Law / United States / 
Washington
HB 1493, Biometric Privacy Law
RCW 19.375; HB 1493, chapter 299, Laws of 2017
In force since .
A biometric privacy rule binding private bodies.
- Private right of action
- No
- Excludes recording-derived identifiers
- Yes
- Audit expectation
- none
What it requires
- Provide notice, obtain consent, or provide a mechanism to prevent use, before enrolling a biometric identifier such as a voiceprint or faceprint in a database for a commercial purpose. This duty does not reach an identifier generated from a photo, video, or audio recording.NIST Privacy FrameworkCT.PO-P1
- Retain an enrolled biometric identifier no longer than reasonably necessary for the purpose it was enrolled for, a legal retention duty, or fraud and security prevention needs.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a business that enrolls a biometric identifier only to authenticate its own users, and never sells or discloses it to a third party, act for a 'commercial purpose' as RCW 19.375.010(4) defines that term?
What it makes you log
Logging duty
RCW 19.375.020 requires notice, consent or a mechanism to prevent later use before a person enrolls a biometric identifier in a database for a commercial purpose, limits sale and disclosure, requires reasonable care against unauthorized access, and lets a person retain an enrolled biometric identifier no longer than reasonably necessary for the purposes it lists. A notice or consent requirement and a limit on how long the identifier may be kept are conditions on, and limits on, the personal data itself; no clause requires a log, a consent record or any other record, and the chapter sets no content fields, audit or person who may demand a record. Enforcement is by the Attorney General alone under the Consumer Protection Act (RCW 19.375.030(2)).
- Kind
- None
- As of
What this law does
Requires a person to provide notice, obtain consent, or provide a mechanism to prevent use, before enrolling an individual's biometric identifier in a database for a commercial purpose.
Biometric identifier is defined as data from automatic measurement of biological characteristics such as fingerprint, voiceprint, retina, or iris, but the definition excludes any identifier generated from a photo, video, or audio recording and any Health Insurance Portability and Accountability Act (HIPAA) covered information, so a faceprint or voiceprint pulled from an existing recording falls outside this statute even though the same identifier is covered as consumer health data under the My Health My Data Act.
An enrolled identifier may be retained no longer than reasonably necessary for the purpose it was enrolled for, a legal retention duty, or fraud and security prevention, and the chapter separately exempts Gramm-Leach-Bliley financial institutions and law enforcement.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .