wa-law.org > bill > 2023-24 > HB 2277 > Original Bill
The legislature finds that:
The data consumers generate in nearly every moment of their modern lives in today's highly technological world enables the constant surveillance of any individual any time of the day and every day of the year. There has been rapid growth in the volume and variety of this personal data, which is known as behavioral surplus, being collected, analyzed, packaged, sold, purchased, monetized, and used in ways that are both helpful and harmful. This process is largely invisible to consumers and often happens without their awareness or consent. This growth has the potential for great benefits to human knowledge, technological innovation, and economic growth, but also the potential to harm individual privacy and freedom;
Privacy is a deeply held value of Washington state residents, and Washington explicitly recognizes its citizens' right to privacy under Article I, section 7 of the state Constitution. Fundamental privacy rights have long been and continue to be integral to protecting Washingtonians and to safeguarding the democratic republic. Washington residents should have the right to a reasonable expectation of privacy in their movements, and thus should be free from ubiquitous and surreptitious surveillance;
Washington is a technology leader on a national and global level and recognizes its distinctive position in promoting the efficient balance of consumer privacy and economic benefits. In addition, the technology industry has been a tremendous driver of economic growth in Washington state, but should not be based on the exploitation of its residents at the expense of their privacy; and
Technological advances have outpaced the legislature's ability to protect consumers. Technology and businesses continue to push the limits of data collection with exponential rapidity. Laws must keep pace as technology and business practices evolve.
The legislature intends to lay the groundwork for improved protection of the privacy of the residents of Washington. Creating a policy that offers greater transparency and accountability of the actions of data brokers will allow consumers to understand which companies are engaged in brokering personal data. It is the intention of the legislature for this to lead to the creation of more robust privacy safeguards and improved ability of consumers to make informed decisions about how their personal data is collected and used.
The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.
[Empty]
"Biometric information" means a record of one or more measurable biological or behavioral characteristics that can be used alone or in combination with each other or with other information for automated recognition of a known or unknown individual. Examples include, but are not limited to: fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics, gait, handwriting, key stroke dynamics, and mouse movements.
"Biometric information" does not include writing samples, written signatures, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions, such as height, weight, hair color, or eye color. "Biometric information" does not include donated organs, tissues, or parts, or blood or serum stored on behalf of recipients or potential recipients of living or cadaveric transplants and obtained or stored by a federally designated organ procurement agency.
"Brokered personal data" means any of the following computerized data elements about a resident individual, if categorized or organized for sale or licensing to another entity:
The resident individual's name or the name of a member of the resident individual's immediate family or household;
The resident individual's address or an address for a member of the resident individual's immediate family or household;
The resident individual's date or place of birth;
The maiden name of the resident individual's mother;
Biometric information about the resident individual;
The resident individual's social security number or the number of any other government-issued identification for the resident individual; or
Other information that, alone or in combination with other information that is sold or licensed, can reasonably be associated with the resident individual.
[Empty]
"Business entity" means:
A resident individual who regularly engages in commercial activity for the purpose of generating income;
A corporation or nonprofit corporation, limited liability company, partnership or limited liability partnership, business trust, joint venture, or other form of business organization the constituent parts of which share a common economic interest;
A financial institution, as defined in RCW 9A.56.280; or
An individual that controls, is controlled by, or is under common control with a person described in (a)(ii) or (iii) of this subsection (3).
"Business entity" does not include the state or a state agency, a local government, or a business entity or other person during a period in which the business entity or person is acting solely on behalf of and at the direction of the state, a state agency, or the local government.
"Data broker" means any business entity that engages in data brokering and does not include:
A consumer reporting agency, as defined in Title 15 U.S.C. Sec. 1681a, a person that furnishes information to a consumer reporting agency, as provided in Title 15 U.S.C. Sec. 1681s-2, or a user of a consumer report, as defined in Title 15 U.S.C. Sec. 1681a, to the extent that the consumer reporting agency, the person that furnishes information to a consumer reporting agency, or the user of a consumer report engages in activities that are subject to regulation under the federal fair credit reporting act, Title 15 U.S.C. Sec. 1681 et seq.; and
A financial institution, an affiliate, or a nonaffiliated third party, as those terms are defined in Title 15 U.S.C. Sec. 6809, to the extent that the financial institution, affiliate, or nonaffiliated third party is subject to regulation under Title V of the Gramm-Leach-Bliley act, Title 15 U.S.C. Secs. 6801 to 6809, and regulations adopted under Title V of the Gramm-Leach-Bliley act.
"Data brokering" means the act of collecting, aggregating, analyzing, buying, selling, and sharing brokered personal data, irrespective of the business entity's relationship with the resident individual whose data is being brokered.
"Department" means the department of licensing.
"Resident individual" means a person who resides in Washington.
Except as provided in subsection (2) of this section, a data broker who engages in data brokering must register with the department as provided in section 4 of this act.
A data broker is not required to register with the department if the brokered personal data involves any of the following:
Providing publicly available information that is related to a resident individual's business or profession;
Providing publicly available information as part of a service that provides alerts for health or safety purposes;
Providing directory assistance or directory information services as, or on behalf of, a telecommunications carrier; or
Selling the assets of a business entity or a part of a business entity a single time, or only occasionally, as part of a transfer of control over the assets that is not part of the ordinary conduct of the business entity or a part of the business entity.
Annually, on or before January 31st following a year in which a business entity meets the definition of data broker as provided in section 2 of this act, a data broker must:
Submit on a form and in a format the department specifies:
The name of the data broker;
The street address and telephone number of the data broker; and
The data broker's primary website and email address;
Pay a fee in an amount the department specifies by rule. The department shall set the fee in an amount that is sufficient to pay the costs of administering the registration program as provided in RCW 43.24.086. Any fees or fines collected under the authority of this chapter must be deposited into the business and professions account created in RCW 43.24.150; and
Include with the application form a declaration in which the data broker:
States whether a resident individual's precise geolocation information is a part of their data brokering activity;
States whether resident individuals' consumer health data, as defined in RCW 19.373.010, is a part of their data brokering activity;
States whether resident individuals may opt out of all or a portion of the data broker's use of their brokered personal data;
iv.(A) Identifies which of the data broker's activities a resident individual may opt out of; and
(B) Identifies which portion of the resident individual's brokered personal data the resident individual may opt out of providing or permitting the data broker to use;
v. Describes the method by which a resident individual may exercise the choices described in (c)(iii) and (iv) of this subsection (1); and
vi. States whether a resident individual may authorize an individual to exercise the choice described in (c)(iii) of this subsection (1) on the resident individual's behalf and, if so, the appropriate process for the authorization.
The department shall make the information that business entities submit for registration under this chapter publicly available on the department's website.
The department shall report to the governor and to the legislature in accordance with RCW 43.01.036 annually, beginning December 31, 2026, on the following:
How many business entities registered with the department as data brokers in that year;
The fee the department charged for registration per data broker, and the total revenue collected;
How many business entities were fined for noncompliance with this chapter; and
Any other information the department deems relevant.
The uniform regulation of business and professions act, chapter 18.235 RCW governs unlicensed practice, the issuance and denial of licenses, and the discipline of licensees under this chapter.
The department may adopt rules that are necessary to implement the provisions of this chapter.
This chapter applies only to the director and the boards and commissions having jurisdiction in relation to the businesses and professions licensed under the chapters specified in this section. This chapter does not apply to any business or profession not licensed under the chapters specified in this section.
[Empty]
The director has authority under this chapter in relation to the following businesses and professions:
Auctioneers under chapter 18.11 RCW;
Bail bond agents and bail bond recovery agents under chapter 18.185 RCW;
Camping resorts' operators and salespersons under chapter 19.105 RCW;
Commercial telephone solicitors under chapter 19.158 RCW;
Cosmetologists, barbers, manicurists, and estheticians under chapter 18.16 RCW;
Court reporters under chapter 18.145 RCW;
Driver training schools and instructors under chapter 46.82 RCW;
Employment agencies under chapter 19.31 RCW;
ix. For hire vehicle operators under chapter 46.72 RCW;
Notaries public under chapter 42.45 RCW;
Private investigators under chapter 18.165 RCW;
Professional boxing, martial arts, and wrestling under chapter 67.08 RCW;
Real estate appraisers under chapter 18.140 RCW;
Real estate brokers and salespersons under chapters 18.85 and 18.86 RCW;
Scrap metal processors, scrap metal recyclers, and scrap metal suppliers under chapter 19.290 RCW;
Security guards under chapter 18.170 RCW;
Sellers of travel under chapter 19.138 RCW;
Timeshares and timeshare salespersons under chapter 64.36 RCW;
Whitewater river outfitters under chapter 79A.60 RCW;
Home inspectors under chapter 18.280 RCW;
Body artists, body piercers, and tattoo artists, and body art, body piercing, and tattooing shops and businesses, under chapter 18.300 RCW;
Appraisal management companies under chapter 18.310 RCW; and
Data brokers under chapter 19.--- RCW (the new chapter created in section 9 of this act).
The boards and commissions having authority under this chapter are as follows:
The state board for architects established in chapter 18.08 RCW;
The Washington state collection agency board established in chapter 19.16 RCW;
The state board of registration for professional engineers and land surveyors established in chapter 18.43 RCW governing licenses issued under chapters 18.43 and 18.210 RCW;
The funeral and cemetery board established in chapter 18.39 RCW governing licenses issued under chapters 18.39 and 68.05 RCW;
The state board of licensure for landscape architects established in chapter 18.96 RCW; and
In addition to the authority to discipline license holders, the disciplinary authority may grant or deny licenses based on the conditions and criteria established in this chapter and the chapters specified in subsection (2) of this section. This chapter also governs any investigation, hearing, or proceeding relating to denial of licensure or issuance of a license conditioned on the applicant's compliance with an order entered under RCW 18.235.110 by the disciplinary authority.
This act takes effect January 1, 2026.