C. Sec. 299b-21 et
15 seq.;
16 (h) Information that is deidentified in accordance with the
17 requirements for deidentification set forth in 45 C.F.R. Part 164 and
18 derived from any of the health care-related information identified in
19 this subsection;
20 (i) Information originating from, and intermingled so as to be
21 indistinguishable with, information described in (a) through (h) of
22 this subsection that is maintained by:
23 (i) A covered entity or business associate as defined by the
24 health insurance portability and accountability act of 1996 and
25 related regulations;
26 (ii) A health care facility or health care provider as defined in
27 RCW 70.02.010; or
28 (iii) A program or a qualified service organization as defined by
29 42 C.F.R. Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2;
30 (j) Information used only for public health activities and
31 purposes as described in 45 C.F.R. Sec. 164.512 or that is part of a
32 limited data set, as defined, and is used, disclosed, and maintained
33 in the manner required, by 45 C.F.R. Sec. 164.514;
34 (k) Identifiable data collected, used, or disclosed in accordance
35 with chapter 43.371 RCW or RCW 69.43.165;
36 (l) Personal information that is governed by and collected,
37 processed, sold, or disclosed pursuant to the following regulations,
38 parts, titles, or acts:
39 (i) The Gramm-Leach-Bliley act, 15 U.S.C. Sec. 6801 et seq., and
40 implementing regulations;
p. 11 HB 1671
1 (ii) Part C of Title XI of the social security act, 42 U.S.C.
2 1320d et seq.;
3 (iii) The fair credit reporting act, 15 U.S.C. 1681 et seq.;
4 (iv) The family educational rights and privacy act, 20 U.S.C.
5 1232g; 34 C.F.R. Part 99;
6 (v) The Washington health benefit exchange and applicable
7 statutes and regulations, including 45 C.F.R. Sec. 155.260 and
8 chapter 43.71 RCW;
9 (vi) Privacy rules adopted by the office of the insurance
10 commissioner pursuant to chapter 48.02 or 48.43 RCW;
11 (vii) The federal driver's privacy protection act of 1994, 18
12 U.S.C. Sec. 2721 et seq.;
13 (viii) The federal family educational rights and privacy act, 20
14 U.S.C. Sec. 1232g et seq.; or
15 (ix) The federal farm credit act of 1971, 12 U.S.C. Sec. 2001 et
16 seq.;
17 (m) Personal data collected, processed, sold, or disclosed in
18 relation to price, route, or service, as such terms are used in the
19 airline deregulation act, 49 U.S.C. 40101 et seq., by an air carrier
20 subject to the act, to the extent this chapter is preempted by the
21 airline deregulation act, 49 U.S.C. 41713; or
22 (n) Data processed or maintained:
23 (i) In the course of an individual applying to, employed by, or
24 acting as an agent or independent contractor of a controller,
25 processor, or third party, to the extent that the data is collected
26 and used within the context of that role;
27 (ii) As the emergency contact information of the individual under
28 this chapter used for emergency contact purposes; or
29 (iii) That is necessary to retain to administer benefits for
30 another individual relating to the individual who is the subject of
31 the information under (n)(i) of this subsection and used for the
32 purposes of administering such benefits.
33 (4) Controllers that are in compliance with the verifiable
34 parental consent requirements under the children's online privacy
35 protection act, 15 U.S.C. Sec. 6501 through 6506 and its implementing
36 regulations, are deemed compliant with any obligation to obtain
37 parental consent under this chapter.
38 NEW SECTION. Sec. 3. CONSUMER RIGHTS. (1) A consumer has the
39 right to:
p. 12 HB 1671
1 (a) Confirm whether a controller is collecting or processing
2 personal data concerning the consumer, access such personal data, and
3 confirm whether or not the consumer's personal data is used to
4 profile the consumer for the purpose of automated decision making;
5 (b) Obtain from a controller a list of specific third parties,
6 other than natural persons, to which the controller has transferred
7 either the consumer's personal data or any personal data;
8 (c) Correct inaccuracies in the consumer's personal data, taking
9 into account the nature of the personal data and the purposes of the
10 processing of the consumer's personal data;
11 (d) Delete personal data concerning the consumer, including
12 personal data the consumer provided to the controller, personal data
13 the controller obtained from another source, and derived data;
14 (e) Obtain a copy of the consumer's personal data collected or
15 processed by the controller, in a portable and, to the extent
16 technically feasible, readily usable format that allows the consumer
17 to transmit the data to another controller without hindrance, where
18 the processing is carried out by automated means; and
19 (f) Opt out of the processing of the personal data for purposes
20 of:
21 (i) Targeted advertising;
22 (ii) The sale of personal data; or
23 (iii) Profiling in furtherance of solely automated decisions that
24 produce legal or similarly significant effects concerning the
25 consumer.
26 (2)(a) If a consumer's personal data is profiled in furtherance
27 of decisions that produce legal effects concerning a consumer or
28 similarly significant effects concerning a consumer, the consumer has
29 the right to question the result of such profiling, to be informed of
30 the reason why the profiling resulted in the decision, and, if
31 feasible, to be informed of what actions the consumer might have
32 taken to secure a different decision and the actions that the
33 consumer might take to secure a different decision in the future.
34 (b) The consumer has the right to review the consumer's personal
35 data used in the profiling.
36 (c) If the decision is determined to have been based upon
37 inaccurate personal data, the consumer has the right to have the data
38 corrected and the profiling decision reevaluated based upon the
39 corrected data.
p. 13 HB 1671
1 NEW SECTION. Sec. 4. EXERCISING CONSUMER RIGHTS. (1) A consumer
2 may exercise rights under this chapter by a secure and reliable means
3 established by the controller and described to the consumer in the
4 controller's privacy notice.
5 (2)(a) A consumer may designate another person to serve as the
6 consumer's authorized agent, and act on the consumer's behalf, to
7 exercise rights specified in section 3 of this act.
8 (b) A controller must comply with a consumer's request received
9 from an authorized agent if the controller is able to verify, with
10 commercially reasonable effort, the identity of the consumer and the
11 authorized agent's authority to act on the consumer's behalf.
12 (3) In the case of personal data of a known child, the parent or
13 legal guardian of the known child may exercise the rights of this
14 chapter on the child's behalf.
15 (4) In the case of personal data concerning a consumer subject to
16 guardianship, conservatorship, or other protective arrangement, the
17 guardian or the conservator of the consumer may exercise the rights
18 of this chapter on the consumer's behalf.
19 NEW SECTION. Sec. 5. RESPONDING TO CONSUMER REQUESTS. Except as
20 otherwise provided in this chapter, a controller shall comply with a
21 request by a consumer to exercise the consumer rights authorized in
22 this chapter in accordance with this section.
23 (1) A controller shall respond to the consumer without undue
24 delay, but not later than 45 days after receipt of the request. The
25 response period may be extended once by 45 additional days when
26 reasonably necessary, taking into account the complexity and number
27 of the consumer's requests, so long as the controller informs the
28 consumer of any such extension within the initial 45-day response
29 period, together with the reason for the extension.
30 (2) If a controller declines to take action regarding the
31 consumer's request, the controller shall inform the consumer without
32 undue delay, but not later than 45 days after receipt of the request,
33 of the justification for declining to take action and instructions
34 for how to appeal the decision.
35 (3) Information provided in response to a consumer request must
36 be provided by the controller, free of charge, twice per consumer
37 during any 12-month period. If requests from a consumer are
38 manifestly unfounded, excessive, or repetitive, the controller may
39 charge the consumer a reasonable fee to cover the administrative
p. 14 HB 1671
1 costs of complying with the request or decline to act on the request.
2 The controller bears the burden of demonstrating the manifestly
3 unfounded, excessive, or repetitive nature of the request.
4 (4)(a) If a controller is unable to authenticate the request
5 using commercially reasonable efforts, the controller is not required
6 to comply with a request to exercise any of the rights under section
7 3 of this act and may request that the consumer provide additional
8 information reasonably necessary to authenticate the consumer and the
9 consumer's request.
10 (b) A controller may not require authentication of an opt-out
11 request, but a controller may deny an opt-out request if the
12 controller has a good-faith, reasonable, and documented belief that
13 such request is fraudulent. If a controller denies an opt-out request
14 because the controller believes the request is fraudulent, the
15 controller shall send notice to the person who made the request,
16 stating that the controller believes the request to be fraudulent,
17 why the controller believes the request to be fraudulent, and that
18 the controller will not comply with the request.
19 (5) A controller that has obtained personal data about a consumer
20 from a source other than the consumer is deemed in compliance with a
21 consumer's request to delete such data pursuant to section 3(1)(d) of
22 this act by deleting the consumer's personal data retained by the
23 controller and retaining a record of the deletion request and the
24 minimum data necessary for the purpose of ensuring the consumer's
25 personal data remains deleted from the controller's records and not
26 using such retained data for any other purpose pursuant to this
27 chapter.
28 (6) A controller shall establish a process for a consumer to
29 appeal the controller's refusal to take action on a request within a
30 reasonable period of time after the consumer's receipt of the
31 decision. The appeal process must be conspicuously available and
32 similar to the process for submitting consumer rights requests.
33 Within 45 days of receipt of an appeal, a controller shall inform the
34 consumer in writing of any action taken or not taken in response to
35 the appeal, including a written explanation of the reasons for the
36 decisions. If the appeal is denied, the controller shall also provide
37 the consumer with an online mechanism, if available, or other method
38 through which the consumer may contact the attorney general to submit
39 a complaint.
p. 15 HB 1671
1 (7) A controller may not condition, effectively condition,
2 attempt to condition, or attempt to effectively condition the
3 exercise of a consumer right described in section 3 of this act
4 through the use of dark patterns or any false, fictitious,
5 fraudulent, or materially misleading statement or representation.
6 (8) A controller may not require a consumer to create a new
7 account in order to exercise consumer rights, but may require a
8 consumer to use an existing account.
9 (9) A controller shall establish, and describe in the
10 controller's privacy notice, one or more secure and reliable means
11 for consumers to submit a request to exercise their consumer rights
12 pursuant to this chapter. Such means must take into account the ways
13 in which consumers normally interact with the controller, the need
14 for secure and reliable communication of such requests, and the
15 ability of the controller to verify the identity of the consumer
16 making the request. Such means must include:
17 (a) Providing a clear and conspicuous link on the controller's
18 internet website to an internet web page that enables a consumer, or
19 an agent of the consumer, to opt out of the targeted advertising, the
20 sale of the consumer's personal data, and profiling in furtherance of
21 solely automated decisions that produce legal or similarly
22 significant effects concerning the consumer; and
23 (b) Not later than December 31, 2025, allowing a consumer to opt
24 out of any collection or processing of the consumer's personal data
25 for the purposes of targeted advertising, or any sale of the
26 consumer's personal data, through an opt-out preference signal that
27 is sent, with the consumer's consent, by a platform, technology, or
28 mechanism to the controller and that indicates the consumer's intent
29 to opt out of any processing or sale. The platform, technology, or
30 mechanism must:
31 (i) Be consumer friendly and easy to use by the average consumer;
32 and
33 (ii) Enable the controller to reasonably determine that the
34 consumer is a Washington resident or a resident of a different state
35 whose data is collected in Washington state, and whether the consumer
36 has made a legitimate request to opt out of any sale of such
37 consumer's personal data or targeted advertising. For purposes of
38 this subsection, the use of an internet protocol address to estimate
39 the consumer's location shall be considered sufficient to reasonably
40 determine residency.
p. 16 HB 1671
1 (10) If a consumer's decision to opt out of any processing of the
2 consumer's personal data for the purposes of targeted advertising, or
3 any sale of the consumer's personal data, through an opt-out
4 preference signal sent in accordance with subsection (9) of this
5 section conflicts with the consumer's existing controller specific
6 privacy setting or voluntary participation in a controller's
7 financial incentive program, the controller shall comply with the
8 consumer's opt-out preference signal, but may notify the consumer of
9 the conflict and provide to the consumer the choice to confirm the
10 controller specific privacy setting or participation in the program.
11 (11) If a controller responds to the consumer opt-out requests
12 received pursuant to subsection (9) of this section by informing the
13 consumer of a change in the price, rate, level, quality, or selection
14 of goods or services, the controller shall present the terms of any
15 financial incentive offered pursuant to section 6(7) of this act for
16 the retention, use, sale, or sharing of the consumer's personal data.
17 NEW SECTION. Sec. 6. RESPONSIBILITIES OF CONTROLLERS. (1)(a)
18 Except as specified in (b) of this subsection, a controller shall
19 limit the collection, processing, and transfer of personal data to
20 what is strictly necessary in relation to provide or maintain:
21 (i) A specific product or service requested by the consumer to
22 whom the data pertains, including any routine administrative,
23 operational, or account-servicing activity, such as billing,
24 shipping, delivery, storage, or accounting; or
25 (ii) A communication, that is not an advertisement, by the
26 controller to the consumer reasonably anticipated within the context
27 of the relationship between the controller and the consumer.
28 (b) A controller may only collect and transfer consumer health
29 data in accordance with RCW 19.373.030.
30 (c) Except with respect to sensitive data, a controller may
31 process or transfer personal data collected under this subsection to
32 provide first-party advertising or targeted advertising. However,
33 this subsection does not permit the processing or transfer of
34 personal data for targeted advertising to a consumer who has opted
35 out of such advertising pursuant to this chapter or to a consumer
36 under circumstances where the controller has knowledge, or willfully
37 disregards, that the consumer is a minor.
38 (2) Except as specified in RCW 19.373.030, a controller may not
39 transfer sensitive data concerning a consumer without obtaining the
p. 17 HB 1671
1 consumer's affirmative consent, or, in the case of the collection or
2 processing of sensitive data of a known child, without collecting or
3 processing such data in accordance with the children's online privacy
4 protection act, 15 U.S.C. Sec. 6501 through 6506 and its implementing
5 regulations.
6 (3) A controller may not sell sensitive data, with the exception
7 of consumer health data, which may be sold in accordance with RCW
8 19.373.070.
9 (4) A controller shall establish, implement, and maintain
10 administrative, technical, and physical data security practices that,
11 at a minimum, satisfy reasonable standard of care within the
12 controller's industry to protect the confidentiality, integrity, and
13 accessibility of personal data appropriate to the volume and nature
14 of the personal data at issue, including disposing of personal data
15 in accordance with a retention schedule that requires the deletion of
16 personal data when the data is required to be deleted by law or is no
17 longer necessary for the purpose for which the data was collected,
18 processed, or transferred.
19 (5) A controller shall provide an effective mechanism for a
20 consumer to revoke the consumer's affirmative consent that is at
21 least as easy as the mechanism by which the consumer provided the
22 consumer's affirmative consent. Upon revocation of the consumer's
23 affirmative consent, the controller shall cease to process the data
24 as soon as practicable, but not later than 15 days after the receipt
25 of the revocation.
26 (6) A controller may not process the personal data of a consumer
27 for purposes of targeted advertising or sell the consumer's personal
28 data under the circumstances where a controller has actual knowledge,
29 or willfully disregards, that the consumer is a minor.
30 (7)(a) A controller may not discriminate or retaliate against a
31 consumer for exercising any of the consumer rights contained in this
32 chapter, or for refusing to agree to the collection or processing of
33 personal data for a separate product or service, including by denying
34 goods or services, charging different prices or rates for goods or
35 services, or providing a different level of quality of goods or
36 services to the consumer.
37 (b) Nothing in this subsection may be construed to require a
38 controller to provide a product or service that requires the personal
39 data of a consumer which the controller does not collect or maintain.
p. 18 HB 1671
1 (c)(i) Nothing in this subsection may be construed to prohibit a
2 controller from offering a different price, rate, level, quality, or
3 selection of goods or services to a consumer, including offering
4 goods or services for no fee, if the offering is in connection with a
5 consumer's voluntary participation in a financial incentive program,
6 such as a bona fide loyalty, rewards, premium features, discounts, or
7 club card program, provided that the controller may not transfer
8 personal data to a third party as part of such a program unless:
9 (A) The transfer is functionally necessary to enable the third
10 party to provide a benefit to which the consumer is entitled;
11 (B) The transfer of personal data to the third party is clearly
12 disclosed in the terms of the program; and
13 (C) The third party uses the personal data only for purposes of
14 facilitating a benefit to which the consumer is entitled and does not
15 process or transfer the personal data for any other purpose.
16 (ii) The sale of personal data must not be considered
17 functionally necessary to provide a financial incentive program. A
18 controller may not use financial incentive practices that are unjust,
19 unreasonable, coercive, or usurious in nature.
20 (8)(a) A controller or processor may not collect, process, or
21 transfer personal data in a manner that discriminates against an
22 individual or class of individuals, or otherwise makes unavailable
23 the equal enjoyment of goods or services, on the basis of an
24 individual's or class of individuals' actual or perceived race,
25 color, sex, sexual orientation, gender identity, disability,
26 religion, ancestry, or national origin.
27 (b) This subsection does not apply to:
28 (i) The collection, processing, or transfer of personal data for
29 the sole purpose of a controller's or processor's self-testing to
30 prevent or mitigate unlawful discrimination or otherwise to ensure
31 compliance with state or federal law, or for the sole purpose of
32 diversifying an applicant, participant, or customer pool; or
33 (ii) A private establishment, as described in 42 U.S.C. Sec.
34 2000a(e).
35 (9)(a) A controller must provide consumers with a reasonably
36 accessible, clear, and meaningful privacy notice that includes:
37 (i) The categories of personal data collected and processed by
38 the controller, including a separate list of categories of sensitive
39 data collected and processed by the controller, described in a level
p. 19 HB 1671
1 of detail that provides consumers a meaningful understanding of the
2 type of personal data collected or processed;
3 (ii) The categories of sources from which the consumer health
4 data is collected;
5 (iii) The purpose for collecting and processing each category of
6 personal data the controller collects or processes, described in a
7 way that gives consumers a meaningful understanding of how each
8 category of the consumers' personal data will be used;
9 (iv) How consumers may exercise their consumer rights included in
10 section 3 of this act, including how a consumer may appeal a
11 controller's decision with regard to the consumer's request;
12 (v) The categories of personal data that the controller transfers
13 to third parties, if any, and the purposes for those transfers;
14 (vi) The categories of third parties, if any, to which the
15 controller transfers personal data;
16 (vii) The length of time the controller intends to retain each
17 category of personal data, or, if it is not possible to identify the
18 length of time, the criteria used to determine the length of time the
19 controller intends to retain categories of personal data; and
20 (viii) An active email address or other online mechanism that the
21 consumer may use to contact the controller.
22 (b) If a controller makes a material change to its privacy
23 notice, the controller shall notify each consumer affected by the
24 material change before implementing the material change with respect
25 to prospectively collected personal data and provide a reasonable
26 opportunity for each consumer to withdraw consent. A controller
27 should provide a reasonable opportunity for each consumer to
28 affirmatively consent to further materially different processing or
29 transfer of previously collected personal data under the changed
30 policy. The controller shall take all reasonable electronic measures
31 to provide direct notification regarding material changes to the
32 privacy notice to each affected consumer, taking into account
33 available technology and the nature of the relationship.
34 (10) If a controller sells personal data to third parties or
35 processes personal data for targeted advertising, the controller
36 shall clearly and conspicuously disclose such selling or processing,
37 as well as the manner in which a consumer may exercise the right to
38 opt out of such selling or processing. The sale of consumer health
39 data must comply with RCW 19.373.030.
p. 20 HB 1671
1 NEW SECTION. Sec. 7. RESPONSIBILITIES OF PROCESSORS. (1) A
2 processor shall adhere to the instructions of a controller and shall
3 assist the controller in meeting the controller's obligations under
4 this chapter. A processor's assistance must include:
5 (a) Taking into account the nature of processing and the
6 information available to the processor, by appropriate technical and
7 organizational measures, insofar as is reasonably practicable,
8 assisting the controller in fulfilling the controller's obligation to
9 respond to consumer rights requests;
10 (b) Taking into account the nature of processing and the
11 information available to the processor, assisting the controller in
12 meeting the controller's obligation in relation to the security of
13 processing the personal data and in relation to the notification of a
14 breach of the security of the processor's system in order to meet the
15 controller's obligations; and
16 (c) Providing necessary information to enable the controller to
17 conduct and document data protection assessments.
18 (2) The processor's data processing procedures with respect to
19 processing performed on behalf of the controller must be governed by
20 a contract between a controller and a processor. The contract must be
21 binding and must clearly set forth instructions for processing data,
22 the nature and purpose of processing, the type of data subject to
23 processing, the duration of processing, and the rights and
24 obligations of both parties. The processor shall adhere to the
25 instructions of the controller and only process and transfer data it
26 receives from the controller to the extent necessary to provide a
27 service requested by the controller, as set out in the contract. The
28 contract must also require that the processor:
29 (a) Ensure that each person processing personal data is subject
30 to a duty of confidentiality with respect to that data;
31 (b) At the controller's direction, delete or return all personal
32 data to the controller as requested at the end of the provision of
33 services, unless retention of the personal data is required by law;
34 (c) Upon the reasonable request of the controller, make available
35 to the controller all information in its possession necessary to
36 demonstrate the processor's compliance with this chapter;
37 (d) After providing the controller an opportunity to object,
38 engage any subcontractor pursuant to a written contract that requires
39 the subcontractor to meet the obligations of the processor with
40 respect to the personal data;
p. 21 HB 1671
1 (e) Be prohibited from combining personal data that the processor
2 receives from or on behalf of a controller with personal data that
3 the processor receives from or on behalf of another person or
4 collects from the interaction of the processor with an individual;
5 and
6 (f) Allow and cooperate with reasonable assessments by the
7 controller or the controller's designated assessor or arrange for a
8 qualified and independent assessor to conduct an assessment of the
9 processor's policies and technical and organizational measures in
10 support of the obligations under this chapter, using an appropriate
11 and accepted control standard or framework and assessment procedure
12 for such assessments. The processor shall provide a report of such
13 assessment to the controller upon request.
14 (3) A processor shall establish, implement, and maintain
15 administrative, technical, and physical data security practices that,
16 at a minimum, satisfy reasonable standard of care within the
17 processor's industry to protect the confidentiality, integrity, and
18 accessibility of personal data appropriate to the volume and nature
19 of the personal data at issue.
20 (4) Nothing in this section may be construed to relieve a
21 controller or processor from the liabilities imposed on the
22 controller or processor by virtue of the controller's or processor's
23 role in the processing relationship, as described in this chapter.
24 (5) Determining whether a person is acting as a controller or
25 processor with respect to a specific processing of personal data is a
26 fact-based determination that depends on the context in which
27 personal data is to be processed. A person who is not limited in the
28 processing of personal data pursuant to a controller's instructions,
29 or who fails to adhere to such instructions, is a controller and not
30 a processor with respect to that specific processing of personal
31 data. A processor that continues to adhere to a controller's
32 instructions with respect to a specific processing of personal data
33 remains a processor. If a processor begins, alone or jointly with
34 others, determining the purposes and means of the processing of
35 personal data, the processor is a controller with respect to such
36 processing and may be subject to an enforcement action under this
37 chapter.
38 NEW SECTION. Sec. 8. DATA PROTECTION ASSESSMENTS. (1) A
39 controller may not conduct processing that presents a heightened risk
p. 22 HB 1671
1 of harm to a consumer without conducting and documenting a data
2 protection assessment for each of the controller's processing
3 activities that presents the heightened risk of harm to a consumer.
4 For the purposes of this section, processing that presents a
5 heightened risk of harm to a consumer includes:
6 (a) The collection or processing of personal data for the
7 purposes of targeted advertising;
8 (b) The sale of personal data;
9 (c) The processing of personal data for the purposes of
10 profiling, where such profiling presents a reasonably foreseeable
11 risk of:
12 (i) Unfair or deceptive treatment of consumers or unlawful
13 disparate impact on consumers;
14 (ii) Financial, physical, or reputational injury to consumers;
15 (iii) A physical or other intrusion upon the solitude, seclusion,
16 or the private affairs or concerns of consumers, where such intrusion
17 would be offensive to a reasonable person; or
18 (iv) Other substantial injury to consumers; and
19 (d) The collection or processing of sensitive data.
20 (2) Data protection assessments conducted pursuant to subsection
21 (1) of this section must identify the categories of personal data
22 collected, the purposes for collecting personal data, and whether
23 personal data is being transferred. Data protection assessments must
24 also identify and weigh the benefits that may flow, directly and
25 indirectly, from the processing to the controller, the consumer,
26 other stakeholders, and the public against the potential risks to the
27 rights of the consumer associated with such processing, as mitigated
28 by safeguards that are employed by the controller to reduce such
29 risks. The controller shall factor into any data protection
30 assessment the use of deidentified data and the reasonable
31 expectations of consumers, as well as the context of the processing
32 and the relationship between the controller and the consumer whose
33 personal data is being processed.
34 (3)(a) A controller shall submit a report of the data protection
35 assessment or evaluation to the attorney general upon request. The
36 report must include a summary of the data protection assessment, and
37 the controller shall make the summary publicly available in a place
38 that is easily accessible to consumers.
39 (b) The attorney general may require that a controller disclose
40 any data protection assessment that is relevant to an investigation
p. 23 HB 1671
1 conducted by the attorney general, and the controller shall make the
2 data protection assessment available to the attorney general upon
3 request. The attorney general may evaluate the data protection
4 assessment for compliance with the responsibilities set forth in this
5 chapter. To the extent any information contained in a data protection
6 assessment disclosed to the attorney general includes information
7 subject to attorney-client privilege or work product protection, the
8 disclosure does not constitute a waiver of such privilege or
9 protection.
10 (4) A single data protection assessment may address a comparable
11 set of processing operations that include similar activities.
12 (5) If a controller conducts a data protection assessment for the
13 purpose of complying with another applicable law or regulation, the
14 data protection assessment is deemed to satisfy the requirements of
15 this section if the data protection assessment is reasonably similar
16 in scope and effect to the data protection assessment that would
17 otherwise be conducted pursuant to this section.
18 (6) A controller shall conduct and document a data protection
19 assessment before initiating a processing activity that presents a
20 heightened risk of harm to a consumer. Throughout the processing
21 activity's life cycle, the controller shall review and update the
22 data protection assessment as often as appropriate, taking into
23 consideration the type, amount, and sensitivity of personal data
24 collected or processed and the level of risk presented by the
25 processing, in order to:
26 (a) Monitor for harm caused by the processing and adjust
27 safeguards accordingly; and
28 (b) Ensure that data protection and privacy are considered as the
29 controller makes new decisions with respect to the processing.
30 (7) The first data protection assessment required by this section
31 must be completed no later than one year after the effective date of
32 this section.
33 NEW SECTION. Sec. 9. DEIDENTIFIED DATA. (1) Any controller in
34 possession of deidentified data shall:
35 (a) Take technical measures to ensure that the data cannot be
36 associated with an individual;
37 (b) Publicly commit to maintaining and using deidentified data
38 without attempting to reidentify the data; and
p. 24 HB 1671
1 (c) Contractually obligate any recipients of the deidentified
2 data to comply with all provisions of this chapter.
3 (2) Nothing in this chapter may be construed to require a
4 controller or processor to:
5 (a) Reidentify deidentified data;
6 (b) Maintain data in an identifiable form; or
7 (c) Collect, obtain, retain, or access any data or technology in
8 order to be capable of associating an authenticated consumer request
9 with personal data.
10 (3) Nothing in this chapter may be construed to require a
11 controller or processor to comply with an authenticated consumer
12 rights request if the controller:
13 (a) Is not reasonably capable of associating the request with the
14 personal data or it would be unreasonably burdensome for the
15 controller to associate the request with the personal data; and
16 (b) Does not use the personal data to recognize or respond to the
17 specific consumer who is the subject of the personal data, or
18 associate the personal data with other personal data about the same
19 specific consumer.
20 (4) A controller that transfers deidentified data shall exercise
21 reasonable oversight to monitor compliance with any contractual
22 commitments to which the deidentified data is subject and shall take
23 appropriate steps to address any breaches of those contractual
24 commitments.
25 NEW SECTION. Sec. 10. LIMITATIONS. (1) The obligations imposed
26 on controllers and processors under this chapter do not restrict a
27 controller's or processor's ability to:
28 (a) Comply with federal, state, or local laws, rules, or
29 regulations, except as prohibited by the Washington shield law,
30 chapter 7.115 RCW;
31 (b) Comply with a civil, criminal, or regulatory inquiry,
32 investigation, subpoena, or summons by federal, state, local, or
33 other governmental authorities;
34 (c) Cooperate with law enforcement agencies concerning conduct or
35 activity that the controller or processor reasonably and in good
36 faith believes may violate federal, state, or local laws, rules, or
37 regulations;
38 (d) Investigate, establish, exercise, prepare for, or defend
39 legal claims;
p. 25 HB 1671
1 (e) Provide a product or service specifically requested by the
2 consumer;
3 (f) Perform under a contract to which a consumer is a party,
4 including fulfilling the terms of a written warranty;
5 (g) Take steps at the request of a consumer prior to entering
6 into a contract;
7 (h) Take immediate steps to protect an interest that is essential
8 for the life or physical safety of the consumer or another
9 individual, and where the processing cannot be manifestly based on
10 another legal basis;
11 (i) Prevent, detect, protect against, or respond to security
12 incidents, identity theft, fraud, harassment, malicious or deceptive
13 activities, or any illegal activity targeted at or involving the
14 controller or processor or its services; preserve the integrity or
15 security of systems; or investigate, report, or prosecute those
16 responsible for any such action;
17 (j) Engage in public or peer-reviewed scientific or statistical
18 research in the public interest that adheres to all relevant laws and
19 regulations governing such research, if applicable, and is approved,
20 monitored, and governed by an institutional review board, human
21 subjects research ethics review board, or a similar independent
22 oversight entity that determines whether:
23 (i) The deletion of personal data requested by a consumer
24 pursuant to section 3 of this act is likely to provide substantial
25 benefits that do not exclusively accrue to the controller;
26 (ii) The expected benefits of the research outweigh the privacy
27 risks; and
28 (iii) The controller has implemented reasonable safeguards to
29 mitigate privacy risks associated with research, including any risks
30 associated with reidentification;
31 (k) Assist another controller, processor, or third party with any
32 of the obligations under this chapter;
33 (l) Process personal data for reasons of public interest in the
34 area of public health, community health, or population health, but
35 solely to the extent that such processing is:
36 (i) Subject to suitable and specific measures to safeguard the
37 rights of the consumer whose personal data is being processed; and
38 (ii) Under the responsibility of a professional subject to
39 confidentiality obligations under federal, state, or local law;
p. 26 HB 1671
1 (m) Ensure the data security and integrity of personal data as
2 required by this chapter, protect against spam, or protect and
3 maintain networks and systems, including through diagnostics,
4 debugging, and repairs;
5 (n) Transfer assets to a third party in the context of a merger,
6 acquisition, bankruptcy, or similar transaction when the third party
7 assumes control, in whole or in part, of the controller's assets,
8 provided that the controller, in a reasonable time prior to the
9 transfer, provides an affected consumer with notice describing the
10 transfer, including the name of the entity receiving the consumer's
11 personal data and the applicable privacy policies of such entity, and
12 a reasonable opportunity to withdraw previously provided consent
13 related to the consumer's personal data and to request the deletion
14 of the consumer's personal data;
15 (o) Effectuate a product recall pursuant to federal or state law,
16 or to fulfill a warranty;
17 (p) Conduct medical research in compliance with 45 C.F.R. Part 46
18 or 21 C.F.R. Part 50 or 56; or
19 (q) Process personal data previously collected in accordance with
20 this chapter such that the personal data becomes deidentified data,
21 including to:
22 (i) Conduct internal research to develop, improve, or repair
23 products, services, or technology;
24 (ii) Identify and repair technical errors that impair existing or
25 intended functionality; or
26 (iii) Perform internal operations that are reasonably aligned
27 with the expectations of the consumer or reasonably anticipated based
28 on the consumer's existing relationship with the controller, or are
29 otherwise compatible with processing data in furtherance of the
30 provision of a product or service specifically requested by a
31 consumer or the performance of a contract to which the consumer is a
32 party.
33 (2) The obligations imposed on controllers and processors under
34 this chapter do not apply where compliance by a controller or
35 processor would violate an evidentiary privilege under Washington law
36 and do not prevent a controller or processor from providing personal
37 data concerning a consumer to a person covered by an evidentiary
38 privilege under Washington law as part of a privileged communication.
39 (3) A controller or processor that discloses personal data in
40 compliance with this chapter to a third-party controller or processor
p. 27 HB 1671
1 is not in violation of this chapter if the recipient processes such
2 personal data in violation of this chapter, provided that, at the
3 time of disclosing the personal data, the disclosing controller or
4 processor did not have actual knowledge that the recipient would
5 violate this chapter. A third-party controller or processor receiving
6 personal data in compliance with this chapter from a controller or
7 processor is likewise not in violation of this chapter for the
8 transgressions of the controller or processor from which it receives
9 the personal data.
10 (4) Nothing in this chapter may be construed to:
11 (a) Impose any obligation on a controller or processor that
12 adversely affects the rights or freedoms of any persons including,
13 but not limited to, the rights of any person to freedom of speech or
14 freedom of the press guaranteed in the First Amendment to the United
15 States Constitution or under the Washington reporter shield law,
16 chapter 5.68 RCW;
17 (b) Apply to any person's collection or processing of personal
18 data in the course of the person's purely personal or household
19 activities; or
20 (c) For private schools approved by the state under chapter
21 28A.195 RCW and private institutions of higher education as defined
22 in 20 U.S.C. Sec. 1001 et seq., require deletion of personal data
23 that would unreasonably interfere with the provision of education
24 services by or the ordinary operation of the school or institution.
25 (5)(a) Personal data collected or processed by a controller
26 pursuant to this section may be collected or processed to the extent
27 that the collection or processing is:
28 (i) Strictly necessary and proportionate to the purposes listed
29 in this section, or, in the case of consumer health data, is in
30 compliance with RCW 19.373.030;
31 (ii) Limited to what is strictly necessary in relation to the
32 specific purpose or purposes listed in this section, or, in the case
33 of consumer health data, in compliance with RCW 19.373.030; and
34 (iii) Compliant with section 6 of this act.
35 (b) Personal data processed pursuant to subsection (1)(q) of this
36 section must, where applicable, take into account the nature and
37 purpose or purposes of the processing. Such data must be subject to
38 reasonable administrative, technical, and physical measures to
39 protect the confidentiality, integrity, and accessibility of the
p. 28 HB 1671
1 personal data, and to reduce reasonably foreseeable risks of harm to
2 consumers relating to such processing of personal data.
3 (6) If a controller collects or processes personal data pursuant
4 to an exemption in this section, the controller bears the burden of
5 demonstrating that such collection or processing qualifies for the
6 exemption and complies with the requirements in subsection (5) of
7 this section.
8 NEW SECTION. Sec. 11. ADDITIONAL REQUIREMENTS. (1) Controllers
9 and processors that collect or process consumer health data may be
10 subject to additional data privacy requirements pursuant to chapter
11 19.373 RCW.
12 (2) Controllers and processors that collect or process data that
13 is exempt from this chapter may still be considered regulated
14 entities or processors under chapter 19.373 RCW and may be required
15 to comply with obligations under chapter 19.373 RCW.
16 NEW SECTION. Sec. 12. ENFORCEMENT. The legislature finds that
17 the practices covered by this chapter are matters vitally affecting
18 the public interest for the purpose of applying the consumer
19 protection act, chapter 19.86 RCW. A violation of this chapter is not
20 reasonable in relation to the development and preservation of
21 business and is an unfair or deceptive act in trade or commerce and
22 an unfair method of competition for the purpose of applying the
23 consumer protection act, chapter 19.86 RCW.
24 NEW SECTION. Sec. 13. OTHER ENFORCEMENT PRECLUDED. The rights
25 and obligations covered by this chapter may only be enforced pursuant
26 to section 12 of this act.
27 NEW SECTION. Sec. 14. WAIVER OF RIGHTS. Any provision of a
28 contract or agreement of any kind that purports to waive, release,
29 limit in any way, or extinguish the rights of consumers under this
30 chapter is against public policy and is void and unenforceable.
31 NEW SECTION. Sec. 15. A new section is added to chapter 19.373
32 RCW to read as follows:
33 A regulated entity, small business, or processor subject to the
34 requirements of this chapter may also be subject to data privacy
p. 29 HB 1671
1 requirements provided in chapter 19.--- RCW (the new chapter created
2 in section 17 of this act).
3 NEW SECTION. Sec. 16. If any provision of this act or its
4 application to any person or circumstance is held invalid, the
5 remainder of the act or the application of the provision to other
6 persons or circumstances is not affected.
7 NEW SECTION. Sec. 17. Sections 1 through 14 of this act
8 constitute a new chapter in Title 19 RCW.
9 NEW SECTION. Sec. 18. Section 12 of this act takes effect
10 August 1, 2026.
--- END ---
p. 30 HB 1671
File and source
- File
- 2025-02-04_a32657_bill_1671.pdf
- Size
- 175,930 bytes
- SHA-256
- 54dbaa853c1b94977e976cfedf23d2cf7a7403d1e32bed1e8970696199eb04dc
- Our copy
- 2025-02-04_a32657_bill_1671.pdf
- Original
- No public link identified.