Washington State House of Representatives Office of Program Research | BILL ANALYSIS |
Innovation, Technology & Economic Development Committee |
HB 2365
This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent. |
Brief Description: Notifying Washington consumers of products that transmit user data.
Sponsors: Representatives Smith, Hudgins, Leavitt, Young, Wylie, Kloba and Pollet.
Brief Summary of Bill |
|
Hearing Date: 1/15/20
Staff: Kyle Raymond (786-7190).
Background:
The Consolidated Technology Services (CTS) agency supports state agencies as a centralized provider and procurer of certain information technology services. Within the CTS, the Office of the Chief Information Officer (OCIO) has certain primary duties related to information technology for state government, which include establishing statewide enterprise architecture and standards for consistent and efficient operation. The Office of Privacy and Data Protection (OPDP) is within the OCIO.
The OPDP serves as a central point of contact for state agencies on policy matters involving data privacy and data protection. The Chief Privacy Officer serves as the director of the OPDP. The OPDP conducts annual privacy reviews, trains agencies and employees, articulates privacy principles and best practices, coordinates data protection in cooperation with the CTS, and participates with the OCIO in the review of major state agency projects involving personally identifiable information.
Summary of Bill:
Data Transmission Sticker Development.
The Office of Privacy and Data Protection (OPDP) is directed to develop a user data transmission sticker for the stated purpose of notifying Washington consumers that a connected device has the capability to transmit user data to the device manufacturer or any separate business entity.
The data transmission sticker is required to meet certain design requirements, including that the sticker must:
have a design that is easily identifiable and understandable to both children and adults;
include a graphic that appeals to both children and adults;
be effective in alerting consumers that the product collects and transmits user data to the device manufacturer or any separate business entity; and
be easy to use for manufacturers and retailers of applicable connected devices.
In determining whether a sticker meets the specified design requirements, the OPDP must facilitate focus group discussions with both children and adults to solicit feedback on the design of the sticker. In addition, the OPDP must research existing labels intended to appeal to both children and adults to use as a model in developing the sticker.
User data is defined as any information.
Data Transmission Sticker Product Labeling Requirement.
Beginning January 1, 2022, any connected device product that transmits user data to the product manufacturer, or any separate business entity, must be labeled with a user data transmission sticker developed by the OPDP.
The data transmission sticker must meet certain specified requirements for its placement on a product package, including that the sticker must be:
placed in a prominent location on the principal display panel or front of the product package;
of a size that is legible and readily visible by the consumer;
no smaller than an inch in diameter, unless recommended by the OPDP;
displayed on the product package in a manner that is not altered or cropped; and
made available by the OPDP in digital form to manufacturers without cost.
The digital file for the user data transmission sticker must be made available on the OPDP web site.
A connected device is defined as any device or other physical object that is capable of connecting to the internet, directly or indirectly, and that is assigned an internet protocol address or Bluetooth address.
The OPDP may adopt rules necessary to implement the data transmission sticker product labeling requirements.
Appropriation: None.
Fiscal Note: Available.
Effective Date: The bill takes effect 90 days after adjournment of the session in which the bill is passed.