Processes biometric data, in Washington

RCW 19.375 · Read the law's page

• Before enrolling someone's biometric identifier, a fingerprint, voiceprint, retina or iris scan, or other unique biological pattern used to identify them, in a database for a commercial purpose, provide notice, obtain consent, or provide a mechanism to prevent that subsequent commercial use.
• An ordinary scraped photograph, video, or audio recording, and data generated from one, is never a biometric identifier under this chapter, with no exception for a photo or recording used to identify a specific individual.
• Only the Washington Attorney General may enforce this chapter, under the Consumer Protection Act; there is no private right of action here, unlike the My Health My Data Act's own private right of action.

RCW 19.375; HB 1493, chapter 299, Laws of 2017 · Read the law's page

• Provide notice, obtain consent, or provide a mechanism to prevent use, before enrolling a biometric identifier such as a voiceprint or faceprint in a database for a commercial purpose. This duty does not reach an identifier generated from a photo, video, or audio recording.
• Retain an enrolled biometric identifier no longer than reasonably necessary for the purpose it was enrolled for, a legal retention duty, or fraud and security prevention needs.
• Unless the individual has consented, do not sell, lease or otherwise disclose an enrolled biometric identifier to another person for a commercial purpose, except for a disclosure that is consistent with subsections (1), (2) and (4), is necessary to provide a product or service the individual subscribed to, requested or expressly authorized, is necessary to complete a financial transaction the individual requested, is required or expressly authorized by a federal or state statute or court order, is made to a third party who contractually promises not to disclose it further or enroll it in a database for an inconsistent commercial purpose, or is made to prepare for litigation or respond to judicial process (RCW 19.375.020(3)).
• A person who knowingly possesses a biometric identifier enrolled for a commercial purpose must take reasonable care to guard against unauthorized access to and acquisition of the biometric identifiers in its possession or under its control (RCW 19.375.020(4)(a)).
• Obtain consent for the new terms before using or disclosing an enrolled biometric identifier, or one obtained from a third party for a commercial purpose, in a manner materially inconsistent with the terms under which it was originally provided (RCW 19.375.020(5)).
• This section does not require notice and consent to collect, capture or enroll a biometric identifier and store it in a biometric system, or otherwise, in furtherance of a security purpose, which the chapter defines as preventing shoplifting, fraud or other misappropriation or theft of a thing of value, or protecting the security or integrity of software, accounts, applications, online services or any person (RCW 19.375.020(7) and 19.375.010(8)).

RCW 19.255, as amended by HB 1071 (2019 c 241); originally enacted 2005 c 368 · Read the law's page

• Notify affected Washington residents of a breach of unsecured personal information, including biometric identifiers, in the most expedient time possible and no more than 30 calendar days after discovery.
• Notify the Washington Attorney General of any breach affecting more than 500 Washington residents within 30 days after the breach was discovered.

RCW 19.373; HB 1155, chapter 191, Laws of 2023 · Read the law's page

• Obtain affirmative opt-in consent before collecting a Washington consumer's health data, and separate consent before sharing it, unless the collection or sharing is necessary to provide a product or service the consumer requested; consumer health data includes any biometric identifier used to infer a health condition, whether captured live or extracted from a stored photo, video, or audio recording.
• Obtain a further signed authorization before selling consumer health data.
• Do not geofence within 2,000 feet of a health care facility to identify, track, or send notifications to consumers seeking care.
• Honor a consumer's request to confirm, access, or delete their consumer health data within 45 days, extendable once by 45 additional days.

SHB 1672, 2025-2026 session (codification pending)

• If you are an employer, give 15 days advance written notice before deploying an automated decision system that affects employment decisions, covering its form, its purpose and its data-use practices.
• If you are an employer, do not use automated decision system outputs about an employee's physical or mental health, emotions or personality as a basis for employment decisions.
• If you are an employer, do not track employees off duty.
• If you are an employer, do not use facial recognition in private spaces.
• If you are an employer, do not monitor restrooms.