SENATE BILL REPORT

SB 5564

This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent.

As of February 4, 2009

Title: An act relating to protecting consumers from breaches of security.

Brief Description: Protecting consumers from breaches of security.

Sponsors: Senators Kohl-Welles, Holmquist and Sheldon.

Brief History:

Committee Activity: Labor, Commerce & Consumer Protection: 2/05/09.

SENATE COMMITTEE ON LABOR, COMMERCE & CONSUMER PROTECTION

Staff: Alison Mendiola (786-7483)

Background: State Security Breach Law (Chapter 19.255 RCW). In 2005 the Legislature enacted a security breach law. The law requires any person or business to notify possibly affected persons when security is breached and unencrypted personal information is (or is reasonably believed to have been) acquired by an unauthorized person. A person or business is not required to disclose a technical breach that does not seem reasonably likely to subject customers to a risk of criminal activity. "Personal information" is defined as an individual's first name or first initial and last name in combination with one or more of the following data elements, when either the name or the data elements are not encrypted:

"Personal information" does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

The notice required must be either written, electronic, or substitute notice. If it is electronic, the notice provided is consistent with federal law provisions regarding electronic records, including consent, record retention, and types of disclosures. Substitute notice is only allowed if the cost of providing direct notice exceeds $250,000; the number of persons to be notified exceeds 500,000; or there is insufficient contact information to reach the customer. Substitute notice consists of all of the following:

A customer injured by a violation of the security breach law has the right to a civil action for damages.

State Disposal of Personal Information Law. State law places restrictions on how certain types of personal information may be disposed. If a person or business is disposing of records containing personal financial and health information and personal identification numbers issued by a government entity, the person or business must take all reasonable steps to destroy, or arrange the destruction of, the information. An individual injured by the failure of an entity to comply with the disposal of personal information law may sue for:

The Attorney General may bring a civil action in the name of the state for damages, injunctive relief, or both, against an entity that fails to comply with the law. The court may award damages that are the same as those awarded to individual plaintiffs.

Summary of Bill: The bill as referred to committee not considered.

Summary of Bill (Proposed First Substitute): No person, entity conducting business in Washington, or service provider for such a person or entity that accepts an access device in connection with a transaction may retain the card security code data, the Personal Identification Number (PIN) verification code number, or the full contents of any track of magnetic stripe data after the authorization of the transaction or in the case of a PIN debit transaction, subsequent to 48 hours after the authorization of the transaction. This does not apply if the person, entity conducting business in Washington, or service provider has the express consent of the customer using the access device.

Remedies. A person or entity must reimburse a financial institution if there is a breach of the security of the system of a person or entity or their service provider and the:

The reimbursement is for a financial institution that issued any access devices affected by the breach for all actions reasonably undertaken in order to protect consumers, including costs for:

The remedies are cumulative and do not restrict any other right or remedy otherwise available to the financial institution.

Limited Immunity. A financial institution that provided or approved equipment used to process payment transactions is precluded from recovering cost if:

Additional Transaction Fees Permitted. A person or entity accepting an access device in connection with a transaction may add an additional two cents per transaction to the balance of the transaction for the purpose of subsidizing costs associated with insurance designed to protect against liability associated with the costs of a breach.

Arbitration. The parties to a dispute arising under the security breach provisions may agree to submit to arbitration. The arbitrator must be agreed upon by the parties at the time the dispute arises. The arbitration process must comply with the requirements of chapter 7.04A RCW relating to arbitration. A party to a dispute entering into arbitration as an initial method of dispute resolution may seek also a refund or credit made to an account holder to cover the cost of any unauthorized transaction related to the breach, except that costs may not include any amounts recovered by the financial institution from a credit card company. Any other remedy provided by law may also be sought by a party.

Appropriation: None.

Fiscal Note: Available.

Committee/Commission/Task Force Created: None.

Effective Date: The bill takes effect on January 1, 2010.