Brief Summary of Bill

Expands definition of personal information.
Requires the attorney general to be notified no more than 14 days after the discovery of a data breach.
Requires consumers to be notified no more than 30 days, with certain exceptions, after the discovery of a data breach.
Amends consumer and attorney general notification requirements.

Background: State Security Breach Laws. Under current law, any person or business that conducts business in Washington and all agencies that own, license, or maintain personal information must meet specified requirements regarding the disclosure of any breach of the security system. Certain federally regulated data sets are exempt from disclosure.

Definition of Personal Information. Personal information means an individual's first name or first initial and last name in combination with any one or more of the following data elements:

Social Security number;
driver's license number or Washington identification card number; or
information that would permit access to an individual's financial account.

Personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

Notification Requirements. The breach notification issued to affected, and possibly affected, consumers by a person, business, or agency must be in plain language and include the following:

name and contact information of reporting person, business, or agency;
a list of the type of personal information believed to be subject to the breach; and
contact information of major credit reporting agencies if the breach exposed personal information.

If more than 500 Washington residents affected by a single breach are required to be notified, the reporting person, business, or agency must also submit to the attorney general a copy of the notification sent to consumers and the general number of affected Washington residents.

Consumers and the attorney general must be notified of a data breach in the most expedient time possible and without unreasonable delay no more than 45 days after the breach was discovered, with certain exception.

Summary of Bill (Proposed Substitute): Definition of Personal Information. When used in combination with an individual's first name or first initial and last name, the definition of personal information is expanded to include the following data elements:

full date of birth;
an individual's unique private key that is used to sign an electronic record;
student, military, or passport identification number;
health insurance policy number;
consumer medical information; and
an individual's biometric data generated by automatic measurements.

The definition personal information also includes:

a combination of username or email address with a password or security questions and answers that would permit access to an online account; and
any data elements or combination of data elements without the consumer's first name or first initial and last name that meet certain conditions.

Notification Requirements. In addition to current requirements, notifications to a consumer must include a time frame of exposure, if known, including the date of the breach and the date of the discovery of the breach. Consumers must be notified of a data breach no more than 30 days after the breach was discovered with certain exceptions.

Notifications to the attorney general must include the following:

a list of the type of personal information believed to have been the subject of a breach;
a time frame of exposure, if known, including the date of the breach and the date of the discovery of the breach;
a summary of steps taken to contain the breach; and
a sample copy of the security breach notification.

The attorney general must be notified of a data breach no more than 14 days after the breach was discovered. The notice must be updated if any required information is unknown at the time notice is due.

Staff Summary of Public Testimony on Proposed Substitute: PRO: Dealing with the aftermath of a breach can be a frustrating experience for consumer. We trust our most personal information to these companies and it deserves to be treated with dignity and respect. The current definition of personal information is too narrow to effectively protect consumers in today's environment. A recent study showed that most security breaches are not discovered until after 100 days of the breach. The number of days after a breach needs to be shortened in order to allow consumers to take the necessary steps to protect themselves. We think these protections should be extended to public employees if employers are breached.

OTHER: We think the notification timelines included in the bill are too short and do not provide businesses enough time to complete the complex analyses. An effective date of March 2020 would be more appropriate in order to allow for implementation outside of the holiday season. We have concerns with the use of full date of birth as a separate data element when associated with a name set because inclusion might expand the number of groups regulated by this act. We think the bill could be improved by adding a safe harbor for our mutual defense; aligning notification format with current cybersecurity practices; and adding options for referencing other industry-accepted standards.