HOUSE BILL REPORT

HB 2365

As Reported by House Committee On:

Innovation, Technology & Economic Development

Title: An act relating to notifying Washington consumers of products that transmit user data.

Brief Description: Notifying Washington consumers of products that transmit user data.

Sponsors: Representatives Smith, Hudgins, Leavitt, Young, Wylie, Kloba and Pollet.

Brief History:

Committee Activity:

Innovation, Technology & Economic Development: 1/15/20, 1/24/20 [DPS].

Majority Report: The substitute bill be substituted therefor and the substitute bill do pass. Signed by 9 members: Representatives Hudgins, Chair; Kloba, Vice Chair; Smith, Ranking Minority Member; Boehnke, Assistant Ranking Minority Member; Entenman, Slatter, Tarleton, Van Werven and Wylie.

Staff: Kyle Raymond (786-7190).

Background:

The Consolidated Technology Services (CTS) agency supports state agencies as a centralized provider and procurer of certain information technology services. Within the CTS, the Office of the Chief Information Officer (OCIO) has certain primary duties related to information technology for state government, which include establishing statewide enterprise architecture and standards for consistent and efficient operation. The Office of Privacy and Data Protection (OPDP) is within the OCIO.

The OPDP serves as a central point of contact for state agencies on policy matters involving data privacy and data protection. The Chief Privacy Officer serves as the Director of the OPDP. The OPDP conducts annual privacy reviews, trains agencies and employees, articulates privacy principles and best practices, coordinates data protection in cooperation with the CTS, and participates with the OCIO in the review of major state agency projects involving personally identifiable information.

–––––––––––––––––––––––––––––––––

Summary of Substitute Bill:

Data Transmission Sticker Development.

The Office of Privacy and Data Protection (OPDP) is directed to develop a user data transmission sticker for the stated purpose of notifying Washington consumers that a connected device has the capability to transmit user data to the device manufacturer or any separate business entity.  

The user data transmission sticker is required to meet certain design requirements, including that the sticker must:

• have a design that is easily identifiable and understandable to both children and adults;

• include a graphic that appeals to both children and adults;

• be effective in alerting consumers that the product collects and transmits user data to the device manufacturer or any separate business entity; and

• be easy to use for manufacturers and retailers of applicable connected devices.

In determining whether a sticker meets the specified design requirements, the OPDP must facilitate focus group discussions with both children and adults to solicit feedback on the design of the sticker. In addition, the OPDP must research existing labels intended to appeal to both children and adults to use as a model in developing the sticker.

User data includes any information.

Data Transmission Sticker Product Labeling Requirement.

Beginning January 1, 2022, any connected device product that transmits user data to the product manufacturer, or any separate business entity, must be labeled with a user data transmission sticker developed by the OPDP.

The user data transmission sticker must meet certain specified requirements for its placement on a product package, including that the sticker must be:

• placed in a prominent location on the principal display panel or front of the product package;

• of a size that is legible and readily visible by the consumer;

• no smaller than an inch in diameter, unless recommended by the OPDP;

• displayed on the product package in a manner that is not altered or cropped; and

• made available by the OPDP in digital form to manufacturers without cost.

The digital file for the user data transmission sticker must be made available on the OPDP website.

A connected device is defined as any device or other physical object that is capable of connecting to the internet, directly or indirectly, and that is assigned an internet protocol address or Bluetooth address.

The OPDP may adopt rules necessary to implement the data transmission sticker product labeling requirements.

Substitute Bill Compared to Original Bill:

Amends the definition of "connected device" to limit the application of the labeling requirement to products for personal, family, or household use.

–––––––––––––––––––––––––––––––––

Appropriation: None.

Fiscal Note: Available.

Effective Date of Substitute Bill: The bill takes effect 90 days after adjournment of the session in which the bill is passed.

Staff Summary of Public Testimony:

(In support) In a world of complex data privacy it doesn't all have to be hard. Mr. Yuck is still around because it works at making parents and children aware that a product could hurt you.

Often, there is not a keen awareness of what is being transmitted out of your home. This bill simply asks the Office of Privacy and Data Protection to work with consumers and children to come up with a simple sticker that makes people aware that a product transmits data from your home.

This is a very simple, low-tech option that does something meaningful for the people. This bill will help people understand and make informed choices.

(Opposed) There are some concerns around the scope, feasibility, and implementation of the bill. This could result in costs for the public and private sector. There are some concerns that the bill would not adequately protect consumer data privacy, and it is unlikely to meaningfully protect data privacy. Industry would like to provide more stakeholder input on the issue.

Persons Testifying: (In support) Representative Smith, prime sponsor.

(Opposed) Ian Griswold, Washington Tech Industry Association.

Persons Signed In To Testify But Not Testifying: None.