SB 6281 — Concerning the management and oversight of personal data.

6501 through 6506 and its implementing regulations, shall be deemed compliant with any obligation to obtain parental consent under this chapter.NEW SECTION.  Sec.

alternatively, the processor may,shall with the controller's consent, arrange for a qualified and independent auditor to conduct, at least annually and at the processor's expense, an audit of the processor's policies and technical and organizational measures in support of the obligations under this chapter using an appropriate and accepted control standard or framework and audit procedure for such audits as applicable, and shall provide a report of such audit to the controller upon request.(5) In no event shall any contract relieve a controller or a processor from the liabilities imposed on them by virtue of its role in the processing relationship as defined by this chapter.(6) Determining whether a person is acting as a controller or processor with respect to a specific processing of data is a fact-based determination that depends upon the context in which personal data are to be processed.

A processor that continues to adhere to a controller's instructions with respect to a specific processing of personal data remains a processor.

A consumer has the right to opt out of the processing of personal data concerning such consumer for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal effects concerning a consumer or similarly significant effects concerning a consumer.(6) RespondingNotifying tothird parties of consumer requests.

A controller must, upon request, take reasonable steps to communicate a consumer's request to correct, delete, or opt out of the processing of personal data under subsection (2), (3), or (5) of this section to each third party to whom the controller disclosed the personal data within one year preceding the consumer's request, unless this proves functionally impractical, technically infeasible, or involves disproportionate effort.(7) Responding to consumer requests.

The controller must inform the consumer of any such extension within forty-five days of receipt of the request, together with the reasons for the delay.(b) If a controller does not take action on the request of a consumer, the controller must inform the consumer without undue delay and at the latest within forty-fivethirty days of receipt of the request of the reasons for not taking action and instructions for how to appeal the decision with the controller as described in subsection (7)(8) of this section.(c) Information provided under this section must be provided by the controller free of charge, up to twice annually to the consumer.

In such cases, the controller may request the provision of additional information reasonably necessary to authenticate the request.(7)(a)request.(8)(a) Controllers must establish an internal process whereby consumers may appeal a refusal to take action on a request to exercise any of the rights under subsections (1) through (5) of this section within a reasonable period of time after the consumer's receipt of the notice sent by the controller under subsection (6)(b)(7)(b) of this section.(b) The appeal process must be conspicuously available and as easy to use as the process for submitting such requests under this section.(c) Within thirty days of receipt of an appeal, a controller must inform the consumer of any action taken or not taken in response to the appeal, along with a written explanation of the reasons in support thereof.

The controller must also provide the consumer with an email address or other online mechanism through which the consumer may submit the appeal, along with any action taken or not taken by the controller in response to the appeal and the controller's written explanation of the reasons in support thereof, to the attorney general.(d) When informing a consumer of any action taken or not taken in response to an appeal pursuant to (c) of this subsection, the controller must clearly and prominently ask the consumer whether the consumer consents to having the controller submit the appeal, along with any action taken or not taken by the controller in response to the appeal and must, upon request, provide the controller's written explanation of the reasons in support thereof, to the attorney general.

If the consumer provides such consent, the controller must submit such information to the attorney general.NEWgeneral.(e) The attorney general must make publicly available on its web site all information it receives from a controller pursuant to (d) of this subsection, except that any information that may identify a consumer shall be redacted from such information before it is made publicly available on the attorney general's web site.NEW SECTION.  Sec.

or(c) Maintain data in identifiable form, or collect, obtain, retain, or access any data or technology, in order to be capable of associating an authenticated consumer request with personal data.(2) The rights contained in section 6 (1) through (4) of this act do not apply to pseudonymous data in cases where the controller is able to demonstrate anythat informationit necessaryis not in a position to identify the consumerconsumer, isfor keptinstance, separatelydue andto isthe subjectinstitution toof effective technical and organizational controls that prevent the controller from accessing suchinformation information.(3)that would enable the identification of the consumer.(3) A controller that uses pseudonymous data or deidentified data must exercise reasonable oversight to monitor compliance with any contractual commitments to which the pseudonymous data or deidentified data are subject, and must take appropriate steps to address any breaches of contractual commitments.NEW SECTION.  Sec.

and(v) The categories of third parties, if any, with whom the controller shares personal data.(b) If a controller sells personal data to third parties or processes personal data for targeted advertising, it must clearly and conspicuously disclose such processing, as well as the manner in which a consumer may exercise the right to opt out of such processing, in a clear and conspicuous manner.(c) Controllers shall establish,not andrequire shalla describeconsumer to create a new account in theorder privacyto notice,exercise onea orright, morebut securea andcontroller reliablemay meansrequire fora consumersconsumer to submituse aan requestexisting account to exercise theirthe consumer's rights under this chapter.chapter.(2) Purpose specification.

SuchA meanscontroller's shallcollection takeof intopersonal accountdata themust waysbe inlimited whichto consumerswhat interactis withreasonably thenecessary controller,in therelation needto forthe securespecified and reliableexpress communicationpurposes offor which such requests,data andare theprocessed, controller'sas abilitydisclosed to authenticate the identityconsumer.(3) ofData theminimization. consumer making the request.

ControllersA shallcontroller's notcollection requireof apersonal consumerdata tomust createbe aadequate, newrelevant, accountand inlimited order to exercisewhat ais right,reasonably butnecessary ain controllerrelation mayto requirethe aspecified consumerand toexpress usepurposes anfor existingwhich accountsuch todata exerciseare theprocessed, consumer'sas rightsdisclosed underto thisthe chapter.(2)consumer.(4) PurposeAvoid specification.secondary use.

AExcept controller'sas collectionprovided ofin this chapter, a controller may not process personal data mustfor bepurposes limitedthat toare whatnot is reasonably necessary into, relationor tocompatible with, the specified and express purposes for which such personal data are processed, as disclosed to the consumer.(3)consumer, Dataunless minimization.the controller obtains the consumer's consent.(5) Security.

A controller's collection of personal data must be adequate, relevant, and limited to what is reasonably necessary in relation to the purposes for which such data are processed, as disclosed to the consumer.(4) Avoid secondary use.

Except as provided in this chapter, a controller may not process personal data for purposes that are not reasonably necessary to, or compatible with, the purposes for which such personal data are processed, as disclosed to the consumer, unless the controller obtains the consumer's consent.(5) Security.

A controller shall not discriminate against a consumer for exercising any of the rights contained in this chapter, including denying goods or services to the consumer, charging different prices or rates for goods or services, and providing a different level of quality of goods and services to the consumer.consumer.(7) Sensitive data.

ThisA subsectioncontroller shallmay not prohibitprocess asensitive controllerdata fromconcerning offering a differentconsumer price,without rate,obtaining level,the quality,consumer's orconsent, selectionor, ofin goodsthe orcase servicesof to a consumer, including offering goods or services for no fee, if the offeringprocessing isof inpersonal connectiondata withconcerning a consumer'sknown voluntarychild, participationwithout inobtaining aconsent bonafrom fidethe loyalty,child's rewards,parent premiumor features,lawful discounts,guardian.(8) orNonwaiver clubof cardconsumer program.rights.

A controller may not sell personal data to a third-party controller as part of such a program unless:

(a) The sale is reasonably necessary to enable the third party to provide a benefit to which the consumer is entitled;

(b) the sale of personal data to third parties is clearly disclosed in the terms of the program;

and (c) the third party uses the personal data only for purposes of facilitating such benefit to which the consumer is entitled and does not retain or otherwise use or disclose the personal data for any other purpose.(7) Sensitive data.

Except as otherwise provided in this act, a controller may not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of personal data concerning a known child, without obtaining consent from the child's parent or lawful guardian, in accordance with the children's online privacy protection act requirements.(8) Nonwaiver of consumer rights.

DATA PROTECTION ASSESSMENTS.(1) Controllers must conductconduct, andto documentthe extent not previously conducted, a data protection assessment of each of thetheir following processing activities involving personal data:(a)data Theand processingan ofadditional personal data forprotection purposesassessment ofany targetedtime advertising;(b)there Theis salea ofchange personalin data;(c) The processing ofthat personalmaterially dataincreases forthe purposes of profiling, where such profiling presents a reasonably foreseeable risk of:to consumers.

(i)Such Unfairdata orprotection deceptiveassessments treatmentmust of,take into account the type of personal data to be processed by the controller, including the extent to which the personal data are sensitive data or disparateotherwise impactsensitive on,in consumers;nature, and the context in which the personal data are to be processed.(2) Data protection assessments conducted under subsection (1) of this section must identify and weigh the benefits that may flow directly and indirectly from the processing to the controller, consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks.

(ii)The financial,use physical,of ordeidentified reputationaldata injuryand the reasonable expectations of consumers, as well as the context of the processing and the relationship between the controller and the consumer whose personal data will be processed, must be factored into this assessment by the controller.(3) If the data protection assessment conducted under subsection (1) of this section determines that the potential risks of privacy harm to consumers;consumers are substantial and outweigh the interests of the controller, consumer, other stakeholders, and the public in processing the personal data of the consumer, the controller may only engage in such processing with the consent of the consumer or if another exemption under this chapter applies.

(iii)To athe physicalextent orthe othercontroller intrusionseeks uponconsumer theconsent solitudefor orprocessing, seclusion,such orconsent themust privatebe affairsas oreasy concerns,to ofwithdraw consumers,as whereto suchgive.(4) intrusionProcessing wouldshall be offensivepresumed to abe reasonablepermissible person;unless:

or(a) (iv)It otherinvolves substantialthe injuryprocessing toof consumers;sensitive data;

(d)and The(b) processingthe risk of sensitiveprocessing data;cannot be reduced by appropriate administrative and technical safeguards.(5) The attorney general may request, in writing, that a controller disclose any data protection assessment that is relevant to an investigation conducted by the attorney general.

and(e) Any processing activities involving personal data that present a heightened risk of harm to consumers.Such data protection assessments must take into account the type of personal data to be processed by the controller, including the extent to which the personal data are sensitive data, and the context in which the personal data are to be processed.(2) Data protection assessments conducted under subsection (1) of this section must identify and weigh the benefits that may flow directly and indirectly from the processing to the controller, consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks.

The use of deidentified data and the reasonable expectations of consumers, as well as the context of the processing and the relationship between the controller and the consumer whose personal data will be processed, must be factored into this assessment by the controller.(3) The attorney general may request, in writing, that a controller disclose any data protection assessment that is relevant to an investigation of the controller conducted by the attorney general.

The attorney general may evaluate the data protection assessments for compliance with the responsibilitiesduties contained in section 8 of this act and with other laws including, but not limited to, chapter 19.86 RCW.

The disclosure of a data protection assessment pursuant to a request from the attorney general under this subsection does not constitute a waiver of the attorney-client privilege or work product protection with respect to the assessment and any information contained in the assessment.(4)assessment.NEW Data protection assessments conducted by a controller for the purpose of compliance with other laws or regulations may qualify under this section if they have a similar scope and effect.NEW SECTION.  Sec.

(i) Necessary, reasonable, and proportionate to the specific purpose or purposes listed in this section;

This does not relieve any party from any duties or obligations imposed, or to alter any independent rights that consumers have under other laws, chapter 19.86 RCW, the Washington state Constitution, or the United States Constitution.(2) Where more than one controller or processor, or both a controller and a processor, involved in the same processing, is in violation of this chapter, the liability must be allocated among the parties according to principles of comparative fault.NEWfault, unless such liability is otherwise allocated by contract among the parties.NEW SECTION.  Sec.

ATTORNEYPRIVACY GENERALOFFICE REPORT.(1)STUDY.(1) The attorneystate generaloffice of privacy and data protection shall compileconduct a reportstudy evaluatingon the liabilitydevelopment of technology, such as a browser setting, browser extension, or global device setting, indicating a consumer's affirmative, freely given, and enforcementunambiguous provisionschoice to opt out of thisthe chapterprocessing including,of butpersonal notdata limitedfor to,the purposes of targeted advertising, the effectivenesssale of itspersonal effortsdata, toor enforceprofiling thisin chapter,furtherance andof anydecisions recommendationsthat forproduce changeslegal toeffects suchconcerning provisions.(2)consumers or similarly significant effects concerning consumers.(2) The attorneyoffice generalof privacy and data protection shall submit thea report of its findings and recommendations to the governor and the appropriate committees of the legislature by JulyOctober 1,31, 2022.NEW2021.NEW SECTION.  Sec.

ATTORNEY GENERAL REPORT.(1) The attorney general shall compile a report evaluating the liability and enforcement provisions of this chapter including, but not limited to, the effectiveness of its efforts to enforce this chapter, and any recommendations for changes to such provisions.(2) The attorney general shall submit the report to the governor and the appropriate committees of the legislature by July 1, 2022.NEW SECTION.  Sec.

17.

17.18.

FACIAL RECOGNITION.(1) Processors that provide facial recognition services must make available an application programming interface or other technical capability, chosen by the processor, to enable controllers or third parties to conduct legitimate, independent, and reasonable tests of those facial recognition services for accuracy and unfair performance differences across distinct subpopulations:subpopulations.

PROVIDED,Such Thatsubpopulations makingmay suchbe andefined applicationby programmingrace, interfaceskin ortone, otherethnicity, technicalgender, capabilityage, availabledisability doesstatus, notor requireother theprotected disclosurecharacteristic ofthat proprietaryis data,objectively tradedeterminable secrets, intellectual property, or otherself-identified information,by or if doing so would increase the riskindividuals ofportrayed cyberattacksin including, without limitation, cyberattacks related to unique methods of conducting business, data unique to the producttesting ordataset. services, or determining prices or rates to be charged for services.

SuchIf subpopulationsthe areresults definedof bythat visuallyindependent detectabletesting characteristics,identify suchmaterial asunfair (a)performance race,differences skinacross tone,subpopulations ethnicity,and gender,those age,results orare disabilitydisclosed status,directly orto (b)the otherprocessor, protectedwho, characteristicsacting reasonably, determines that arethe objectivelymethodology determinableand orresults self-identifiedof bythat testing are valid, then the individualsprocessor portrayedmust indevelop and implement a plan to address the testingidentified dataset.performance differences.

If the results of that independent testing identify material unfair performance differences across subpopulations and the methodology, data, and results are disclosed in a manner that allow full reproduction of the testing directly to the processor, who, acting reasonably, determines that the methodology and results of that testing are valid, then the processor must develop and implement a plan to mitigate the identified performance differences.

and(b) Information about where consumers can obtain additional information about the facial recognition service including, but not limited to, a link to any applicable online notice, terms, or policy that provides information about where and how consumers can exercise any rights that they have with respect to the facial recognition service.(5) Controllers must obtain consent from a consumer prior to enrolling an image of that consumer in a facial recognition service used in a physical premisepremises open to the public.(6) AsExcept anas exceptionprovided toin subsection (5) of this section, controllers may enroll an image of a consumer in a facial recognition service for a security or safety purpose without first obtaining consent from that consumer, provided that all of the following requirements are met:(a) The controller must hold a reasonable suspicion, based on a specific incident, that the consumer has engaged in criminal activity, which includes, but is not limited to, shoplifting, fraud, stalking, or domestic violence;(b) Any database used by a facial recognition service for identification, verification, or persistent tracking of consumers for a security or safety purpose must be used solely for that purpose and maintained separately from any other databases maintained by the controller;(c) The controller must review any such database used by the controller's facial recognition service no less than annuallybiannually to remove facial templates of consumers whom the controller no longer holds a reasonable suspicion that they have engaged in criminal activity;activity or that are more than three years old;

and(d) The controller must establish an internal process whereby a consumer may correct or challenge the decision to enroll the image of the consumer in a facial recognition service for a security or safety purpose.(7) Controllers using a facial recognition service to make decisions that produce legal effects on consumers or similarly significant effects on consumers must ensure that those decisions are subject to meaningful human review.(8) Prior to deploying a facial recognition service in the context in which it will be used, controllers using a facial recognition service to make decisions that produce legal effects on consumers or similarly significant effects on consumers must test the facial recognition service in operational conditions.

2258A.(11) Controllers and processors that deploy a facial recognition service must respond to a consumer request to exercise the rights specified in section 6 of this act and must fulfill the duties identified in section 8 of this act.(12)act.NEW VoluntarySECTION.  Sec. facial recognition services used to verify an aviation passenger's identity in connection with services regulated by the secretary of transportation under Title 49 U.S.C.

Sec.

41712 and exempt from state regulation under Title 49 U.S.C.

Sec.

41713(b)(1) are exempt from section 18 of this act.

Images captured by an airline must not be retained for more than twenty-four hours and, upon request of the attorney general, airlines must certify that they do not retain the image for more than twenty-four hours.

An airline facial recognition service must disclose and obtain consent from the customer prior to capturing an image.NEW SECTION.  Sec.

18.

Sections 1 through 17 and 19 of this act constitute a new chapter in Title 19 RCW.NEW SECTION.  Sec.

ThisSections 1 through 18 and 20 of this act takesconstitute effecta Julynew 31,chapter 2021.---in ENDTitle ---19 RCW.NEW SECTION.  Sec.

20.

Except for section 15 of this act, this act takes effect July 31, 2021.--- END ---