wa-law.org > bill > 2023-24 > HB 2149 > Original Bill

HB 2149 - Protecting consumer personal information.

Source

Section 1

The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.

  1. "Consumer" means a natural person who is a Washington resident.

  2. "Personal information" means any one or more of the following items of personally identifiable information about a consumer collected by a transacting entity and maintained by the transacting entity in an accessible form:

    1. A first and last name;

    2. A home or other physical address which includes the name of a street and the name of a city or town;

    3. An email address;

    4. A telephone number;

    5. A social security number;

    6. An identifier that allows a specific person to be contacted either physically or online; and

    7. Any other information concerning a person collected from the person by a transacting entity and maintained by the transacting entity in combination with an identifier in a form that makes the information personally identifiable.

  3. "Point of sale" means the circumstance in which a consumer executes payment for goods or services and where sales taxes may become payable.

  4. "Selling" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by a transacting entity to a third party for monetary or other valuable consideration. For purposes of this chapter, a transacting entity does not sell personal information when:

    1. A consumer uses or directs the transacting entity to intentionally:

      1. Disclose personal information; or

      2. Interact with one or more third parties;

    2. The transacting entity uses or shares an identifier for a consumer who has opted out of the sale of the consumer's personal information or limited the use of the consumer's sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumer's personal information or limited the use of the consumer's personal information;

    3. The transacting entity transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the transacting entity, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title.

  5. "Sharing" means renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by a transacting entity to a third party whether or not for monetary or other valuable consideration, including transactions between a transacting entity and a third party for cross-context behavioral advertising for the benefit of a transacting entity in which no money is exchanged. For purposes of this title, a transacting entity does not share personal information when:

    1. A consumer uses or directs the transacting entity to intentionally disclose personal information or intentionally interact with one or more third parties;

    2. The transacting entity uses or shares an identifier for a consumer who has opted out of the sharing of the consumer's personal information or limited the use of the consumer's sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumer's personal information or limited the use of the consumer's personal information;

    3. The transacting entity transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the transacting entity, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title.

  6. "Transacting entity" means any of the following:

    1. A resident individual who engages regularly in commercial activity for the purpose of generating income;

    2. A corporation or nonprofit corporation, limited liability company, partnership or limited liability partnership, business trust, joint venture, or other form of business organization the constituent parts of which share an economic interest;

    3. A financial institution, as defined in RCW 9A.56.280;

    4. The state or any political subdivision thereof; or

    5. An individual that controls, is controlled by, or is under common control with a person described in (b) or (c) of this subsection.

Section 2

Any transacting entity conducting business in this state who collects personal information from a consumer at a point of sale is prohibited from selling or sharing that consumer's personal information unless the transacting entity first receives express permission from the consumer that the transacting entity is affirmatively authorized to share or sell that consumer's personal information.

Section 3

  1. The legislature finds that the practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this chapter is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

  2. This chapter may be enforced solely by the attorney general under the consumer protection act, chapter 19.86 RCW.

Created by @tannewt. Contribute on GitHub.