H-1009.1
HOUSE BILL 1493
| | |
State of Washington | 65th Legislature | 2017 Regular Session |
By Representatives Morris, Harmsworth, Smith, Tarleton, and Stanford
Read first time 01/20/17. Referred to Committee on Technology & Economic Development.
AN ACT Relating to biometric identifiers; adding a new chapter to Title
19 RCW; and creating a new section.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:
NEW SECTION. Sec. 1. The legislature finds that citizens of Washington are increasingly asked to disclose sensitive biological information that uniquely identifies them for commerce, security, and convenience. The collection and marketing of biometric information about individuals, without consent or knowledge of the individual whose data is collected, is of increasing concern. The legislature intends to require a business that collects and can attribute biometric data to a specific uniquely identified individual to provide notice and obtain consent from an individual before enrolling or changing the use of an individual's biometric identifiers in a database.
NEW SECTION. Sec. 2. (1) A person may not enroll a biometric identifier in a database to create identification of an individual, or change the use of such an enrolled biometric identifier, without first providing clear and conspicuous notice and obtaining the individual's consent.
(2) Clear and conspicuous notice is notice that is given through a procedure reasonably designed to be prominent, timely, relevant, and easily accessible. The exact notice required to achieve this standard is context-dependent.
(3) A person who has enrolled an individual's biometric identifier may not sell, lease, or otherwise disclose the biometric identifier to another person for a commercial purpose unless the disclosure:
(a) Is consistent with subsections (1), (2), and (4) of this section;
(b) Is necessary to provide a product or service requested by the individual;
(c) Is necessary to effect, administer, enforce, or complete a financial transaction that the individual requested, initiated, or authorized, and the third party to whom the biometric identifier is disclosed maintains confidentiality of the biometric identifier and does not further disclose the biometric identifier except as otherwise permitted under this subsection (3);
(d) Is required or expressly authorized by a federal or state statute, administrative code, or court order;
(e) Is made in good faith in response to a request from a law enforcement officer that has represented to the person that such disclosure is necessary to facilitate law enforcement's response to an ongoing incident in which there is an imminent threat of danger or harm to an individual;
(f) Is made to a third party who contractually promises that the biometric identifier will not be further disclosed and will not be enrolled in a database for a commercial purpose inconsistent with the notice and consent described in this subsection and subsections (1) and (2) of this section; or
(g) Is made to prepare for litigation or to respond to or participate in judicial process.
(4) A person who possesses a biometric identifier of an individual that has been enrolled for a commercial purpose:
(a) Must take reasonable care to guard against unauthorized access to biometric identifiers that are in the possession or under the control of the person; and
(b) May retain the biometric identifier no longer than is reasonably necessary to:
(i) Comply with a court order, statute, or administrative rule;
(ii) Protect against or prevent actual or potential fraud, criminal activity, claims, security threats, or liability; or
(iii) Effectuate the purposes for which an individual has provided consent to the capture, enrollment, and disclosure of the biometric identifier, including with existing third parties identified in the original consent obtained from the individual.
(5) A person who enrolls a biometric identifier of an individual pursuant to this section may not use or disclose it in a manner that is materially inconsistent with the terms under which the biometric identifier was originally provided without obtaining consent for the new terms of use or disclosure.
(6) The limitations on disclosure and retention of biometric identifiers provided in this section do not apply to disclosure or retention of biometric identifiers that have been anonymized so as to prevent the possibility of ascertaining the identity of a unique individual.
NEW SECTION. Sec. 3. The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.
(1) "Biometric identifier" means data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, voiceprint, eye retinas or irises, or other unique biological characteristic, which are used by the person or licensee to uniquely authenticate an individual's identity when the individual accesses a system or account.
(2) "Biometric system" means an automated system capable of capturing a biometric sample from an individual, extracting and processing biometric data from that sample, storing the extracted information in a database, comparing the biometric data with data contained in one or more references, determining whether the biometric data matches the reference, and indicating whether or not an identification has been achieved.
(3) "Capture" means the process of using a sensor to collect a biometric sample and related contextual data from a scene or an individual, or both, with or without the individual's knowledge.
(4) "Commercial purpose" means a purpose in furtherance of the sale or disclosure of a biometric identifier for the purpose of marketing of goods or services when such goods or services are unrelated to the initial commercial transaction in which a person first gains possession of an individual's biometric identifier. "Commercial purpose" does not include a security purpose.
(5) "Enroll" means to collect a biometric identifier of an individual, convert it into a reference template, and store it in the biometric system's database for later comparison. Biometric samples converted in a reference template format cannot be reconstructed into the original output image.
(6) "Federal peace officer" has the meaning in RCW
10.93.020.
(7) "Identification" is the task by which a biometric system searches a database for a reference matching a biometric sample and, if found, returns a corresponding identity.
(8) "Law enforcement officer" means a law enforcement officer as defined in RCW
9.41.010 or a federal peace officer.
(9) "Person" means an individual, partnership, corporation, limited liability company, organization, association, or any other legal or commercial entity, but does not include a government agency.
(10) "Security purpose" means the purpose of preventing shoplifting, fraud, or any other misappropriation or theft of a thing of value, including tangible and intangible goods and services.
NEW SECTION. Sec. 4. The legislature finds that the practices covered by this section are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A material violation of this chapter is not reasonable in relation to the development and preservation of business, or is an unfair or deceptive act in trade or commerce and an unfair method of competition. NEW SECTION. Sec. 5. (1) Nothing in this act applies in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated thereunder.
(2) Nothing in this act expands or limits the authority of a law enforcement officer acting within the scope of his or her authority including, but not limited to, the authority of a state law enforcement officer in executing lawful searches and seizures.
NEW SECTION. Sec. 6. Sections 2 through 5 of this act constitute a new chapter in Title 19 RCW. --- END ---