House Bill 2606 — State of Washington, 69th Legislature, 2026 Regular Session

Summary

House Bill 2606 of the 69th Legislature, 2026 Regular Session, State of Washington, is by Representatives Barnard, Ryu, Nance, and Timmons and is referred to the Committee on Technology, Economic Development, & Veterans. The act relates to performance measures, duties, and reporting requirements for the office of privacy and data protection and amends RCW 43.105.369. The text states the office serves as a central point of contact for state agencies on policy matters involving data privacy and data protection. Its listed duties include an annual privacy review and an annual privacy training for state agencies and employees. The reporting items include the number of privacy impact assessments completed.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

     H-2923.1

                                HOUSE BILL 2606


     State of Washington        69th Legislature         2026 Regular Session

     By Representatives Barnard, Ryu, Nance, and Timmons

     Read first time 01/21/26.      Referred   to   Committee   on   Technology,
     Economic Development, & Veterans.




 1       AN ACT Relating to performance measures, duties, and reporting
 2   requirements for the office of privacy and data protection; and
 3   amending RCW 43.105.369.


 4   BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:


 5       Sec. 1.   RCW 43.105.369 and 2024 c 54 s 16 are each amended to
 6   read as follows:
 7       (1) The office of privacy and data protection is created within
 8   the agency. The purpose of the office of privacy and data protection
 9   is to serve as a central point of contact for state agencies on
10   policy matters involving data privacy and data protection.
11       (2) The director shall appoint the chief privacy officer, who is
12   the director of the office of privacy and data protection.
13       (3) The primary duties of the office of privacy and data
14   protection with respect to state agencies are:
15       (a) To conduct an annual privacy review;
16       (b) To conduct an annual privacy training for state agencies and
17   employees;
18       (c) To articulate privacy principles and best practices;
19       (d) To coordinate data protection in cooperation with the agency;
20   and


                                      p. 1                               HB 2606
 1       (e) To participate with the agency in the review of major state
 2   agency   projects  involving   personally  identifiable  information,
 3   including projects using artificial intelligence.
 4       (4) The office of privacy and data protection must serve as a
 5   resource to local governments and the public on data privacy and
 6   protection concerns by:
 7       (a) Developing and promoting the dissemination of best practices
 8   for   the   collection   and  storage   of   personally  identifiable
 9   information, including establishing and conducting a training program
10   or programs for local governments; and
11       (b) Educating consumers about the use of personally identifiable
12   information on mobile and digital networks and measures that can help
13   protect this information.
14       (5) By December 1, 2016, and every four years thereafter, the
15   office of privacy and data protection must prepare and submit to the
16   legislature a report evaluating its performance. The office of
17   privacy and data protection must establish performance measures in
18   its 2016 report to the legislature and, in each report thereafter,
19   demonstrate the extent to which performance results have been
20   achieved. These performance measures must include, but are not
21   limited to, the following:
22       (a) ((The number of state agencies and employees who have
23   participated in the annual privacy training)) Improvement of privacy
24   and data protection policies and practices by state agencies and,
25   when available, local governments, following participation in the
26   office of privacy and data protection's trainings, and for state
27   agencies, annual review;
28       (b) ((A report on the)) The extent of the office of privacy and
29   data protection's coordination with international and national
30   experts in the fields of data privacy, data protection, and access
31   equity;
32       (c) ((A report on the implementation of data protection measures
33   by state agencies attributable in whole or in part to the office of
34   privacy and data protection's coordination of efforts; and
35       (d) A report on consumer education efforts, including but not
36   limited to the number of consumers educated through public outreach
37   efforts, as indicated by how frequently educational documents were
38   accessed, the office of privacy and data protection's participation
39   in outreach events, and inquiries received back from consumers via
40   telephone or other media)) Data on contacts with the public,
                                     p. 2                          HB 2606
 1   including how many members of the public contact the office of
 2   privacy and data protection, the nature of the contact, and the
 3   office of privacy and data protection's response, including providing
 4   referrals and technical assistance;
 5       (d) Results of direct evaluation from participants of the office
 6   of privacy and data protection's trainings, including in-person or
 7   virtual formats. The report shall also include how many trainings
 8   were completed, topics, and how many participants attended;
 9       (e) The number and nature of technical assistance requests by
10   state agencies and local governments;
11       (f) The office of privacy and data protection's staff continuing
12   education activities or certifications in emerging technologies,
13   evolving best practices, and state or federal policies; and
14       (g) The number of privacy threshold analyses completed, and the
15   number of privacy impact assessments completed.
16       (((6) Within one year of June 9, 2016, the office of privacy and
17   data protection must submit to the joint legislative audit and review
18   committee for review and comment the performance measures developed
19   under subsection (5) of this section and a data collection plan.
20       (7) The office of privacy and data protection shall submit a
21   report   to   the   legislature  on   the:   (a)   Extent   to   which
22   telecommunications providers in the state are deploying advanced
23   telecommunications capability; and (b) existence of any inequality in
24   access to advanced telecommunications infrastructure experienced by
25   residents of tribal lands, rural areas, and economically distressed
26   communities. The report may be submitted at a time within the
27   discretion of the office of privacy and data protection, at least
28   once every four years, and only to the extent the office of privacy
29   and data protection is able to gather and present the information
30   within existing resources.))

                                  --- END ---




                                     p. 3                          HB 2606


File and source

File

2026-02-03_a33849_bill_2606.pdf

Size

68,427 bytes

SHA-256

1653accdedb121b0408efcfd4149b333e8123ba83a09820dd69f87be102e9203

Our copy

2026-02-03_a33849_bill_2606.pdf

Original

No public link identified.