Law / United States / 
Washington
Notice of security breaches involving personal information
RCW 19.255, as amended by HB 1071 (2019 c 241); originally enacted 2005 c 368
In force since .
A breach notification rule binding private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- Notify affected Washington residents of a breach of unsecured personal information, including biometric identifiers, in the most expedient time possible and no more than 30 calendar days after discovery.
- Notify the Washington Attorney General of any breach affecting more than 500 Washington residents within 30 days after the breach was discovered.
These lines are LexLint's reading of the law's text. Also read by: Washington State Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Available to the Washington Attorney General, who may bring an action in the name of the state, or as parens patriae, to enforce this chapter under the Consumer Protection Act because a violation is deemed an unfair or deceptive act under RCW 19.86.020. The consumer's own private civil action under subsection (3)(a) is a separate remedy and, unlike the My Health My Data Act, may not be brought under the Consumer Protection Act's own treble-damages provision, RCW 19.86.090.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 7,500
Statutory damages
No fixed per-person amount and no enhancement: subsection (2) expressly bars bringing this chapter's private action under the Consumer Protection Act's own treble-damages provision, RCW 19.86.090, so a consumer's civil action under subsection (3)(a) recovers only the damages the court awards on ordinary proof, unlike the My Health My Data Act's private action under the same chapter.
- As of
Who enforces it
Enforcement body
Washington Attorney General, who may bring an action in the name of the state, or as parens patriae on behalf of Washington residents, to enforce this chapter under the Consumer Protection Act, RCW 19.86; an injured consumer may also institute a separate civil action under this Section to recover damages.
Settledness
- As of
- Guidance link
- https://www.atg.wa.gov/HB1071-FAQ
- Guidance body
- Washington State Office of the Attorney General
- Open questions
- When is a breach of the security of the system 'not reasonably likely to subject consumers to a risk of harm', so that notice to residents is not required under RCW 19.255.010(1)?
What it makes you log
Logging duty
RCW 19.255.010 requires a person or business that conducts business in the state and owns or licenses personal information to notify each resident whose unsecured personal information was or is reasonably believed to have been acquired by an unauthorized person, to notify the owner or licensee of data it merely maintains, and to notify the Attorney General within 30 days of a breach affecting more than 500 Washington residents, with the notice's contents listed. A duty to notify, with no instruction to document the breach or the decision that notice is not required, is not a log or record; the sample copy of the notice sent to the Attorney General is a filing. The chapter names no record, content fields, retention period, audit or person who may demand a record. A person's own notification procedures in an information security policy (RCW 19.255.010(5)) are a policy that states rules, not a record of processing.
- Kind
- None
- As of
What this law does
Requires a person or business conducting business in Washington and owning or licensing data that includes personal information to notify affected residents of a breach of unsecured personal information in the most expedient time possible and no more than 30 calendar days after discovery, and to notify the Attorney General where a breach affects more than 500 Washington residents.
Personal information expressly includes biometric data generated by automatic measurement of biological characteristics such as a fingerprint, voiceprint, retina, or iris, and unlike the state's dedicated Biometric Privacy Law, this definition carries no exclusion for an identifier extracted from a photograph, video, or audio recording.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .