Washington 2019-2020 Regular Session Status: Passed Senate 6 D cosponsors

SB 5376 — Protecting consumer data.

Last action — Senate Rules "X" file.

  1. ✓
    Introduced
  2. ✓
    In Committee
  3. 3
    Passed Senate
  4. 4
    Passed House
  5. 5
    To Executive
  6. 6
    Enacted

This bill died with 2019-2020 Regular Session. It reached “Passed Senate” and never advanced before the session ended, so it can no longer move — a new version would have to be reintroduced in the current session.

This bill is no longer active — its legislative session has ended, so there is no live prognosis. It would have to be reintroduced in the current session to move again.

Bill Text

What changed in the latest version

1 added · 1 removed

Plain-language change summary

The changes to SB 5376 primarily enhance privacy protections for individuals in Washington regarding their personal data. Key additions include stricter regulations around the use of facial recognition technology, ensuring that consumers must provide explicit consent before it's deployed, and that any profiling involving such technology undergoes meaningful human review. These updates are important because they aim to safeguard individual privacy rights in an era of increasing digital surveillance and data collection, giving consumers more control over how their personal information is used and shared.

→
Previous
Latest
S-2412.1SECOND SUBSTITUTE SENATE BILL 5376State of Washington66th Legislature2019 Regular SessionBySenate Ways & Means (originally sponsored by Senators Carlyle, Palumbo, Wellman, Mullet, Pedersen, Billig, Hunt, Liias, Rolfes, Saldaña, Hasegawa, and Keiser)READ FIRST TIME 03/01/19.AN ACT Relating to the management and oversight of personal data;
S-0472.4SENATE BILL 5376State of Washington66th Legislature2019 Regular SessionBySenators Carlyle, Palumbo, Wellman, Mullet, Pedersen, Billig, Hunt, Liias, Rolfes, Saldaña, Hasegawa, and KeiserRead first time 01/18/19.Referred to Committee on Environment, Energy & Technology.AN ACT Relating to the management and oversight of personal data;
DEFINITIONS.The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.(1) "Affiliate" means a legal entity that controls, is controlled by, or is under common control with, another legal entity.(2) "Business associate" has the same meaning as in Title 45 C.F.R., established pursuant to the federal health insurance portability and accountability act of 1996.(3) "Business purpose" means the processing of personal data for the controller's or its processor's operational purposes, or other notified purposes, provided that the processing of personal data must be reasonably necessary and proportionate to achieve the operational purposes for which the personal data was collected or processed or for another operational purpose that is compatible with the context in which the personal data was collected.
DEFINITIONS.The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.(1) "Affiliate" means a legal entity that controls, is controlled by, or is under common control with, another legal entity.(2) "Consent" means a clear affirmative act establishing a freely given, specific, informed, and unambiguous indication of a consumer's agreement to the processing of personal data relating to the consumer, such as by a written statement or other clear affirmative action.(3) "Consumer" means a natural person who is a Washington resident.
Business purposes include:(a) Auditing related to a current interaction with the consumer and concurrent transactions including, but not limited to, counting ad impressions, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;(b) Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;(c) Identifying and repairing errors that impair existing or intended functionality;(d) Short-term, transient use, provided the personal data is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer's experience outside the current interaction including, but not limited to, the contextual customization of ads shown as part of the same interaction;(e) Maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, or providing financing;(f) Undertaking internal research for technological development;
It does not include an employee or contractor of a business acting in their role as an employee or contractor.(4) "Controller" means the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data.(5) "Data broker" means a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship.(6) "Deidentified data" means:(a) Data that cannot be linked to a known natural person without additional information kept separately;
or(g) Authenticating a consumer's identity.(4) "Child" means any natural person under thirteen years of age.(5) "Consent" means a clear affirmative act signifying a specific, informed, and unambiguous indication of a consumer's agreement to the processing of personal data relating to the consumer, such as by a written statement or other clear affirmative action.(6) "Consumer" means a natural person who is a Washington resident acting only in an individual or household context.
It does not include a natural person acting in a commercial or employment context.(7) "Controller" means the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data.(8) "Covered entity" has the same meaning as in Title 45 C.F.R., established pursuant to the federal health insurance portability and accountability act of 1996.(9)(a) "Data broker" means a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship.(b) Providing publicly available information through real-time or near real-time alert services for health or safety purposes, and the collection and sale or licensing of brokered personal information incidental to conducting those activities, does not qualify the business as a data broker.(c) The phrase "sells or licenses" does not include:(i) A one-time or occasional sale of assets that is not part of the ordinary conduct of the business;(ii) A sale or license of data that is merely incidental to the business;
or(iii) Providing 411 directory assistance or directory information services, including name, address, and telephone number, on behalf of or as a function of a telecommunications carrier.(10) "Deidentified data" means:(a) Data that cannot be linked to a known natural person without additional information kept separately;
Enforceable controls to prevent reidentification may include legal, administrative, technical, or contractual controls.(11) "Developer" means a person who creates or modifies the set of instructions or programs instructing a computer or device to perform tasks.(12) "Health care facility" has the same meaning as in RCW 70.02.010.(13) "Health care information" has the same meaning as in RCW 70.02.010.(14) "Health care provider" has the same meaning as in RCW 70.02.010.(15) "Identified or identifiable natural person" means a person who can be readily identified, directly or indirectly.(16) "Personal data" means any information that is linked or reasonably linkable to an identified or identifiable natural person.
Enforceable controls to prevent reidentification may include legal, administrative, technical, or contractual controls.(7) "Developer" means a person who creates or modifies the set of instructions or programs instructing a computer or device to perform tasks.(8) "Identified or identifiable natural person" means a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, specific geolocation data, or an online identifier.(9) "Minor" means any person under eighteen years of age.(10) "Personal data" means any information relating to an identified or identifiable natural person.
Personal data does not include deidentified data or publicly available information.
Personal data does not include deidentified data.(11) "Process" or "processing" means any operation or set of operations that is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, deletion, or destruction.(12) "Processor" means a natural or legal person which processes personal data on behalf of the controller.(13) "Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.(14) "Restriction of processing" means the marking of stored personal data with the aim of limiting the processing of such personal data in the future.(15)(a) "Sale" means the exchange of personal data for monetary consideration by the controller to a third party for purposes of licensing or selling personal data at the third party's discretion to additional third parties.(b) "Sale" does not include the following:
For these purposes, "publicly available information" means information that is lawfully made available from federal, state, or local government records.(17) "Process" or "processing" means any collection, use, storage, disclosure, analysis, deletion, or modification of personal data.(18) "Processor" means a natural or legal person that processes personal data on behalf of the controller.(19) "Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.(20) "Protected health information" has the same meaning as in Title 45 C.F.R., established pursuant to the federal health insurance portability and accountability act of 1996.(21) "Restriction of processing" means the marking of stored personal data with the aim of limiting the processing of such personal data in the future.(22)(a) "Sale," "sell," or "sold" means the exchange of personal data for monetary consideration by the controller to a third party for purposes of licensing or selling personal data at the third party's discretion to additional third parties.(b) "Sale" does not include the following:
(ii) the disclosure of personal data to a third party with whom the consumer has a direct relationship for purposes of providing a product or service requested by the consumer or otherwise in a manner that is consistent with a consumer's reasonable expectations considering the context in which the consumer provided the personal data to the controller;
or (ii) the disclosure of personal data to a third party with whom the consumer has a direct relationship for purposes of providing a product or service requested by the consumer or otherwise in a manner that is consistent with a consumer's reasonable expectations considering the context in which the consumer provided the personal data to the controller.(16) "Sensitive data" means personal data revealing racial or ethnic origin, religious or philosophical beliefs, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning a minor, data concerning health, or data concerning a natural person's sex life or sexual orientation.(17) "Targeted advertising" means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred over time from a consumer's activities across nonaffiliate web sites, applications, or online services.
(iii) the disclosure or transfer of personal data to an affiliate of the controller;
It does not include advertising to a consumer based upon the consumer's current visit to a web site, application, or online service, or in response to the consumer's request for information or feedback.NEW SECTION.  Sec.
or (iv) the disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller's assets.(23) "Sensitive data" means (a) personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, or sex life or sexual orientation;
(b) the processing of genetic or biometric data for the purpose of uniquely identifying a natural person;
or (c) the personal data of a known child.(24) "Targeted advertising" means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred over time from a consumer's activities across nonaffiliated web sites, applications, or online services to predict user preferences or interests.
It does not include advertising to a consumer based upon the consumer's visits to a web site, application, or online service that a reasonable consumer would believe to be associated with the publisher where the ad is placed based on common branding, trademarks, or other indicia of common ownership, or in response to the consumer's request for information or feedback.(25) "Third party" means a natural or legal person, public authority, agency, or body other than the consumer, controller, or an affiliate of the processor of the controller.(26) "Verified request" means the process through which a consumer may submit a request to exercise a right or rights set forth in this chapter, and by which a controller can reasonably authenticate the request and the consumer making the request using commercially reasonable means.NEW SECTION.  Sec.
JURISDICTIONAL SCOPE.(1) This chapter applies to legal entities that conduct business in Washington or produce products or services that are intentionally targeted to residents of Washington, and that satisfy one or more of the following thresholds:(a) Controls or processes personal data of one hundred thousand consumers or more;
JURISDICTIONAL SCOPE.(1) This chapter applies to legal entities that conduct business in Washington or produce products or services that are intentionally targeted to residents of Washington, and that satisfy one or more of the following thresholds:(a) Controls or processes data of one hundred thousand consumers or more;
or(b) Derives over fifty percent of gross revenue from the sale of personal data and processes or controls personal data of twenty-five thousand consumers or more.(2) This chapter does not apply to:(a) State and local governments;(b) Municipal corporations;(c) Information that meets the definition of:(i) Protected health information for purposes of the federal health insurance portability and accountability act of 1996 and related regulations;(ii) Health care information for purposes of chapter 70.02 RCW;(iii) Patient identifying information for purposes of 42 C.F.R.
or(b) Derives over fifty percent of gross revenue from the sale of personal information and processes or controls personal information of twenty-five thousand consumers or more.(2) This chapter does not apply to:(a) State and local governments;(b) Personal data sets to the extent that they are regulated by the federal health insurance portability and accountability act of 1996, the federal health information technology for economic and clinical health act, or the Gramm-Leach-Bliley act of 1999;
Part 2, established pursuant to 42 U.S.C.
or(c) Data sets maintained for employment records purposes.NEW SECTION.  Sec.
Sec.
290 dd-2;(iv) Identifiable private information for purposes of the federal policy for the protection of human subjects, 45 C.F.R.
Part 46, or identifiable private information that is otherwise information collected as part of human subjects research pursuant to the good clinical practice guidelines issued by the international council for harmonisation, or the protection of human subjects under 21 C.F.R.
Parts 50 and 56;(v) Information and documents created specifically for, and collected and maintained by:(A) A quality improvement committee for purposes of RCW 43.70.510, 70.230.080, or 70.41.200;(B) A peer review committee for purposes of RCW 4.24.250;(C) A quality assurance committee for purposes of RCW 74.42.640 or 18.20.390;(D) A hospital, as defined in RCW 43.70.056, for reporting of health care-associated infections for purposes of RCW 43.70.056, a notification of an incident for purposes of RCW 70.56.040(5), or reports regarding adverse events for purposes of RCW 70.56.020(2)(b);(vi) Information and documents created for purposes of the federal health care quality improvement act of 1986, and related regulations;
or(vii) Patient safety work product information for purposes of 42 C.F.R.
Part 3, established pursuant to 42 U.S.C.
Sec.
299b-21-26;(d) Information maintained in the same manner as information under (c) of this subsection by:(i) A covered entity or business associate as defined by the health insurance portability and accountability act of 1996 and related regulations;(ii) A health care facility or health care provider as defined in RCW 70.02.010;
or(iii) A program or a qualified service organization as defined by 42 C.F.R.
Part 2, established pursuant to 42 U.S.C.
Sec.
290 dd-2;(e) Personal data provided to, from, or held by a consumer reporting agency as defined by 15 U.S.C.
Sec.
1681a(f), and use of that data is in compliance with the federal fair credit reporting act (15 U.S.C.
Sec.
1681 et seq.);(f) Personal data collected, processed, sold, or disclosed pursuant to the federal Gramm Leach Bliley act (P.L.
106-102), and implementing regulations, if the collection, processing, sale, or disclosure is in compliance with that law;(g) Personal data collected, processed, sold, or disclosed pursuant to the federal driver's privacy protection act of 1994 (18 U.S.C.
Sec.
2721 et seq.), if the collection, processing, sale, or disclosure is in compliance with that law;
or(h) Data maintained for employment records purposes.NEW SECTION.  Sec.
RESPONSIBILITY ACCORDING TO ROLE.(1) Controllers are responsible for meeting the obligations established under this chapter.(2) Processors are responsible under this act for adhering to the instructions of the controller and assisting the controller to meet its obligations under this chapter.(3) Processing by a processor is governed by a contract between the controller and the processor that is binding on the processor and that sets out the processing instructions to which the processor is bound.NEW SECTION.  Sec.
RESPONSIBILITY ACCORDING TO ROLE.(1) Controllers shall be responsible for meeting the obligations set forth under this act.(2) Processors are responsible under this act for adhering to the instructions of the controller and assisting the controller to meet its obligations under this chapter.(3) Processing by a processor shall be governed by a contract between the controller and the processor that is binding on the processor and that sets out the processing instructions to which the processor is bound.NEW SECTION.  Sec.
CONSUMER RIGHTS.Controllers shall facilitate verified requests to exercise the consumer rights set forth in subsections (1) through (6) of this section.(1) Upon a verified request from a consumer, a controller must confirm whether or not personal data concerning the consumer is being processed by the controller, including whether such personal data is sold to data brokers, and, where personal data concerning the consumer is being processed by the controller, provide access to such personal data that the controller maintains in identifiable form concerning the consumer.(a) Upon a verified request from a consumer, a controller must provide a copy of the personal data that the controller maintains in identifiable form undergoing processing.
CONSUMER RIGHTS.Controllers shall facilitate requests to exercise the consumer rights set forth in subsections (1) through (7) of this section.(1) On request from a consumer, a controller must confirm whether or not personal data concerning the consumer is being processed by the controller, including whether such personal data is sold to data brokers, and, where personal data concerning the consumer is being processed by the controller, provide access to such personal data concerning the consumer.(a) On request from a consumer, a controller must provide a copy of the personal data undergoing processing.
Show all 75 changed rows (35 more)
Previous
Latest
Where the consumer makes the request by electronic means, and unless otherwise requested by the consumer, the information must be provided in a commonly used electronic form.(b) This subsection does not adversely affect the rights or freedoms of others.(2) Upon a verified request from a consumer, the controller, without undue delay, must correct inaccurate personal data that the controller maintains in identifiable form concerning the consumer.
Where the consumer makes the request by electronic means, and unless otherwise requested by the consumer, the information must be provided in a commonly used electronic form.(b) This subsection shall not adversely affect the rights of consumers.(2) On request from a consumer, the controller, without undue delay, must correct inaccurate personal data concerning the consumer.
Taking into account the business purposes of the processing, the controller must complete incomplete personal data, including by means of providing a supplementary statement where appropriate.(3)(a) Upon a verified request from a consumer, a controller must delete, without undue delay, the consumer's personal data that the controller maintains in identifiable form if one of the following grounds applies:(i) The personal data is no longer necessary for a business purpose, including the provision of a product or service to the consumer;(ii) For processing that requires consent under section 8(3) of this act, the consumer withdraws consent to processing and there are no business purposes for the processing;(iii) The consumer objects to the processing pursuant to subsection (6) of this section and (A) there are no business purposes for processing the personal data for the controller, the consumer whose personal data is being processed, or the public, for which the processing is necessary;
Taking into account the purposes of the processing, the controller must complete incomplete personal data, including by means of providing a supplementary statement.(3)(a) On request from a consumer, a controller must delete the consumer's personal data without undue delay where one of the following grounds applies:(i) The personal data is no longer necessary in relation to the purposes for which the personal data was collected or otherwise processed;(ii) For processing that requires consent under section 8(3) of this act, the consumer withdraws consent to processing and there are no other legitimate grounds for the processing;(iii) The consumer objects to the processing pursuant to subsection (6) of this section and (A) there are no overriding legitimate grounds for the processing;
or (B) the processing is for targeted advertising;(iv) The personal data has been unlawfully processed;
or (B) the processing is for direct marketing purposes;(iv) The personal data has been unlawfully processed;(v) The personal data must be deleted to comply with a legal obligation under federal, state, or local law to which the controller is subject;
or(v) The personal data must be deleted to comply with a legal obligation under federal, state, or local law to which the controller is subject.(b) Where the controller is obliged to delete personal data that the controller maintains in identifiable form under this section that has been disclosed to third parties by the controller, including data brokers that received the personal data through a sale, the controller must take reasonable steps, which may include technical measures, to inform other controllers of which it is aware that are processing such personal data, and that received such personal data from the controller or are processing such personal data on behalf of the controller, that the consumer has requested the deletion by the other controllers of any links to, or copy or replication of, the personal data.
or(vi) The personal data has been collected in relation to the offer of a service normally provided for remuneration, at a distance, by electronic means, and at the individual request of the recipient of services.(b) Where the controller is obliged to delete personal data under this section that has been disclosed to third parties by the controller, including data brokers that received the data through a sale, the controller must take reasonable steps, which may include technical measures, to inform other controllers that are processing the personal data that the consumer has requested the deletion by the other controllers of any links to, or copy or replication of, the personal data.
Compliance with this obligation must take into account available technology and cost of implementation.(c) This subsection does not apply to the extent processing is necessary:(i) For exercising the right of free speech;(ii) For compliance with a legal obligation that requires processing of personal data by federal, state, or local law, or regulation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;(iii) For reasons of public interest in the area of public health, where the processing (A) is subject to suitable and specific measures to safeguard the rights of the consumer;
Compliance with this obligation must take into account available technology and cost of implementation.(c) This subsection does not apply to the extent processing is necessary:(i) For exercising the right of free speech;(ii) For compliance with a legal obligation that requires processing by federal, state, or local law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;(iii) For reasons of public interest in the area of public health, where the processing (A) is subject to suitable and specific measures to safeguard the rights of the consumer;
and (B) is under the responsibility of a professional subject to confidentiality obligations under federal, state, or local law;(iv) For archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, where the deletion of such personal data is likely to render impossible or seriously impair the achievement of the objectives of the processing;(v) For the establishment, exercise, or defense of legal claims;(vi) To detect or respond to security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or identify, investigate, or prosecute those responsible for that activity;
and (B) is processed by or under the responsibility of a professional subject to confidentiality obligations under federal, state, or local law;(iv) For archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, where the deletion of such personal data is likely to render impossible or seriously impair the achievement of the objectives of the processing;
or(vii) For a data broker that received the personal data from third parties and is acting as a controller, solely to prevent the personal data from reappearing in the future, in which case the controller shall instead comply with the requirements in subsection (4) of this section.(4)(a) Upon a verified request from a consumer, the controller must restrict processing of personal data that the controller maintains in identifiable form if the purpose for which the personal data is (i) not consistent with a purpose for which the personal data was collected;
or(v) For the establishment, exercise, or defense of legal claims.(4)(a) On request from a consumer, the controller must restrict processing if one of the following grounds applies:(i) The accuracy of the personal data is contested by the consumer, for a period enabling the controller to verify the accuracy of the personal data;(ii) The processing is unlawful and the consumer opposes the deletion of the personal data and requests the restriction of processing instead;(iii) The controller no longer needs the personal data for the purposes of the processing, but such personal data is required by the consumer for the establishment, exercise, or defense of legal claims;
(ii) not consistent with a purpose disclosed to the consumer at the time of collection or authorization;
or(iv) The consumer objects to the processing pursuant to subsection (6) of this section pending the verification of whether the legitimate grounds of the controller override those of the consumer.(b) Where personal data is subject to a restriction of processing under this subsection, the personal data must, with the exception of storage, only be processed (i) with the consumer's consent;
or (iii) unlawful.(b) Where personal data is subject to a restriction of processing under this subsection, the personal data must, with the exception of storage, only be processed (i) with the consumer's consent;
(iv) for reasons of important public interest under federal, state, or local law;
or (iv) for reasons of important public interest under federal, state, or local law.(c) A consumer who has obtained restriction of processing pursuant to this subsection must be informed by the controller before the restriction of processing is lifted.(5)(a) On request from a consumer, the controller must provide the consumer any personal data concerning such consumer that such consumer has provided to the controller in a structured, commonly used, and machine-readable format if (i)(A) the processing of such personal data requires consent under section 8(3) of this act, (B) the processing of such personal data is necessary for the performance of a contract to which the consumer is a party, or (C) in order to take steps at the request of the consumer prior to entering into a contract;
(v) to provide products or services requested by the consumer;
and (ii) the processing is carried out by automated means.(b) Controllers must transmit the personal data requested under this subsection directly from one controller to another, where technically feasible, and transmit the personal data to another controller without hindrance from the controller to which the personal data was provided.(c) Requests for personnel data under this subsection must be without prejudice to subsection (3) of this section.(d) The rights provided in this subsection do not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, and must not adversely affect the rights of others.(6)(a) A consumer may object, on grounds relating to the consumer's particular situation, at any time to processing of personal data concerning such consumer:(b) When a consumer objects to direct marketing, which includes the sale of personal data concerning the consumer to third parties for direct marketing purposes, profiling to the extent that it is related to such direct marketing and targeted advertising, the controller must no longer process the personal data subject to the objection for such purpose and must communicate the consumer's objection, unless it proves impossible or involves disproportionate effort, regarding any further processing of the consumer's personal data for such purposes to any third parties to whom the controller sold the consumer's personal data for such purposes.
or (vi) for another purpose set forth in subsection (3)(c) of this section.(c) A consumer who has obtained restriction of processing pursuant to this subsection must be informed by the controller before the restriction of processing is lifted.(5)(a) Upon a verified request from a consumer, the controller must provide to the consumer, if technically feasible and commercially reasonable, any personal data that the controller maintains in identifiable form concerning the consumer that such consumer has provided to the controller in a structured, commonly used, and machine-readable format if (i)(A) the processing of such personal data requires consent under section 8(3) of this act, (B) the processing of such personal data is necessary for the performance of a contract to which the consumer is a party, or (C) in order to take steps at the request of the consumer prior to entering into a contract;
Third parties must honor objection requests pursuant to this subsection received from third-party controllers.(c) If a consumer objects to processing for any purposes, other than direct marketing, the controller may continue processing the personal data subject to the objection if the controller can demonstrate a compelling legitimate ground to process such personal data.(7) A consumer must not be subject to a decision based solely on profiling which produces legal effects concerning such consumer or similarly significantly affects the consumer.
and (ii) the processing is carried out by automated means.(b) Requests for personal data under this subsection must be without prejudice to the other rights granted in this chapter.(c) The rights provided in this subsection do not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, and must not adversely affect the rights of others.(6)(a) A consumer may object through a verified request, on grounds relating to the consumer's particular situation, at any time to processing of personal data concerning such consumer.(b) When a consumer objects to the processing of their personal data for targeted advertising, which includes the sale of personal data concerning the consumer to third parties for purposes of targeted advertising, the controller must no longer process the personal data subject to the objection for such purpose and must take reasonable steps to communicate the consumer's objection, unless it proves impossible or involves disproportionate effort, regarding any further processing of the consumer's personal data for such purposes to any third parties to whom the controller sold the consumer's personal data for such purposes.
Legal or similarly significant effects include, but are be limited to, denial of consequential services or support, such as financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, and health care services.(a) This subsection does not apply if the decision is:(i) Necessary for entering into, or performance of, a contract between the consumer and a controller;(ii) Authorized by federal or state law to which the controller is subject and which incorporates suitable measures to safeguard the consumer's rights and legitimate interests, as indicated by the risk assessments required by section 8 of this act;
Third parties must honor objection requests pursuant to this subsection received from third-party controllers.(c) If a consumer objects to processing for any purposes, other than targeted advertising, the controller may continue processing the personal data subject to the objection if the controller can demonstrate a legitimate ground to process such personal data that overrides the potential risks to the rights of the consumer associated with the processing, or if another exemption in this chapter applies.(7) A controller must communicate any correction, deletion, or restriction of processing carried out in accordance with subsections (2), (3), or (4) of this section to each third-party recipient to whom the controller knows the personal data has been disclosed, including third parties that received the data through a sale, within one year preceding the verified request unless this proves functionally impractical, technically infeasible, or involves disproportionate effort, or the controller knows or is informed by the third party that the third party is not continuing to use the personal data.
or(iii) Based on the consumer's consent.(b) Notwithstanding (a) of this subsection, the controller shall implement suitable measures to safeguard consumer's rights and legitimate interests with respect to decisions based solely on profiling, including providing human review of the decision, to express the consumer's point of view with respect to the decision, and to contest the decision.(8) A controller must communicate any correction, deletion, or restriction of processing carried out in accordance with subsections (2), (3), or (4) of this section to each third-party recipient to whom the personal data has been disclosed, including third parties that received the data through a sale, unless this proves impossible or involves disproportionate effort.
The controller must inform the consumer about third-party recipients or categories with whom the controller shares personal information, if any, if the consumer requests such information.(8) A controller must provide information on action taken on a verified request under subsections (1) through (6) of this section without undue delay and in any event within thirty days of receipt of the request.
The controller must inform the consumer about such third-party recipients, if any, if the consumer requests such information.(9) A controller must provide information on action taken on a request under subsections (1) through (7) of this section without undue delay and in any event within thirty days of receipt of the request.
That period may be extended by sixty additional days where reasonably necessary, taking into account the complexity and number of the requests.
That period may be extended by sixty additional days where necessary, taking into account the complexity and number of the requests.
The controller bears the burden of demonstrating the manifestly unfounded or excessive character of the request.(c) Where the controller has reasonable doubts concerning the identity of the consumer making a request under subsections (1) through (6) of this section, the controller may request the provision of additional information necessary to confirm the identity of the consumer.NEW SECTION.  Sec.
The controller bears the burden of demonstrating the manifestly unfounded or excessive character of the request.(c) Where the controller has reasonable doubts concerning the identity of the consumer making a request under subsections (1) through (7) of this section, the controller may request the provision of additional information necessary to confirm the identity of the consumer.NEW SECTION.  Sec.
and(e) The categories of third parties, if any, with whom the controller shares personal data.(2) If a controller sells personal data to data brokers or processes personal data for targeted advertising, it must disclose such processing, as well as the manner in which a consumer may exercise the right to object to such processing, in a clear and conspicuous manner.NEW SECTION.  Sec.
and(e) The categories of third parties, if any, with whom the controller shares personal data.(2) Controllers that engage in profiling must disclose such profiling to the consumer at or before the time personal data is obtained, including meaningful information about the logic involved and the significance and envisaged consequences of the profiling.(3) If a controller sells personal data to data brokers or processes personal data for direct marketing purposes, including targeted marketing and profiling to the extent that it is related to such direct marketing, it must disclose such processing, as well as the manner in which a consumer may exercise the right to object to such processing, in a clear and prominent manner.NEW SECTION.  Sec.
RISK ASSESSMENTS.(1) Controllers must conduct, to the extent not previously conducted, a risk assessment of each of their processing activities involving personal data and an additional risk assessment any time there is a change in processing that materially increases the risk to consumers.
DOCUMENTED RISK ASSESSMENTS.(1) Controllers must conduct and document risk assessments covering the processing of personal data prior to the processing of such personal data whenever there is a change in processing that materially impacts the risk to individuals, and on at least an annual basis regardless of changes in processing.
Such risk assessments must take into account the type of personal data to be processed by the controller, including the extent to which the personal data is sensitive data or otherwise sensitive in nature, and the context in which the personal data is to be processed.(2) Risk assessments conducted under subsection (1) of this section must identify and weigh the benefits that may flow directly and indirectly from the processing to the controller, consumer, other stakeholders, and the public, against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks.
Risk assessments must take into account the type of personal data to be processed by the controller, including the extent to which the personal data is sensitive data or otherwise sensitive in nature, and the context in which the personal data is to be processed.(2) Risk assessments conducted under subsection (1) of this section must identify and weigh the benefits that may flow directly and indirectly from the processing to the controller, consumer, other stakeholders, and the public, against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks.
The use of deidentified data and the reasonable expectations of consumers, as well as the context of the processing and the relationship between the controller and the consumer whose personal data will be processed, must factor into this assessment by the controller.(3) If the risk assessment conducted under subsection (1) of this section determines that the potential risks of privacy harm to consumers are substantial and outweigh the interests of the controller, consumer, other stakeholders, and the public in processing the personal data of the consumer, the controller may only engage in such processing with the consent of the consumer or if another exemption under this chapter applies.
The use of deidentified data and the reasonable expectations of consumers must factor into this assessment by the controller.(3) If the risk assessment conducted under subsection (1) of this section determines that the potential risks to the rights of the consumer outweigh the interests of the controller, consumer, other stakeholders, and the public in processing the personal data of the consumer, the controller may only engage in such processing with the consent of the consumer.
To the extent the controller seeks consumer consent for processing, such consent shall be as easy to withdraw as to give.(4) Processing for a business purpose shall be presumed to be permissible unless:
Such consent shall be as easy to withdraw as to give.(4) The controller must make the risk assessment available to the attorney general upon request.
(a) It involves the processing of sensitive data;
and (b) the risk of processing cannot be reduced through the use of appropriate administrative and technical safeguards.(5) The controller must make the risk assessment available to the attorney general upon request.
EXEMPTIONS.(1) The obligations imposed on controllers or processors under this chapter do not restrict a controller's or processor's ability to:(a) Comply with federal, state, or local laws, rules, or regulations;(b) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities;(c) Cooperate with law enforcement agencies concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local law;(d) Investigate, exercise, or defend legal claims;(e) Prevent or detect identity theft, fraud, or other criminal activity or verify identities;(f) Perform a contract to which the consumer is a party or in order to take steps at the request of the consumer prior to entering into a contract;(g) Protect the vital interests of the consumer or of another natural person;(h) Perform a task carried out in the public interest or in the exercise of official authority vested in the controller;(i) Process personal data of a consumer for one or more specific purposes where the consumer has given their consent to the processing;
EXEMPTIONS.(1) The obligations imposed on controllers or processors under this chapter do not restrict a controller's or processor's ability to:(a) Comply with federal, state, or local laws;(b) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities;(c) Cooperate with law enforcement agencies concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local law;(d) Investigate, exercise, or defend legal claims;
or(j) Prevent, detect, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity;
or(e) Prevent or detect identity theft, fraud, or other criminal activity or verify identities.(2) The obligations imposed on controllers or processors under this chapter do not apply where compliance by the controller or processor with this chapter would violate an evidentiary privilege under Washington law and do not prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under Washington law as part of a privileged communication.(3) A controller or processor that discloses personal data to a third-party controller or processor in compliance with the requirements of this chapter is not in violation of this chapter, including under section 11 of this act, if the third-party recipient processes such personal data in violation of this chapter, provided that, at the time of disclosing the personal data, the disclosing controller or processor did not have actual knowledge that the third-party recipient intended to commit a violation.
preserve the integrity or security of systems;
A third-party recipient receiving personal data from a controller or processor is likewise not liable under this chapter, including under section 11 of this act, for the obligations of a controller or processor to which it provides services.(4) This chapter does not require a controller or processor to do the following:(a) Reidentify deidentified data;(b) Retain personal data concerning a consumer that it would not otherwise retain in the ordinary course of business;(c) Comply with a request to exercise any of the rights under section 6 (1) through (7) of this act if the controller is unable to verify, using commercially reasonable efforts, the identity of the consumer making the request.(5) Obligations imposed on controllers and processors under this chapter do not:(a) Adversely affect the rights of any persons;
or investigate, report, or prosecute those responsible for any such action.(2) The obligations imposed on controllers or processors under this chapter do not apply where compliance by the controller or processor with this chapter would violate an evidentiary privilege under Washington law and do not prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under Washington law as part of a privileged communication.(3) A controller or processor that discloses personal data to a third-party controller or processor in compliance with the requirements of this chapter is not in violation of this chapter, including under section 11 of this act, if the recipient processes such personal data in violation of this chapter, provided that, at the time of disclosing the personal data, the disclosing controller or processor did not have actual knowledge that the recipient intended to commit a violation.
A third-party controller or processor receiving personal data from a controller or processor is likewise not liable under this chapter, including under section 11 of this act, for the obligations of a controller or processor to which it provides services.(4) This chapter does not require a controller or processor to do the following:(a) Reidentify deidentified data;(b) Retain, link, or combine personal data concerning a consumer that it would not otherwise retain, link, or combine in the ordinary course of business;(c) Comply with a request to exercise any of the rights under section 6 (1) through (6) of this act if the controller is unable to verify, using commercially reasonable efforts, the identity of the consumer making the request.(5) Obligations imposed on controllers and processors under this chapter do not:(a) Adversely affect the rights or freedoms of any persons;
A violation of this chapter is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.(2) The attorney general may bring an action in the name of the state, or as parens patriae on behalf of persons residing in the state, to enforce this chapter.(3) A controller or processor is in violation of this chapter if it fails to cure any alleged violation of sections 6 through 10 of this act within thirty days after receiving notice of alleged noncompliance.
A violation of this chapter is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.(2) The attorney general may bring an action in the name of the state, or as parens patriae on behalf of persons residing in the state, to enforce this chapter.(3) A controller or processor is in violation of this chapter if it fails to cure any alleged breach of sections 7 through 10 of this act within thirty days after receiving notice of alleged noncompliance.
PREEMPTION.This chapter supersedes and preempts laws, ordinances, regulations, or the equivalent adopted by any local entity regarding the processing of personal data by controllers or processors.NEW SECTION.  Sec.
PREEMPTION.This chapter supersedes and preempts laws adopted by any local entity regarding the processing of personal data by controllers or processors.NEW SECTION.  Sec.
Decisions producing legal effects or similarly significant effects shall include, but not be limited to, denial of consequential services or support, such as financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, and health care services.(2) Processors that provide facial recognition services must provide documentation that includes general information that explains the capabilities and limitations of the technology in terms that customers and consumers can understand.(3) Processors that provide facial recognition services must prohibit, in the contract required by section 5 of this act, the use of such facial recognition services by controllers to unlawfully discriminate under federal or state law against individual consumers or groups of consumers.(4) Controllers must obtain consent from consumers prior to deploying facial recognition services in physical premises open to the public.
Decisions producing legal effects or similarly significant effects shall include, but not be limited to, denial of consequential services or support, such as financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, and health care services.(2) Processors that provide facial recognition services must provide documentation that includes general information that explains the capabilities and limitations of the technology in terms that customers and consumers can understand.(3) Processors that provide facial recognition services must prohibit, in the contract required by section 5 of this act, the use of such facial recognition services by controllers to unlawfully discriminate under federal or state law against individual consumers or groups of consumers.(4) Controllers must obtain consent from consumers prior to deploying facial recognition services.
The placement of conspicuous notice in physical premises that clearly conveys that facial recognition services are being used constitute a consumer's consent to the use of such facial recognition services when that consumer enters those premises that have such notice.(5) Providers of commercial facial recognition services that make their technology available as an online service for developers and customers to use in their own scenarios must make available an application programming interface or other technical capability, chosen by the provider, to enable third parties that are legitimately engaged in independent testing to conduct reasonable tests of those facial recognition services for accuracy and unfair bias.(6) For purposes of this section, "facial recognition" means technology that analyzes facial features and is used for the unique personal identification of natural persons in still or video images.NEW SECTION.  Sec.
The placement of conspicuous notice in physical premises or online that clearly conveys that facial recognition services are being used constitute a consumer's consent to the use of such facial recognition services when that consumer enters those premises or proceeds to use the online services that have such notice, provided that there is a means by which the consumer may exercise choice as to facial recognition services.(5) Providers of commercial facial recognition services that make their technology available as an online service for developers and customers to use in their own scenarios must make available an application programming interface or other technical capability, chosen by the provider, to enable third parties that are legitimately engaged in independent testing to conduct reasonable tests of those facial recognition services for accuracy and unfair bias.(6) For purposes of this section, "facial recognition" means technology that analyzes facial features and is used for the unique personal identification of natural persons in still or video images.NEW SECTION.  Sec.
By September 30, 2023, the office of privacy and data protection must submit a report of its findings to the appropriate committees of the legislature.(9) The office of privacy and data protection, in consultation with the attorney general, must by rule (a) establish any exceptions to this chapter necessary to comply with state or federal law by the effective date of this section and as necessary thereafter, (b) clarify definitions of this chapter as necessary, and (c) create exemption eligibility requirements for small businesses and research institutions.NEW SECTION.  Sec.
By September 30, 2023, the office of privacy and data protection must submit a report of its findings to the appropriate committees of the legislature.NEW SECTION.  Sec.
This act takes effect July 31, 2021.--- END ---
This act takes effect December 31, 2020.--- END ---
⬇ Download PDF
View plain text versions (3)

Action History

  1. Senate Rules "X" file.

  2. By resolution, reintroduced and retained in present status.

  3. By resolution, returned to Senate Rules Committee for third reading.

  4. Referred to Rules 2 Consideration.

  5. Rules Committee relieved of further consideration. Placed on second reading.

  6. Scheduled for public hearing in the House Committee on Appropriations at 05:30 PM

  7. Referred to Rules 2 Review.

  8. Minority; do not pass.

  9. APP - Majority; do pass with amendment(s) but without amendment(s) by Innovation, Technology & Economic Development.

  10. Scheduled for public hearing in the House Committee on Appropriations at 09:00 AM

  11. Scheduled for public hearing in the House Committee on Innovation, Technology & Economic Development at 08:00 AM

  12. Referred to Appropriations.

  13. Minority; do not pass.

  14. ITED - Majority; do pass with amendment(s).

  15. Scheduled for public hearing in the House Committee on Innovation, Technology & Economic Development at 10:00 AM

  16. First reading, referred to Innovation, Technology & Economic Development.

  17. Third reading, passed; yeas, 46; nays, 1; absent, 0; excused, 2.

  18. Rules suspended. Placed on Third Reading.

  19. 2nd substitute bill substituted.

  20. 2nd substitute bill substituted.

  21. 2nd substitute bill substituted.

  22. Placed on second reading by Rules Committee.

  23. Placed on second reading by Rules Committee.

  24. Placed on second reading by Rules Committee.

  25. Passed to Rules Committee for second reading.

  26. Passed to Rules Committee for second reading.

  27. Passed to Rules Committee for second reading.

  28. Scheduled for public hearing in the Senate Committee on Ways & Means at 01:30 PM

  29. Minority; without recommendation.

  30. WM - Majority; 2nd substitute bill be substituted, do pass.

  31. Minority; without recommendation.

  32. WM - Majority; 2nd substitute bill be substituted, do pass.

  33. Minority; without recommendation.

  34. WM - Majority; 2nd substitute bill be substituted, do pass.

  35. Scheduled for public hearing in the Senate Committee on Ways & Means at 01:30 PM

  36. Referred to Ways & Means.

  37. Referred to Ways & Means.

  38. Scheduled for public hearing in the Senate Committee on Environment, Energy & Technology at 10:00 AM

  39. And refer to Ways & Means.

  40. ENET - Majority; 1st substitute bill be substituted, do pass.

  41. And refer to Ways & Means.

  42. ENET - Majority; 1st substitute bill be substituted, do pass.

  43. Scheduled for public hearing in the Senate Committee on Environment, Energy & Technology at 10:00 AM

  44. First reading, referred to Environment, Energy & Technology.

Sponsors

Sponsorship breakdown

Export CSV (upgrade) →

1 sponsors · 11 co-sponsors · 139 not signed on

Sponsors (1)

  • Carlyle

Co-sponsors (11)

Not signed on (139)

139 members have not signed on to this bill.

Show all 139 →

"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.

Whip count is in markup. Polling the chamber and every recorded vote this session. Only the first open is slow. It’s instant for you after this. Calling the roll · Tallying · Engrossing

Votes

3rd Reading & Final Passage (#27)

Passed 46 Yea · 1 Nay · 2 Other
Party YeaNayPresentNot Voting
Unaffiliated 26001
Republican 8001
Democrat 12100
Total 46102
% of votes cast 94%2%0%4%
How each member voted (49)
Member Party Vote
Bailey — Yea
Becker — Yea
Billig — Yea
Brown — Yea
Carlyle — Yea
Darneille — Yea
Das — Yea
Ericksen — Yea
Frockt — Yea
Hawkins — Yea
Hobbs — Yea
Honeyford — Yea
Keiser — Yea
Kuderer — Yea
McCoy — Yea
Mullet — Yea
O'Ban — Yea
Padden — Yea
Palumbo — Yea
Randall — Yea
Rivers — Yea
Rolfes — Yea
Sheldon — Not Voting
Takko — Yea
Wilson, L. — Yea
Zeiger — Yea
Van De Wege — Yea
Annette Cleveland Democrat Yea
Bob Hasegawa Democrat Nay
Claire Wilson Democrat Yea
Jamie Pedersen Democrat Yea
Jesse Salomon Democrat Yea
Joe Nguyen Democrat Yea
Lisa Wellman Democrat Yea
Liz Lovelett Democrat Yea
Manka Dhingra Democrat Yea
Marko Liias Democrat Yea
Rebecca Saldaña Democrat Yea
Steve Conway Democrat Yea
Victoria Hunt Democrat Yea
Curtis King Republican Yea
Jeff Holy Republican Yea
Jim Walsh Republican Not Voting
John Braun Republican Yea
Judy Warnick Republican Yea
Keith Wagoner Republican Yea
Mark Schoesler Republican Yea
Phil Fortunato Republican Yea
Shelly Short Republican Yea

Official roll call →

Subjects

technology
Cross-referencing the record. Reading this bill against every other bill in the corpus by meaning, not keywords. Only the first open is slow. It’s instant for you after this. Matching · Ranking · Engrossing

Frequently asked questions

Who sponsors SB 5376?
SB 5376 is sponsored by Carlyle, Palumbo, Lisa Wellman (Democrat), Mullet, Jamie Pedersen (Democrat), Billig, Marko Liias (Democrat), Rolfes, Rebecca Saldaña (Democrat), Bob Hasegawa (Democrat), Keiser, and Victoria Hunt (Democrat).
What is the current status of SB 5376?
This bill died with 2019-2020 Regular Session. It reached “Passed Senate” and never advanced before the session ended, so it can no longer move — a new version would have to be reintroduced in the current session.
Where can I track SB 5376?
Track SB 5376 free on One Click Politics — get push/email alerts when it moves.

Make your voice heard on SB 5376

Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.

Find my representatives → Run a campaign

Stay ahead of SB 5376

Last checked for changes 3 months ago · updated continuously

One Click Politics tracks every bill in Congress and all 50 states.

Track this bill →