The legislature finds that the state of Washington has been selling the personal data of its citizens to third-party vendors. This practice violates the state's obligation to respect and protect its citizens' personal property and it must come to an end. The legislature therefore intends to prohibit state agencies from selling personal data to third parties.
This section adds a new section to an existing chapter 43.105. Here is the modified chapter for context.
The sale of personal data by a state agency to a third party is prohibited.
By December 31st of each year, a state agency must certify compliance with the requirements of this section to the office of privacy and data protection.
As used in this section:
"Personal data" means any information relating to a natural person that is collected by a state agency.
"Sale" means the exchange of personal data for monetary consideration, other than cost recovery as permitted by law, to a third party.
This section adds a new section to an existing chapter 43.105. Here is the modified chapter for context.
A state agency must be transparent and accountable for its processing of personal data by making available to state residents and property owners a privacy notice that includes:
The categories of personal data collected by the state agency;
The categories of personal data that the state agency shares with third parties, if any, and the purposes for which that data is shared; and
The categories of third parties, if any, with whom the state agency shares personal data.
As used in this section:
"Personal data" has the same meaning as defined in section 2 of this act.
"Processing" means any operation or set of operations that is performed on personal data or sets of personal data, such as collection, storage, alteration, retrieval, use, disclosure, or dissemination.