Pandemic Darlings The pandemic economy, in original documents
Home Source documents House Bill Analysis, HB 2606 - Office of Privacy and Data Protection (Hearing Date 1/27/26)

House Bill Analysis, HB 2606 - Office of Privacy and Data Protection (Hearing Date 1/27/26)

Summary

House Bill Analysis of HB 2606, Concerning performance measures, duties, and reporting requirements for the office of privacy and data protection, prepared by the Office of Program Research for the Technology, Economic Development, & Veterans Committee, with a hearing date of 1/27/26. The sponsors are Representatives Barnard, Ryu, Nance and Timmons. The brief summary says the bill modifies performance measures for the Office of Privacy and Data Protection (OPDP), includes review of agency projects using artificial intelligence in its primary duties, and removes the requirement to report on telecommunications providers and infrastructure. The analysis lists Appropriation: None and a fiscal note requested on January 20, 2026.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Cite this document

“House Bill Analysis, HB 2606 - Office of Privacy and Data Protection (Hearing Date 1/27/26).” Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2026-01-27-a33763-d292196-bill-analysis-47bef1ab6b/, SHA-256 7e49b4ec25343d8b765485e9136948c0c54b173f50a12e81bc9ce30aff98308f.

Full text

Washington State                    BILL
House of Representatives
Office of Program Research   ANALYSIS
Technology, Economic Development, &
Veterans Committee
                                        HB 2606
Brief Description: Concerning performance measures, duties, and reporting requirements for
     the office of privacy and data protection.

Sponsors: Representatives Barnard, Ryu, Nance and Timmons.


                                     Brief Summary of Bill
          • Modifies performance measures for the Office of Privacy and Data
            Protection (OPDP), adding agency improvements, public contacts,
            trainings, technical assistance requests, continuing education, and
            threshold analyses and privacy impact assessments completed; and
            removing reporting on data protection measures and consumer education
            efforts.
          • Includes review of agency projects using artificial intelligence in the
            OPDP's primary duties.
          • Removes requirement for the OPDP to report on telecommunications
            providers and infrastructure.


Hearing Date: 1/27/26

Staff: Martha Wehling (786-7067).

Background:

The Office of Privacy and Data Protection (OPDP) was created in the Office of the State Chief
Information Officer (OCIO) in 2016. The OCIO was eliminated in 2024, and the OCIO's
responsibilities were reassigned to Washington Technology Solutions (WaTech). In 2024 the




     This analysis was prepared by non-partisan legislative staff for the use of legislative
     members in their deliberations. This analysis is not part of the legislation nor does it
     constitute a statement of legislative intent.

House Bill Analysis                             -1-                                         HB 2606
OPDP was established within WaTech, rather than the OCIO.

The purpose of the OPDP is to serve as a central point of contact for state agencies on policy
matters involving data privacy and data protection, and to serve as a forum for ensuring equitable
consumer access to communications and data technology. The Chief Information Officer must
appoint the director, who is the Chief Privacy Officer.

The primary duties of the OPDP are to conduct an annual privacy review, to conduct an annual
privacy training for state agencies and employees, to articulate privacy principles and best
practices for state agencies, to coordinate data protection, and to participate in the review of
major state agency projects involving personally identifiable information.

The OPDP must serve as a resource to local governments and the public on data privacy and
protection concerns. This includes developing and promoting the dissemination of best practices
for the collection and storage of personally identifiable information, and establishing and
conducting a training program or programs for educating local governments and consumers
about the use of personally identifying information on mobile and digital networks and measures
that can help protect such information.

The OPDP was required to establish performance measures in its 2016 report to the Legislature
and, in each report thereafter, demonstrate the extent to which performance results have been
achieved. Certain performance reports are specified, for example pertaining to the OPDP's
training, coordination, consumer education, and outreach efforts.

The OPDP was required to submit performance measures and a data collection plan for review
and comment to the Joint Legislative Audit and Review Committee (JLARC) by 2017. In
December 2025 JLARC conducted a program and fiscal review of the OPDP and recommended
that the Legislature update the OPDP's mandate to align with its capacity and focus.

The OPDP must, at its discretion but at least once every four years, report to the Legislature on
access of state residents to advanced telecommunications capability. The report must describe
the extent to which telecommunications providers in the state are deploying advanced
telecommunications capability and the existence of any inequality in access experienced by
residents of rural areas, tribal lands, and economically distressed communities. The report is
only required to the extent that the OPDP is able to gather and present the information within
existing resources.

Summary of Bill:

The OPDP's primary duties are expanded to include review of agency projects using artificial
intelligence. The OPDP's performance measures are modified to add:
    • agency improvements in privacy and data protection policies and practices following
       participation in OPDP trainings, annual review of state agencies, and, when available,
       local government improvements;


House Bill Analysis                            -2-                                         HB 2606
    • public contacts including the number of contacts, nature of the contact, and the OPDP's
      response;
    • results of OPDP trainings, number of trainings completed, topics, and attendance;
    • technical assistance requests by agencies and local governments, including the number and
      nature of the requests;
    • OPDP staff's continuing education activities or certifications; and
    • number of privacy threshold analyses and privacy impact assessments completed.

Reporting on data protection measures and consumer education efforts are removed from the
OPDP's performance measures. The OPDP's requirement to report to JLARC and to report on
telecommunications providers and infrastructure is removed.

Appropriation: None.

Fiscal Note: Requested on January 20, 2026.

Effective Date: The bill takes effect 90 days after adjournment of the session in which the bill is
passed.




House Bill Analysis                            -3-                                         HB 2606

File and source

File
2026-01-27_a33763_d292196_bill-analysis.pdf
Size
42,137 bytes
SHA-256
7e49b4ec25343d8b765485e9136948c0c54b173f50a12e81bc9ce30aff98308f
Our copy
2026-01-27_a33763_d292196_bill-analysis.pdf
Original
No public link identified.
Back to top