SB 5919 — Concerning consumer protection of internet privacy.

S-3445.2SUBSTITUTES-2519.2SENATE SENATE BILL 5919State of Washington65th Legislature2018Legislature2017 Regular SessionBy Senate Energy, Environment & Technology (originally sponsored by Senators Ranker, Fain, Miloscia, Rivers, Rossi, Billig, Carlyle, Brown, Rolfes, Frockt, Hasegawa, Conway, Warnick, Darneille, Pedersen, Keiser, Zeiger, Baumgartner, Cleveland, Chase, Kuderer, Takko, McCoy, Hunt, Nelson, Saldaña, Fortunato, Liias, Short, Mullet, Palumbo, Wellman, Hobbs, Pearson, and Sheldon)READSheldonRead FIRSTfirst TIMEtime 02/02/18.AN04/05/17. ACT Relating to protecting the privacy and security of internet users;

addingReferred ato newCommittee chapteron Energy, Environment & Telecommunications.AN ACT Relating to Titleconsumer 19protection RCW;of internet privacy;

providingand anadding effectivenew date;sections to chapter 43.105 RCW.BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:NEW SECTION.  Sec. 1.  A new section is added to chapter 43.105 RCW to read as follows:No telecommunications or internet service provider that has entered into a franchise agreement, right-of-way agreement, or other contract with the state of Washington or a political subdivision, or that uses facilities that are subject to such agreements, even if it is not a party to the agreement, may collect personal information from a customer resulting from the customer's use of the telecommunications or internet service provider without express written approval from the customer.

andA providingtelecommunications aor contingentinternet expirationservice date.BEprovider ITmay ENACTEDnot BYrefuse THEto LEGISLATUREprovide OFits THEservices STATEto OFa WASHINGTON:NEWcustomer SECTION.  Sec. 1.  Theon definitionsthe ingrounds thisthat sectionthe applycustomer throughouthas thisnot chapterapproved unlesscollection of the contextcustomer's clearlypersonal requiresinformation.NEW otherwise.(1)SECTION.  Sec. 2.  A "Broadbandnew internetsection accessis service"added orto "BIAS"chapter means43.105 aRCW massto marketread retailas servicefollows:The bylegislature wirefinds or radio that provides the capabilitypractices tocovered transmitby datasection to1 andof receivethis dataact fromare allmatters orvitally substantiallyaffecting allthe internetpublic endpoints,interest includingfor any capabilities that are incidental to and enable the operationpurpose of applying the communicationsconsumer service,protection butact, excludingchapter dial-up19.86 internetRCW. access service.

ThisA termviolation alsoof encompassessection any1 serviceof thatthis theact federalis communicationsnot commissionreasonable findsin relation to bethe providingdevelopment aand functionalpreservation equivalent of thebusiness serviceand describedconstitutes inan thisunfair subsection.(2)or "Broadbanddeceptive internetact accessor servicepractice provider"in the conduct of trade or "BIAScommerce provider"and meansan aunfair personmethod engagedof incompetition thefor provisionpurposes of BIAS.(3)applying "Customer"the means:consumer protection act, chapter 19.86 RCW.--- END ---

(a) A current or former subscriber to a BIAS;

or (b) an applicant for a BIAS.(4) "Customer proprietary information" means any of the following a BIAS provider acquires in connection with its provision of BIAS:(a) Content of text or voice communication;(b) Call detail information;(c) Financial information;(d) Health information;(e) Information pertaining to children;(f) Social security numbers;(g) Precise geolocation information;

and(h) Other personally identifiable information, which consists of any information that is linked or reasonably linkable to an individual.(5) "Opt-in approval" means affirmative, express customer consent to an activity under section 2 of this act, after the customer is provided appropriate notification in accordance with relevant federal trade commission and federal communications commission requirements.NEW SECTION.  Sec. 2.  (1) Except with the opt-in approval of the customer, a BIAS provider may not:(a) Sell or transfer customer proprietary information;

or(b) Send or display to a customer an advertisement selected to be sent or displayed based on the customer's proprietary information.(2) A BIAS provider must solicit the approval required under subsection (1) of this section at the point of sale.

A BIAS provider must obtain new approval for any changes in the actions described in subsection (1) of this section, if those changes are inconsistent with the terms or conditions provided at the time of prior customer approval.(3) A BIAS provider must provide access to a mechanism that is reasonably designed to be readily available and understandable for a customer to grant, deny, or withdraw approval for the BIAS provider to take any of the actions described in subsection (1) of this section.

The exact notice and mechanism to obtain opt-in approval or to deny or withdraw that approval is context dependent.(4) For the purposes of this section, "transfer" does not include the use or disclosure of customer proprietary information for the provision of internet access service from which such information is derived or the provision of services necessary to, or used in, the provision of such services.(5) Subsection (1)(a) of this section does not apply to the sale or transfer of customer proprietary information as part of any merger, acquisition, sale of all, or substantially all, company assets, or transition of service to another provider.NEW SECTION.  Sec. 3.  (1) A BIAS provider must not condition, or effectively condition, provision of BIAS on a customer's agreement to waive privacy rights guaranteed by law or rule, including this chapter.

A BIAS provider must not terminate service or otherwise refuse to provide BIAS as a direct or indirect consequence of a customer's refusal to waive any such privacy rights.(2) A BIAS provider that offers a financial incentive in exchange for any customer approvals described in section 2(1) of this act must provide the customer with the terms and conditions of the use of the customer proprietary information, including the type of information sought, the purposes of its use, and the categories of entities to which the information may be disclosed.(3) For any customer that has agreed to participate in a financial incentive program as described in subsection (2) of this section, a BIAS provider must provide access to a mechanism for customers to withdraw participation from such a program at any time.NEW SECTION.  Sec. 4.  The utilities and transportation commission is authorized to adopt rules, consistent with the purposes of this chapter, that do either or both of the following:(1) Further define the definitions in section 1 of this act;

and(2) Prescribe appropriate notice and the form of such a notice to be provided to customers under sections 2 and 3 of this act.NEW SECTION.  Sec. 5.  The legislature finds that the practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW.

Notwithstanding the provisions of RCW 19.86.170, a violation of this chapter, including the violation of any rule adopted by the utilities and transportation commission pursuant to section 4 of this act, is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

A violation of this chapter by a public service company providing broadband internet access service may be subject to enforcement by the utilities and transportation commission under Title 80 RCW.NEW SECTION.  Sec. 6.  The consumer privacy and security account is created in the state treasury.

All receipts from recoveries by the office of the attorney general for lawsuits related to the consumer protection act under the provisions of this chapter, or otherwise designated to this account, must be deposited into the account.

Moneys in the account may be spent only after appropriation.

Expenditures from the account may be used only for costs incurred by the office of the attorney general in the administration and enforcement of this chapter.NEW SECTION.  Sec. 7.  Sections 1 through 6 of this act expire upon determination by the utilities and transportation commission that the federal government has established BIAS customer protections standards substantially equivalent to the levels of protection provided in this chapter.

The utilities and transportation commission must provide notice of the expiration date of sections 1 through 6 of this act to affected parties, the chief clerk of the house of representatives, the secretary of the senate, the office of the code reviser, and others as deemed appropriate by the utilities and transportation commission.NEW SECTION.  Sec. 8.  Sections 1 through 7 of this act take effect December 31, 2019.NEW SECTION.  Sec. 9.  Sections 1 through 7 of this act constitute a new chapter in Title 19 RCW.--- END ---