Duty LXD-1089
Processes personal data, in Washington
HB 1493, Biometric Privacy Lawsince 6 lines
RCW 19.375; HB 1493, chapter 299, Laws of 2017 · Read the law's page
- Provide notice, obtain consent, or provide a mechanism to prevent use, before enrolling a biometric identifier such as a voiceprint or faceprint in a database for a commercial purpose. This duty does not reach an identifier generated from a photo, video, or audio recording.
- Retain an enrolled biometric identifier no longer than reasonably necessary for the purpose it was enrolled for, a legal retention duty, or fraud and security prevention needs.
- Unless the individual has consented, do not sell, lease or otherwise disclose an enrolled biometric identifier to another person for a commercial purpose, except for a disclosure that is consistent with subsections (1), (2) and (4), is necessary to provide a product or service the individual subscribed to, requested or expressly authorized, is necessary to complete a financial transaction the individual requested, is required or expressly authorized by a federal or state statute or court order, is made to a third party who contractually promises not to disclose it further or enroll it in a database for an inconsistent commercial purpose, or is made to prepare for litigation or respond to judicial process (RCW 19.375.020(3)).
- A person who knowingly possesses a biometric identifier enrolled for a commercial purpose must take reasonable care to guard against unauthorized access to and acquisition of the biometric identifiers in its possession or under its control (RCW 19.375.020(4)(a)).
- Obtain consent for the new terms before using or disclosing an enrolled biometric identifier, or one obtained from a third party for a commercial purpose, in a manner materially inconsistent with the terms under which it was originally provided (RCW 19.375.020(5)).
- This section does not require notice and consent to collect, capture or enroll a biometric identifier and store it in a biometric system, or otherwise, in furtherance of a security purpose, which the chapter defines as preventing shoplifting, fraud or other misappropriation or theft of a thing of value, or protecting the security or integrity of software, accounts, applications, online services or any person (RCW 19.375.020(7) and 19.375.010(8)).
Notice of security breaches involving personal informationsince 2 lines
RCW 19.255, as amended by HB 1071 (2019 c 241); originally enacted 2005 c 368 · Read the law's page
- Notify affected Washington residents of a breach of unsecured personal information, including biometric identifiers, in the most expedient time possible and no more than 30 calendar days after discovery.
- Notify the Washington Attorney General of any breach affecting more than 500 Washington residents within 30 days after the breach was discovered.
HB 1155, My Health My Data Actsince 4 lines
RCW 19.373; HB 1155, chapter 191, Laws of 2023 · Read the law's page
- Obtain affirmative opt-in consent before collecting a Washington consumer's health data, and separate consent before sharing it, unless the collection or sharing is necessary to provide a product or service the consumer requested; consumer health data includes any biometric identifier used to infer a health condition, whether captured live or extracted from a stored photo, video, or audio recording.
- Obtain a further signed authorization before selling consumer health data.
- Do not geofence within 2,000 feet of a health care facility to identify, track, or send notifications to consumers seeking care.
- Honor a consumer's request to confirm, access, or delete their consumer health data within 45 days, extendable once by 45 additional days.