wa-law.org > bill > 2025-26 > HB 2483 > Original Bill

HB 2483 - Data broker registry

Source

Section 1

  1. The legislature recognizes that consumers are increasingly conducting their professional and personal affairs online and on devices such as laptop computers, smartphones, or tablets. These activities include accessing the marketplace, the workplace, health care, information, and entertainment. Through these daily activities, consumers generate enormous and unprecedented amounts of data about themselves, including their locations, behaviors, and preferences.

  2. The legislature further recognizes that technological advances have made it possible to more easily and quickly collect vast amounts of personal information and connect it to an individual, whether such information is obtained through electronic or other means.

  3. The legislature finds that there are many businesses engaged in collecting the personal data of Washingtonians, and sharing, buying, and selling it without Washingtonians' knowledge or consent. This is a new business model that has flourished and is anticipated to grow as more people and more devices are connected with ever-increasing frequency for an ever-greater number of innovative applications. As such, the legislature intends to provide transparency into the number of businesses, volume, and type of activity in this unique and growing industry.

Section 2

The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.

  1. [Empty]

    1. "Biometric information" means a record of one or more measurable biological or behavioral characteristics that can be used alone or in combination with each other or with other information for automated recognition of a known or unknown individual. Examples include, but are not limited to: Fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics, gait, handwriting, key stroke dynamics, and mouse movements.

    2. "Biometric information" does not include writing samples, written signatures, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions, such as height, weight, hair color, or eye color. "Biometric information" does not include donated organs, tissues, or parts, or blood or serum stored on behalf of recipients or potential recipients of living or cadaveric transplants and obtained or stored by a federally designated organ procurement agency.

  2. "Brokered personal data" means any of the following computerized data elements about a resident individual, if categorized or organized for sale or licensing to another entity:

    1. The resident individual's name or the name of a member of the resident individual's immediate family or household;

    2. The resident individual's address or an address of a member of the resident individual's immediate family or household;

    3. The resident individual's date or place of birth;

    4. The maiden name of the resident individual's mother;

    5. Biometric information about the resident individual;

    6. The resident individual's social security number or the number of any other government-issued identification for the resident individual; or

    7. Other information that, alone or in combination with other information that is sold or licensed, can reasonably be associated with the resident individual.

  3. [Empty]

    1. "Business entity" means:

      1. A resident individual who regularly engages in commercial activity for the purpose of generating income;

      2. A corporation or nonprofit corporation, limited liability company, partnership or limited liability partnership, business trust, joint venture, or other form of business organization the constituent parts of which share a common economic interest;

      3. A financial institution, as defined in RCW 9A.56.280; or

      4. An individual that controls, is controlled by, or is under common control with a person described in (a)(ii) or (iii) of this subsection (3).

    2. "Business entity" does not include the state or a state agency, a local government, or a business entity or other person during a period in which the business entity or person is acting solely on behalf of and at the direction of the state, a state agency, or a local government.

  4. "Data broker" means any business entity or part of a business entity that collects and sells or licenses brokered personal data to another person, irrespective of the business entity's relationship with the resident individual whose data is being collected and sold or licensed. "Data broker" does not include:

    1. A consumer reporting agency, as defined in 15 U.S.C. Sec. 1681a, a person that furnishes information to a consumer reporting agency, as provided in 15 U.S.C. Sec. 1681s-2, or a user of a consumer report, as defined in 15 U.S.C. Sec. 1681a, to the extent that the consumer reporting agency, the person that furnishes information to a consumer reporting agency, or the user of a consumer report engages in activities that are subject to regulation under the federal fair credit reporting act, 15 U.S.C. Sec. 1681 et seq.; and

    2. A financial institution, an affiliate, or a nonaffiliated third party, as those terms are defined in 15 U.S.C. Sec. 6809, to the extent that the financial institution, affiliate, or nonaffiliated third party is subject to regulation under Title V of the Gramm-Leach-Bliley act, 15 U.S.C. Secs. 6801 to 6809, and regulations adopted under Title V of the Gramm-Leach-Bliley act.

  5. "Department" means the department of licensing.

  6. "License" means a grant of access to, or distribution of, data by one person to another person in exchange for consideration. "License" does not include a use of data for the sole benefit of a data provider where the data provider maintains control over the use of the data.

  7. "Resident individual" means a person who resides in Washington.

Section 3

  1. Except as provided in subsection (2) of this section, beginning January 1, 2027, a data broker may not collect and sell or license brokered personal data within this state unless the data broker registers with the department as provided in section 4 of this act.

  2. A data broker is not required to register with the department if the brokered personal data involves only:

    1. Providing publicly available information that is related to a resident individual's business or profession;

    2. Providing publicly available information as part of a service that provides alerts for health or safety purposes;

    3. Providing directory assistance or directory information services as, or on behalf of, a telecommunications carrier; or

    4. Selling the assets of a business entity or a part of a business entity a single time, or only occasionally, as part of a transfer of control over the assets that is not part of the ordinary conduct of the business entity or a part of the business entity.

  3. A data broker who is required to register under this chapter but fails to do so is subject to a fine of $1,000 per day for each day the data broker is not registered.

Section 4

  1. Annually, following a year in which a business entity meets the definition of data broker as provided in section 2 of this act, a data broker must:

    1. Submit on a form and in a format the department specifies:

      1. The name of the data broker;

      2. The street address and telephone number of the data broker; and

      3. The data broker's primary website and email address;

    2. Pay a fee in an amount the department specifies by rule. The department shall set the fee in an amount that is sufficient to pay the costs of administering the registration program as provided in RCW 43.24.086. Any fees or fines collected under the authority of this chapter must be deposited into the business and professions account created in RCW 43.24.150; and

    3. Include with the application form a declaration in which the data broker:

      1. Indicates the type of data the data broker collects, how the data is processed, who the data is sold to, and for what purposes the data is sold;

      2. Specifies how many resident individuals the data broker collected data on each month of the previous year;

      3. Explains what types of security measures the data broker has in place to protect their data;

      4. States whether a resident individual's precise geolocation information is a part of their data brokering activity;

    4. States whether resident individuals' consumer health data, as defined in RCW 19.373.010, is a part of their data brokering activity;

    1. States whether resident individuals may opt out of all or a portion of the data broker's use of their brokered personal data;

    vii.(A) Identifies which of the data broker's activities a resident individual may opt out of; and

(B) Identifies which portion of the resident individual's brokered personal data the resident individual may opt out of providing or permitting the data broker to use;

viii. Describes the method by which a resident individual may exercise the choices described in (vi) and (vii) of this subsection (1)(c); and

    ix. States whether a resident individual may authorize an individual to exercise the choice described in (vi) of this subsection (1)(c) on the resident individual's behalf and, if so, the appropriate process for the authorization.
  1. If a data broker complies with the requirements set forth in this section, the department must approve the registration. A registration under this section is valid until January 1st of the year after the department approves the registration.

Section 5

The department shall make the information that business entities submit for registration under this chapter publicly available on the department's website.

Section 6

  1. The uniform regulation of business and professions act, chapter 18.235 RCW governs unregistered practice, the issuance and denial of registration, and the discipline of registrants under this chapter.

  2. If the registrant is an individual, the department shall immediately suspend the registration of a person who has been certified pursuant to RCW 74.20A.320 by the department of social and health services as a person who is not in compliance with a support order. If the person has continued to meet all other requirements for reinstatement during the suspension, reissuance of the registration shall be automatic upon the department's receipt of a release issued by the department of social and health services stating that the registrant is in compliance with the order.

Section 7

The department may adopt rules that are necessary to implement the provisions of this chapter.

Section 8

  1. This chapter applies only to the director and the boards and commissions having jurisdiction in relation to the businesses and professions licensed under the chapters specified in this section. This chapter does not apply to any business or profession not licensed under the chapters specified in this section.

  2. [Empty]

    1. The director has authority under this chapter in relation to the following businesses and professions:

      1. Auctioneers under chapter 18.11 RCW;

      2. Bail bond agents and bail bond recovery agents under chapter 18.185 RCW;

      3. Camping resorts' operators and salespersons under chapter 19.105 RCW;

      4. Commercial telephone solicitors under chapter 19.158 RCW;

    2. Cosmetologists, barbers, manicurists, and estheticians under chapter 18.16 RCW;

    1. Court reporters under chapter 18.145 RCW;

    2. Driver training schools and instructors under chapter 46.82 RCW;

    3. Employment agencies under chapter 19.31 RCW;

     ix. For hire vehicle operators under chapter 46.72 RCW;
    1. Limousines under chapter 46.72A RCW;

    1. Notaries public under chapter 42.45 RCW;

    2. Private investigators under chapter 18.165 RCW;

    3. Professional boxing, martial arts, and wrestling under chapter 67.08 RCW;

    4. Real estate appraisers under chapter 18.140 RCW;

    5. Real estate brokers and salespersons under chapters 18.85 and 18.86 RCW;

    6. Scrap metal processors, scrap metal recyclers, and scrap metal suppliers under chapter 19.290 RCW;

    7. Security guards under chapter 18.170 RCW;

    8. Sellers of travel under chapter 19.138 RCW;

    9. Timeshares and timeshare salespersons under chapter 64.36 RCW;

    10. Whitewater river outfitters under chapter 79A.60 RCW;

    11. Home inspectors under chapter 18.280 RCW;

    12. Body artists, body piercers, and tattoo artists, and body art, body piercing, and tattooing shops and businesses, under chapter 18.300 RCW; and

    13. Appraisal management companies under chapter 18.310 RCW; and

    14. Data brokers under chapter 19.--- RCW (the new chapter created in section 9 of this act).

    1. The boards and commissions having authority under this chapter are as follows:

      1. The state board for architects established in chapter 18.08 RCW;

      2. The Washington state collection agency board established in chapter 19.16 RCW;

      3. The state board of registration for professional engineers and land surveyors established in chapter 18.43 RCW governing licenses issued under chapters 18.43 and 18.210 RCW;

      4. The funeral and cemetery board established in chapter 18.39 RCW governing licenses issued under chapters 18.39 and 68.05 RCW;

    2. The state board of licensure for landscape architects established in chapter 18.96 RCW; and

    1. The state geologist licensing board established in chapter 18.220 RCW.

  3. In addition to the authority to discipline license holders, the disciplinary authority may grant or deny licenses based on the conditions and criteria established in this chapter, chapter 18.415 RCW, and the chapters specified in subsection (2) of this section. This chapter also governs any investigation, hearing, or proceeding relating to denial of licensure or issuance of a license conditioned on the applicant's compliance with an order entered under RCW 18.235.110 by the disciplinary authority.

Created by @tannewt. Contribute on GitHub.