SB 5062 — Concerning the management, oversight, and use of data.

(a) State agencies, legislative agencies, the judicial branch, local governments, or tribes;

(c) AirInformation carriers;that meets the definition of:

(d) Information that meets the definition of:

p.(vi) Information and documents created for purposes of the federal health care quality improvement act of 1986, and related regulations;

8 SSB 5062 (vi) Information and documents created for purposes of the federal health care quality improvement act of 1986, and related regulations;

or (viii)p. Information that is (A) deidentified in accordance with the requirements for deidentification set forth in 45 C.F.R.

Part8 164,SB and5062 (B)(viii) derivedInformation fromthat anyis of(A) deidentified in accordance with the healthrequirements care-relatedfor informationdeidentification listedset forth in this45 subsectionC.F.R. (2)(d);

(e)Part Information164, originatingand from,(B) andderived intermingledfrom toany beof indistinguishablethe with,health care-related information underlisted (d)in of this subsection that(2)(c); is maintained by:

(d) Information originating from, and intermingled to be indistinguishable with, information under (c) of this subsection that is maintained by:

(f)(e) Information used only for public health activities and purposes as described in 45 C.F.R.

(g)(i)(f)(i) An activity involving the collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency, as defined in Title 15 U.S.C.

1681a1681a(d), (d), and by a user of a consumer report, as set forth in Title 15 U.S.C.

(ii) (e)(i)(d)(i) of this subsection applies only to the extent that such an activity involving the collection, maintenance, disclosure, sale, communication, or use of such information by that agency, furnisher, or user is subject to regulation under the fair credit reporting act, Title 15 U.S.C.

(h)(g) Personal data collected and maintained for purposes of chapter 43.71 RCW;

p.(h) Personal data collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley act (P.L.

9 SSB 5062 (i) Personal data collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley act (P.L.

(j)p. Personal data collected, processed, sold, or disclosed pursuant to the federal driver's privacy protection act of 1994 (18 U.S.C.

9 SB 5062 (i) Personal data collected, processed, sold, or disclosed pursuant to the federal driver's privacy protection act of 1994 (18 U.S.C.

(k)(j) Personal data regulated by the federal family education rights and privacy act, 20 U.S.C.

(l)(k) Personal data regulated by the student user privacy in education rights act, chapter 28A.604 RCW;

(m)(l) Personal data collected, processed, sold, or disclosed pursuant to the federal farm credit act of 1971 (as amended in 12 U.S.C.

or (n)(m) Data collected or maintained:

(ii) as the emergency contact information of an individual under (n)(i)(m)(i) of this subsection used solely for emergency contact purposes;

or (iii) that is necessary for the business to retain to administer benefits for another individual relating to the individual under (n)(i)(m)(i) of this subsection is used solely for the purposes of administering those benefits.

(2) A consumer has the right to correct inaccurate personal data concerning the consumer, taking into account the nature of the personal data and the purposes of the processing of the personal data.

10 SSBSB 5062 (2)(3) A consumer has the right to correctdelete inaccurate personal data concerning the consumer,consumer. taking into account the nature of the personal data and the purposes of the processing of the personal data.

(3) A consumer has the right to delete personal data concerning the consumer.

(b) Controllers may not require a consumer to create a new account in order to exercise a right, but a controller may require a consumer to use an existing account to exercise the consumer's rights under this chapter.

11 SSBSB 5062 (b)(3) ControllersA maycontroller notmust requirecomply with a consumerrequest to createexercise athe newright account in ordersection to103(5) exerciseof athis right,act butas asoon controlleras mayfeasibly requirepossible, abut consumerno tolater usethan an15 existingdays accountof toreceipt exerciseof the consumer'srequest. rights under this chapter.

(3) A controller must comply with a request to exercise the right in section 103(5) of this act as soon as feasibly possible, but no later than 15 days of receipt of the request.

(b) The appeal process must be conspicuously available and as easy to use as the process for submitting such a request under this section.

12 SSBSB 5062 (b)(c) TheWithin appeal30 processdays of receipt of an appeal, a controller must beinform conspicuouslythe availableconsumer andof asany easyaction totaken useor asnot thetaken processin forresponse submittingto suchthe appeal, along with a requestwritten underexplanation thisof section.the reasons in support thereof.

(c) Within 30 days of receipt of an appeal, a controller must inform the consumer of any action taken or not taken in response to the appeal, along with a written explanation of the reasons in support thereof.

and p.(b) Taking into account the nature of processing and the information available to the processor, the processor shall:

13Assist SSBthe 5062controller (b)in Takingmeeting intothe accountcontroller's obligations in relation to the naturesecurity of processing and the informationpersonal availabledata toand thein processor,relation to the processorp. shall:

Assist13 theSB controller5062 in meeting the controller's obligations in relation to the security of processing the personal data and in relation to the notification of a breach of the security of the system pursuant to RCW 19.255.010;

The controller and processor are each responsible for only the measures allocated to them.

and p.(ii) The processor shall allow for, and contribute to, reasonable audits and inspections by the controller or the controller's designated auditor.

14Alternatively, SSBthe 5062processor (ii)may, Thewith processorthe shallcontroller's allowconsent, for,arrange for a qualified and contributeindependent to,auditor reasonableto auditsconduct, andat inspectionsleast byannually and at the controllerprocessor's orexpense, an audit of the controller'sprocessor's designatedpolicies auditor.and technical and organizational p.

Alternatively,14 theSB processor5062 may, with the controller's consent, arrange for a qualified and independent auditor to conduct, at least annually and at the processor's expense, an audit of the processor's policies and technical and organizational measures in support of the obligations under this chapter using an appropriate and accepted control standard or framework and audit procedure for the audits as applicable, and provide a report of the audit to the controller upon request.

(b) If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller must clearly and conspicuously disclose the processing, as well as the manner in which a consumer may exercise the right to opt out of the processing, in a clear and conspicuous manner.

15 SSBSB 5062 (b)(2) IfA acontroller's controllercollection sellsof personal data to third parties or processes personal data for targeted advertising, the controller must clearlybe andlimited conspicuouslyto disclosewhat theis processing,reasonably asnecessary well as the manner in whichrelation ato consumer may exercise the rightpurposes tofor optwhich out of the processing,data inis aprocessed. clear and conspicuous manner.

(2) A controller's collection of personal data must be limited to what is reasonably necessary in relation to the purposes for which the data is processed.

A controller may not sell personal data to a third-party p.controller as part of such a program unless:

16 SSB 5062 controller as part of such a program unless:

and (c) the third party uses the personal data only for purposes of facilitatingp. such a benefit to which the consumer is entitled and does not retain or otherwise use or disclose the personal data for any other purpose.

(8)16 ExceptSB as5062 otherwisefacilitating providedsuch in this chapter, a controllerbenefit mayto notwhich processthe sensitive data concerning a consumer withoutis obtainingentitled theand consumer'sdoes consentnot or,retain inor theotherwise caseuse of the processing of sensitive data concerning a known child, without obtaining consent from the child's parent or lawfuldisclose guardian, in accordance with the children'spersonal onlinedata privacyfor protectionany actother requirements.purpose.

(8) Except as otherwise provided in this chapter, a controller may not process sensitive data concerning a consumer without obtaining the consumer's consent or, in the case of the processing of personal data concerning a known child, without obtaining consent from the child's parent or lawful guardian, in accordance with the children's online privacy protection act requirements.

or p.(c) Maintain data in identifiable form, or collect, obtain, retain, or access any data or technology, in order to be capable of associating an authenticated consumer request with personal data.

17(2) SSBThe 5062rights (c)contained Maintainin datasection in103 identifiable(1) form,through or(4) collect,of obtain,this retain,act ordo accessnot anyapply datato orpseudonymous technology,data in ordercases towhere bethe capablecontroller ofis associatingable anto authenticateddemonstrate consumerany requestinformation withnecessary personalto data.identify the p.

(2)17 TheSB rights5062 contained in section 103 (1) through (4) of this act do not apply to pseudonymous data in cases where the controller is able to demonstrate any information necessary to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing such information.

(2) Data protection assessments conducted under subsection (1) of this section must identify and weigh the benefits that may flow directly and indirectly from the processing to the controller, p.consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks.

18The SSBuse 5062of consumer,deidentified otherdata stakeholders, and the publicreasonable againstexpectations theof potentialconsumers, risksas towell as the rightscontext of the consumerprocessing associatedand withthe suchrelationship processing,between as mitigated by safeguards that can be employed by the controller toand reducethe suchconsumer risks.whose p.

The18 useSB of5062 deidentified data and the reasonable expectations of consumers, as well as the context of the processing and the relationship between the controller and the consumer whose personal data will be processed, must be factored into this assessment by the controller.

p.(d) Investigate, establish, exercise, prepare for, or defend legal claims;

19 SSB 5062 (d) Investigate, establish, exercise, prepare for, or defend legal claims;

(f)p. Take immediate steps to protect an interest that is essential for the life of the consumer or of another natural person, and where the processing cannot be manifestly based on another legal basis;

19 SB 5062 (f) Take immediate steps to protect an interest that is essential for the life of the consumer or of another natural person, and where the processing cannot be manifestly based on another legal basis;

(3) The obligations imposed on controllers or processors under this chapter do not apply where compliance by the controller or processor with this chapter would violate an evidentiary privilege under Washington law and do not prevent a controller or processor from providing personal data concerning a consumer to a person p.

20 SSBSB 5062 (3) The obligations imposed on controllers or processors under this chapter do not apply where compliance by the controller or processor with this chapter would violate an evidentiary privilege under Washington law and do not prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under Washington law as part of a privileged communication.

(ii) adequate, relevant, and limited p.to what is necessary in relation to the specific purpose or purposes listed in this section;

21and SSB(iii) 5062insofar toas whatpossible, istaking necessaryinto inaccount relationthe tonature and purpose of processing the specificpersonal purposedata, orsubjected purposesto listedreasonable inadministrative, thistechnical, section;and physical measures to protect the confidentiality, integrity, and accessibility p.

and21 (iii)SB insofar5062 as possible, taking into account the nature and purpose of processing the personal data, subjected to reasonable administrative, technical, and physical measures to protect the confidentiality, integrity, and accessibility of the personal data, and to reduce reasonably foreseeable risks of harm to consumers.

p.(5) A controller or processor found in violation of this chapter is subject to a civil penalty of up to $7,500 for each violation.

22 SSB 5062 (5) A controller or processor found in violation of this chapter is subject to a civil penalty of up to $7,500 for each violation.

(7)p. All receipts from the imposition of civil penalties under this chapter must be deposited into the consumer privacy account created in section 113 of this act.

22 SB 5062 (7) All receipts from the imposition of civil penalties under this chapter must be deposited into the consumer privacy account created in section 113 of this act.

(1) The state office of privacy and data protection, in collaboration with the office of the attorney general, shall research and examine existing analysis on the development of technology, such as a browser setting, browser extension, or global device setting, indicating a consumer's affirmative, freely given, and unambiguous choice to opt out of the processing of personal data for the purposes of targeted advertising, p.the sale of personal data, or profiling in furtherance of decisions that produce legal effects concerning consumers or similarly significant effects concerning consumers.

23 SSB 5062 the sale of personal data, or profiling in furtherance of decisions that produce legal effects concerning consumers or similarly significant effects concerning consumers.

(2) The office of privacy and data protection shall submit a report of its findings and will identify specific recommendations to thep. governor and the appropriate committees of the legislature by December 1, 2022.

23 SB 5062 the governor and the appropriate committees of the legislature by December 1, 2022.

p.(6) "Controller" means the natural or legal person that, alone or jointly with others, determines the purposes and means of the processing of covered data.

24 SSB 5062 (6) "Controller" means the natural or legal person that, alone or jointly with others, determines the purposes and means of the processing of covered data.

(8)p. "Covered entity" has the same meaning as defined in Title 45 C.F.R.

24 SB 5062 (8) "Covered entity" has the same meaning as defined in Title 45 C.F.R.

p.(16) "Known child" means a child under circumstances where a controller has actual knowledge of, or willfully disregards, the child's age.

25 SSB 5062 (16) "Known child" means a child under circumstances where a controller has actual knowledge of, or willfully disregards, the child's age.

"Personalp. data" does not include deidentified data or publicly available information.

25 SB 5062 "Personal data" does not include deidentified data or publicly available information.

p.(26) "Third party" means a natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or the controller.

26 SSB 5062 (26) "Third party" means a natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or the controller.

(1)p. Process covered data for a covered purpose unless:

26 SB 5062 (1) Process covered data for a covered purpose unless:

(3) In the case of processing personal data concerning a consumer subject to guardianship, conservatorship, or other protective p.arrangement under chapter 11.88, 11.92, or 11.130 RCW, the guardian or the conservator of the consumer may exercise the rights of this chapter on the consumer's behalf.

27 SSB 5062 arrangement under chapter 11.88, 11.92, or 11.130 RCW, the guardian or the conservator of the consumer may exercise the rights of this chapter on the consumer's behalf.

(1) Except as provided in this chapter, controllers that process covered data for a coveredp. purpose must comply with a request to exercise the rights pursuant to section 203 of this act.

27 SB 5062 covered purpose must comply with a request to exercise the rights pursuant to section 203 of this act.

The p.controller bears the burden of demonstrating the manifestly unfounded or excessive character of the request.

28 SSB 5062 controller bears the burden of demonstrating the manifestly unfounded or excessive character of the request.

In such a case, the controller may requestp. the provision of additional information reasonably necessary to authenticate the request.

28 SB 5062 request the provision of additional information reasonably necessary to authenticate the request.

p.NEW SECTION.

29 SSB 5062 NEW SECTION.

(a)p. Taking into account the nature of the processing, the processor shall assist the controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the controller's obligation to respond to consumer requests to exercise their rights pursuant to section 203 of this act;

and29 (b)SB 5062 (a) Taking into account the nature of processing and the informationprocessing, available to the processor, the processor shall assist the controller inby meetingappropriate thetechnical controller'sand obligationsorganizational inmeasures, relationinsofar toas thethis securityis ofpossible, processingfor the personalfulfillment dataof andthe incontroller's relationobligation to therespond notificationto ofconsumer arequests breachto ofexercise thetheir securityrights ofpursuant theto systemsection pursuant203 toof RCWthis 19.255.010.act;

and (b) Taking into account the nature of processing and the information available to the processor, the processor shall:

Assist the controller in meeting the controller's obligations in relation to the security of processing the personal data and in relation to the notification of a breach of the security of the system pursuant to RCW 19.255.010;

and provide information to the controller necessary to enable the controller to conduct and document any data protection assessments required by section 109 of this act.

In addition, the contract must include the requirements p.imposed by this subsection and subsections (3) and (4) of this section, as well as the following requirements:

30(a) SSBAt 5062the imposedchoice byof thisthe subsectioncontroller, andthe subsectionsprocessor (3)shall anddelete (4)or ofreturn thisall section,personal asdata wellto the controller as requested at the followingend requirements:p.

(a)30 AtSB the5062 choice of the controller, the processor shall delete or return all personal data to the controller as requested at the end of the provision of services, unless retention of the personal data is required by law;

p.(a) How a consumer may exercise the rights contained in section 203 of this act, including how a consumer may appeal a controller's action with regard to the consumer's request;

31 SSB 5062 (a) How a consumer may exercise the rights contained in section 203 of this act, including how a consumer may appeal a controller's action with regard to the consumer's request;

(c)p. The purposes for which the categories of covered data are processed;

31 SB 5062 (c) The purposes for which the categories of covered data are processed;

(2) A controller's collection of covered data must be limited to what is reasonably necessary in relation to the covered purposespurpose s for which the data is processed.

p.or (e) the goods, services, facilities, privileges, advantages, or accommodations of any place of public accommodation.

32(8) SSBAny 5062provision of a contract or (e)agreement theof goods,any services,kind facilities,that privileges,purports advantages,to waive or accommodationslimit ofin any placeway ofa publicconsumer's accommodation.rights under this p.

(8)32 AnySB provision5062 of a contract or agreement of any kind that purports to waive or limit in any way a consumer's rights under this chapter is deemed contrary to public policy and is void and unenforceable.

or p.(iv) Information that is (A) deidentified in accordance with the requirements for deidentification set forth in 45 C.F.R.

33 SSB 5062 (iv) Information that is (A) deidentified in accordance with the requirements for deidentification set forth in 45 C.F.R.

164,102, and (B) derived from any of the health care-related information listed in this subsection (2)(a);

(b)p. Information originating from, and intermingled to be indistinguishable with, information under (a) of this subsection that is maintained by:

33 SB 5062 (b) Information originating from, and intermingled to be indistinguishable with, information under (a) of this subsection that is maintained by:

p.NEW SECTION.

34 SSB 5062 NEW SECTION.

(2)p. Rights possessed by consumers as of July 1, 2020, under chapter 19.86 RCW, the Washington state Constitution, the United States Constitution, or other laws are not altered.

34 SB 5062 (2) Rights possessed by consumers as of July 1, 2020, under chapter 19.86 RCW, the Washington state Constitution, the United States Constitution, or other laws are not altered.

p.NEW SECTION.

35 SSB 5062 NEW SECTION.

(1) Except as provided in this section, this chapter supersedes and preempts laws, ordinances, regulations,p. or the equivalent adopted by any local entity regarding the processing of covered data for a covered purpose by controllers or processors.

35 SB 5062 regulations, or the equivalent adopted by any local entity regarding the processing of covered data for a covered purpose by controllers or processors.

and (iii) except as provided in (b) of this p.subsection, contractually obligates any recipients of the information to comply with all provisions of this subsection.

36p. SSB 5062 subsection, contractually obligates any recipients of the information to comply with all provisions of this subsection.

36 SB 5062 (b) For the purposes of this subsection, the obligations imposed under (a)(iii) of this subsection do not apply when a controller discloses deidentified data to the public pursuant to chapter 42.56 RCW or other state disclosure laws.

(12) "Secure" means encrypted in a manner that meets or exceeds the national institute of standards and technology standard or is otherwise modified so that the technology-assisted contact tracing p.information is rendered unreadable, unusable, or undecipherable by an unauthorized person.

37p. SSB 5062 information is rendered unreadable, unusable, or undecipherable by an unauthorized person.

37 SB 5062 (13) "Sell" means the exchange of technology-assisted contact tracing information for monetary or other valuable consideration by the controller to a third party.

p.NEW SECTION.

38 SSB 5062 NEW SECTION.

(2)p. Processors are responsible under this chapter for adhering to the instructions of the controller and assisting the controller to meet its obligations under this chapter.

38 SB 5062 (2) Processors are responsible under this chapter for adhering to the instructions of the controller and assisting the controller to meet its obligations under this chapter.

(a) At the choice of the controller, the processor shall delete or return all technology-assisted contact tracing information to the controller as requested at the end of the provision of services, p.unless retention of the technology-assisted contact tracing information is required by law;

39p. SSB 5062 unless retention of the technology-assisted contact tracing information is required by law;

39 SB 5062 (b)(i) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations in this chapter;

(a) The categories of technology-assisted contact tracing information processed by the controller;

40 SSBSB 5062 (a)(b) The purposes for which the categories of technology-assisted contact tracing information processedare byprocessed; the controller;

(b) The purposes for which the categories of technology-assisted contact tracing information are processed;

(7) A controller may not process technology-assisted contact tracing information on the basis of an individual's or a class of individuals' actual or perceived race, color, ethnicity, religion, national origin, sex, gender, gender identity, sexual orientation, p.

41 SSBSB 5062 individuals' actual or perceived race, color, ethnicity, religion, national origin, sex, gender, gender identity, sexual orientation, familial status, lawful source of income, or disability, in a manner that unlawfully discriminates against the individual or class of individuals with respect to the offering or provision of:

p.(b) Technology-assisted contact tracing information that is processed by a controller pursuant to this section may be processed solely to the extent that such processing is:

42(i) SSBNecessary, 5062p. (b) Technology-assisted contact tracing information that is processed by a controller pursuant to this section may be processed solely to the extent that such processing is:

(i)42 Necessary,SB 5062 reasonable, and proportionate to the purposes listed in this section;

PART 4 Miscellaneous p.NEW SECTION.

43 SSB 5062 NEW SECTION.

(2)p. Sections 201 through 211 of this act constitute a new chapter in Title 19 RCW.

43 SB 5062 (2) Sections 201 through 211 of this act constitute a new chapter in Title 19 RCW.

SectionsThis 101chapter throughdoes 114 of this act do not apply to institutions of higher educationeducation, air carriers, or nonprofit corporations until July 31, 2026.

44 SSBSB 5062