Strike everything after the enacting clause and insert the following:

"NEW SECTION.  Sec. 1. SHORT TITLE.This act may be known and cited as the Washington privacy act.

NEW SECTION.  Sec. 2. LEGISLATIVE FINDINGS AND INTENT.(1) The legislature finds that the people of Washington regard their privacy as a fundamental right and an essential element of their individual freedom. Washington's Constitution explicitly provides the right to privacy, and fundamental privacy rights have long been and continue to be integral to protecting Washingtonians and to safeguarding our democratic republic.

(2) Ongoing advances in technology have produced an exponential growth in the volume and variety of personal data being generated, collected, stored, and analyzed, which presents both promise and potential peril. The ability to harness and use data in positive ways is driving innovation and brings beneficial technologies to society. However, it has also created risks to privacy and freedom. The unregulated and unauthorized use and disclosure of personal information and loss of privacy can have devastating impacts, ranging from financial fraud, identity theft, and unnecessary costs, to personal time and finances, to destruction of property, harassment, reputational damage, emotional distress, and physical harm.

(3) Given that technological innovation and new uses of data can help solve societal problems, protect public health associated with global pandemics, and improve quality of life, the legislature seeks to shape responsible public policies where innovation and protection of individual privacy coexist. The legislature notes that our federal authorities have not developed or adopted into law regulatory or legislative solutions that give consumers control over their privacy. In contrast, the European Union's general data protection regulation has continued to influence data privacy policies and practices of those businesses competing in global markets. In the absence of federal standards, Washington and other states across the United States are analyzing elements of the European Union's general data protection regulation to enact state-based data privacy regulatory protections.

(4) With this act, the legislature intends to: Provide a modern privacy regulatory framework with data privacy guardrails to protect individual privacy; establish mechanisms for consumers to exercise control over their data; and require companies to be responsible custodians of data as technological innovations emerge.

(5) This act gives consumers the ability to protect their own rights to privacy by explicitly providing consumers the right to access, correct, and delete personal data, as well as the rights to obtain data in a portable format and to opt out of the collection and use of personal data for certain purposes. These rights will add to, and not subtract from, the consumer protection rights that consumers already have under Washington state law.

(6) This act also imposes affirmative obligations upon companies to safeguard personal data, and provide clear, understandable, and transparent information to consumers about how their personal data is used. It strengthens compliance and accountability by requiring data protection assessments in the collection and use of personal data. Finally, it exclusively empowers the state attorney general to obtain and evaluate a company's data protection assessments, to conduct investigations, while preserving consumers' rights under the consumer protection act to impose penalties where violations occur, and to prevent against future violations.

NEW SECTION.  Sec. 3. DEFINITIONS.The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.

(1) "Affiliate" means a legal entity that controls, is controlled by, or is under common control with, that other legal entity. For these purposes, "control" or "controlled" means: Ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a company; control in any manner over the election of a majority of the directors or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company.

(2) "Air carriers" has the same meaning as defined in the federal aviation act (49 U.S.C. Sec. 40101, et seq.), including the airline deregulation act (49 U.S.C. 41713).

(3) "Authenticate" means to use reasonable means to determine that a request to exercise any of the rights in section 5 (1) through (4) of this act is being made by the consumer who is entitled to exercise such rights with respect to the personal data at issue.

(4) "Business associate" has the same meaning as in Title 45 C.F.R., established pursuant to the federal health insurance portability and accountability act of 1996.

(5) "Child" has the same meaning as defined in the children's online privacy protection act, Title 15 U.S.C. Sec. 6501 through 6506.

(6) "Commission" means the Washington state consumer data privacy commission created in section 15 of this act.

(7) "Consent" means any freely given, specific, informed, and unambiguous indication of the consumer's wishes by which the consumer signifies agreement to the processing of personal data relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use or similar document that contains descriptions of personal data processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through dark patterns does not constitute consent.

(8) "Consumer" means a natural person who is a Washington resident acting only in an individual or household context. It does not include a natural person acting in a commercial or employment context.

(9) "Controller" means the natural or legal person that, alone or jointly with others, determines the purposes and means of the processing of personal data.

(10) "Covered entity" has the same meaning as defined in Title 45 C.F.R., established pursuant to the federal health insurance portability and accountability act of 1996.

(11) "Dark pattern" means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice.

(12) "Decisions that produce legal effects concerning a consumer or similarly significant effects concerning a consumer" means decisions that result in the provision or denial of financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, or access to basic necessities, such as food and water.

(13) "Deidentified data" means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable natural person, or a device linked to such person, provided that the controller that possesses the data: (a) Takes reasonable measures to ensure that the data cannot be associated with a natural person; (b) publicly commits to maintain and use the data only in a deidentified fashion and not attempt to reidentify the data; and (c) contractually obligates any recipients of the information to comply with all provisions of this subsection.

(14) "Health care facility" has the same meaning as defined in RCW 70.02.010.

(15) "Health care information" has the same meaning as defined in RCW 70.02.010.

(16) "Health care provider" has the same meaning as defined in RCW 70.02.010.

(17) "Identified or identifiable natural person" means a person who can be readily identified, directly or indirectly.

(18) "Institutions of higher education" has the same meaning as in RCW 28B.92.030.

(19) "Judicial branch" means any court, agency, commission, or department provided in Title 2 RCW.

(20) "Known child" means a child under circumstances where a controller has actual knowledge of, or willfully disregards, the child's age.

(21) "Legislative agencies" has the same meaning as defined in RCW 44.80.020.

(22) "Local government" has the same meaning as in RCW 39.46.020.

(23) "Nonprofit corporation" has the same meaning as in RCW 24.03A.010.

(24) "Personal data" means any information that is linked or reasonably linkable to an identified or identifiable natural person. "Personal data" does not include deidentified data or publicly available information.

(25) "Process" or "processing" means any operation or set of operations which are performed on personal data or on sets of personal data, whether or not by automated means, such as the collection, use, storage, disclosure, sharing, analysis, deletion, or modification of personal data.

(26) "Processor" means a natural or legal person who processes personal data on behalf of a controller.

(27) "Profiling" means any form of automated processing of personal data to evaluate, analyze, or predict personal aspects concerning an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

(28) "Protected health information" has the same meaning as defined in Title 45 C.F.R., established pursuant to the federal health insurance portability and accountability act of 1996.

(29) "Pseudonymous data" means personal data that cannot be attributed to a specific natural person without the use of additional information, provided that such additional information is kept separately and is subject to appropriate technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

(30) "Publicly available information" means information that is lawfully made available from federal, state, or local government records or information that a controller has a reasonable basis to believe the consumer has lawfully made available to the general public.

(31)(a) "Sale," "sell," or "sold" means the exchange of personal data for monetary or other valuable consideration by the controller to a third party.

(b) "Sale" does not include the following: (i) The disclosure of personal data to a processor who processes the personal data on behalf of the controller; (ii) the disclosure of personal data to a third party with whom the consumer has a direct relationship for purposes of providing a product or service requested by the consumer; (iii) the disclosure or transfer of personal data to an affiliate of the controller; (iv) the disclosure of information that the consumer (A) intentionally made available to the general public via a channel of mass media; and (B) did not restrict to a specific audience; or (v) the disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller's assets.

(32) "Sensitive data" means: (a) Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sexual orientation, or citizenship or immigration status; (b) the processing of genetic or biometric data for the purpose of uniquely identifying a natural person; (c) the personal data from a known child; or (d) specific geolocation data. "Sensitive data" is a form of personal data.

(33) "Specific geolocation data" means information derived from technology including, but not limited to, global positioning system level latitude and longitude coordinates or other mechanisms that directly identifies the specific location of a natural person within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet. Specific geolocation data excludes the content of communications.

(34) "State agency" has the same meaning as in RCW 43.105.020.

(35) "Targeted advertising" means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from a consumer's activities over time and across nonaffiliated websites or online applications to predict the consumer's preferences or interests. It does not include advertising: (a) Based on activities within a controller's own websites or online applications; (b) based on the context of a consumer's current search query or visit to a website or online application; or (c) to a consumer in response to the consumer's request for information or feedback.

(36) "Third party" means a natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or the controller.

NEW SECTION.  Sec. 4. JURISDICTIONAL SCOPE.(1) This chapter applies to legal entities that conduct business in Washington or produce products or services that are targeted to residents of Washington, and that satisfy one or more of the following thresholds:

(a) During a calendar year, controls or processes personal data of 100,000 consumers or more; or

(b) Derives over 25 percent of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more.

(2) This chapter does not apply to:

(a) State agencies, legislative agencies, the judicial branch, local governments, or tribes;

(b) Municipal corporations;

(c) Air carriers;

(d) Information that meets the definition of:

(i) Protected health information for purposes of the federal health insurance portability and accountability act of 1996 and related regulations;

(ii) Health care information for purposes of chapter 70.02 RCW;

(iii) Patient identifying information for purposes of 42 C.F.R. Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2;

(iv) Identifiable private information for purposes of the federal policy for the protection of human subjects, 45 C.F.R. Part 46; identifiable private information that is otherwise information collected as part of human subjects research pursuant to the good clinical practice guidelines issued by the international council for harmonization; the protection of human subjects under 21 C.F.R. Parts 50 and 56; or personal data used or shared in research conducted in accordance with one or more of the requirements set forth in this subsection;

(v) Information and documents created specifically for, and collected and maintained by:

(A) A quality improvement committee for purposes of RCW 43.70.510, 70.230.080, or 70.41.200;

(B) A peer review committee for purposes of RCW 4.24.250;

(C) A quality assurance committee for purposes of RCW 74.42.640 or 18.20.390;

(D) A hospital, as defined in RCW 43.70.056, for reporting of health care-associated infections for purposes of RCW 43.70.056, a notification of an incident for purposes of RCW 70.56.040(5), or reports regarding adverse events for purposes of RCW 70.56.020(2)(b);

(vi) Information and documents created for purposes of the federal health care quality improvement act of 1986, and related regulations;

(vii) Patient safety work product for purposes of 42 C.F.R. Part 3, established pursuant to 42 U.S.C. Sec. 299b-21 through 299b-26; or

(viii) Information that is (A) deidentified in accordance with the requirements for deidentification set forth in 45 C.F.R. Part 164, and (B) derived from any of the health care-related information listed in this subsection (2)(d);

(e) Information originating from, and intermingled to be indistinguishable with, information under (d) of this subsection that is maintained by:

(i) A covered entity or business associate as defined by the health insurance portability and accountability act of 1996 and related regulations;

(ii) A health care facility or health care provider as defined in RCW 70.02.010; or

(iii) A program or a qualified service organization as defined by 42 C.F.R. Part 2, established pursuant to 42 U.S.C. Sec. 290dd-2;

(f) Information used only for public health activities and purposes as described in 45 C.F.R. Sec. 164.512;

(g)(i) An activity involving the collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency, as defined in Title 15 U.S.C. Sec. 1681a(f), by a furnisher of information, as set forth in Title 15 U.S.C. Sec. 1681s-2, who provides information for use in a consumer report, as defined in Title 15 U.S.C. Sec. 1681a(d), and by a user of a consumer report, as set forth in Title 15 U.S.C. Sec. 1681b.

(ii) (g)(i) of this subsection applies only to the extent that such an activity involving the collection, maintenance, disclosure, sale, communication, or use of such information by that agency, furnisher, or user is subject to regulation under the fair credit reporting act, Title 15 U.S.C. Sec. 1681 et seq., and the information is not collected, maintained, used, communicated, disclosed, or sold except as authorized by the fair credit reporting act;

(h) Personal data collected and maintained for purposes of chapter 43.71 RCW;

(i) Personal data collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley act (P.L. 106-102), and implementing regulations, if the collection, processing, sale, or disclosure is in compliance with that law;

(j) Personal data collected, processed, sold, or disclosed pursuant to the federal driver's privacy protection act of 1994 (18 U.S.C. Sec. 2721 et seq.), if the collection, processing, sale, or disclosure is in compliance with that law;

(k) Personal data regulated by the federal family education rights and privacy act, 20 U.S.C. Sec. 1232g and its implementing regulations;

(l) Personal data regulated by the student user privacy in education rights act, chapter 28A.604 RCW;

(m) Personal data collected, maintained, disclosed, or otherwise used in connection with the gathering, dissemination, or reporting of news or information to the public by news media as defined in RCW 5.68.010(5);

(n) Personal data collected, processed, sold, or disclosed pursuant to the federal farm credit act of 1971 (as amended in 12 U.S.C. Sec. 2001-2279cc) and its implementing regulations (12 C.F.R. Part 600 et seq.) if the collection, processing, sale, or disclosure is in compliance with that law; or

(o) Data collected or maintained: (i) In the course of an individual acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business to the extent that it is collected and used solely within the context of that role; (ii) as the emergency contact information of an individual under (o)(i) of this subsection used solely for emergency contact purposes; or (iii) that is necessary for the business to retain to administer benefits for another individual relating to the individual under (o)(i) of this subsection is used solely for the purposes of administering those benefits.

(3) Controllers that are in compliance with the children's online privacy protection act, Title 15 U.S.C. Sec. 6501 through 6506 and its implementing regulations, shall be deemed compliant with any obligation to obtain parental consent under this chapter.

(4) Payment-only credit, check, or cash transactions where no data about consumers are retained do not count as "consumers" for purposes of subsection (1) of this section.

NEW SECTION.  Sec. 5. CONSUMER RIGHTS.(1) A consumer has the right to confirm whether or not a controller is processing personal data concerning the consumer and access the personal data.

(2) A consumer has the right to correct inaccurate personal data concerning the consumer, taking into account the nature of the personal data and the purposes of the processing of the personal data.

(3) A consumer has the right to delete personal data concerning the consumer.

(4) A consumer has the right to obtain personal data concerning the consumer, which the consumer previously provided to the controller, in a portable and, to the extent technically feasible, readily usable format that allows the individual to transmit the data to another controller without hindrance, where the processing is carried out by automated means.

(5) A consumer has the right to opt out of the processing of personal data concerning such a consumer for the purposes of (a) targeted advertising; (b) the sale of personal data; or (c) profiling in furtherance of decisions that produce legal effects concerning a consumer or similarly significant effects concerning a consumer.

NEW SECTION.  Sec. 6. EXERCISING CONSUMER RIGHTS.(1) Consumers may exercise the rights set forth in section 5 of this act by submitting a request, at any time, to a controller specifying which rights the individual wishes to exercise.

(2) In the case of processing personal data of a known child, the parent or legal guardian of the known child may exercise the rights of this chapter on the child's behalf.

(3) In the case of processing personal data concerning a consumer subject to guardianship, conservatorship, or other protective arrangement under chapter 11.130 RCW, the guardian or the conservator of the consumer may exercise the rights of this chapter on the consumer's behalf.

(4) Beginning July 1, 2024, a consumer may exercise the rights under section 5(5) (a) and (b) of this act through a user-selected universal opt-out mechanism that meets the technical specifications established by the commission pursuant to section 14 of this act.

NEW SECTION.  Sec. 7. RESPONDING TO REQUESTS.(1) Except as provided in this chapter, the controller must comply with a request to exercise the rights pursuant to section 5 of this act.

(2)(a) Controllers must provide one or more secure and reliable means for consumers to submit a request to exercise their rights under this chapter. These means must take into account the ways in which consumers interact with the controller and the need for secure and reliable communication of the requests.

(b) Controllers may not require a consumer to create a new account in order to exercise a right, but a controller may require a consumer to use an existing account to exercise the consumer's rights under this chapter.

(3) A controller must comply with a request to exercise the right in section 5(5) of this act as soon as feasibly possible, but no later than 15 days of receipt of the request.

(4)(a) A controller must inform a consumer of any action taken on a request to exercise any of the rights in section 5 of this act without undue delay and in any event within 45 days of receipt of the request. That period may be extended once by 45 additional days where reasonably necessary, taking into account the complexity and number of the requests. The controller must inform the consumer of any such extension within 45 days of receipt of the request, together with the reasons for the delay.

(b) If a controller does not take action on the request of a consumer, the controller must inform the consumer without undue delay and at the latest within 45 days of receipt of the request of the reasons for not taking action and instructions for how to appeal the decision with the controller as described in subsection (5) of this section.

(c) Information provided under this section must be provided by the controller to the consumer free of charge, up to twice annually. Where requests from a consumer are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: (i) Charge a reasonable fee to cover the administrative costs of complying with the request; or (ii) refuse to act on the request. The controller bears the burden of demonstrating the manifestly unfounded or excessive character of the request.

(d) A controller is not required to comply with a request to exercise any of the rights under section 5 of this act if the controller is unable to authenticate the request using commercially reasonable efforts. In such a case, the controller may request the provision of additional information reasonably necessary to authenticate the request.

(5)(a) Controllers must establish an internal process whereby consumers may appeal a refusal to take action on a request to exercise any of the rights under section 5 of this act within a reasonable period of time after the consumer's receipt of the notice sent by the controller under subsection (4)(b) of this section.

(b) The appeal process must be conspicuously available and as easy to use as the process for submitting such a request under this section.

(c) Within 30 days of receipt of an appeal, a controller must inform the consumer of any action taken or not taken in response to the appeal, along with a written explanation of the reasons in support thereof. That period may be extended by 60 additional days where reasonably necessary, taking into account the complexity and number of the requests serving as the basis for the appeal. The controller must inform the consumer of such an extension within 30 days of receipt of the appeal, together with the reasons for the delay. The controller must also provide the consumer with an email address or other online mechanism through which the consumer may submit the appeal, along with any action taken or not taken by the controller in response to the appeal and the controller's written explanation of the reasons in support thereof, to the attorney general.

(d) When informing a consumer of any action taken or not taken in response to an appeal pursuant to (c) of this subsection, the controller must clearly and prominently provide the consumer with information about how to file a complaint with the commission. The controller must maintain records of all such appeals and how it responded to them for at least 24 months and shall, upon request, compile and provide a copy of such records to the attorney general.

NEW SECTION.  Sec. 8. RESPONSIBILITY ACCORDING TO ROLE.(1) Controllers and processors are responsible for meeting their respective obligations established under this chapter.

(2) Processors are responsible under this chapter for adhering to the instructions of the controller and assisting the controller to meet its obligations under this chapter. This assistance includes the following:

(a) Taking into account the nature of the processing, the processor shall assist the controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the controller's obligation to respond to consumer requests to exercise their rights pursuant to section 5 of this act; and

(b) Taking into account the nature of processing and the information available to the processor, the processor shall: Assist the controller in meeting the controller's obligations in relation to the security of processing the personal data and in relation to the notification of a breach of the security of the system pursuant to RCW 19.255.010; and provide information to the controller necessary to enable the controller to conduct and document any data protection assessments required by section 11 of this act. The controller and processor are each responsible for only the measures allocated to them.

(3) Notwithstanding the instructions of the controller, a processor shall:

(a) Ensure that each person processing the personal data is subject to a duty of confidentiality with respect to the data; and

(b) Engage a subcontractor only after providing the controller with an opportunity to object and pursuant to a written contract in accordance with subsection (5) of this section that requires the subcontractor to meet the obligations of the processor with respect to the personal data.

(4) Taking into account the context of processing, the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk and establish a clear allocation of the responsibilities between them to implement such measures.

(5) Processing by a processor must be governed by a contract between the controller and the processor that is binding on both parties and that sets out the processing instructions to which the processor is bound, including the nature and purpose of the processing, the type of personal data subject to the processing, the duration of the processing, and the obligations and rights of both parties. In addition, the contract must include the requirements imposed by this subsection and subsections (3) and (4) of this section, as well as the following requirements:

(a) At the choice of the controller, the processor shall delete or return all personal data to the controller as requested at the end of the provision of services, unless retention of the personal data is required by law;

(b)(i) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations in this chapter; and

(ii) The processor shall allow for, and contribute to, reasonable audits and inspections by the controller or the controller's designated auditor. Alternatively, the processor may, with the controller's consent, arrange for a qualified and independent auditor to conduct, at least annually and at the processor's expense, an audit of the processor's policies and technical and organizational measures in support of the obligations under this chapter using an appropriate and accepted control standard or framework and audit procedure for the audits as applicable, and provide a report of the audit to the controller upon request.

(6) In no event may any contract relieve a controller or a processor from the liabilities imposed on them by virtue of its role in the processing relationship as defined by this chapter.

(7) Determining whether a person is acting as a controller or processor with respect to a specific processing of data is a fact-based determination that depends upon the context in which personal data are to be processed. A person that is not limited in its processing of personal data pursuant to a controller's instructions, or that fails to adhere to such instructions, is a controller and not a processor with respect to a specific processing of data. A processor that continues to adhere to a controller's instructions with respect to a specific processing of personal data remains a processor. If a processor begins, alone or jointly with others, determining the purposes and means of the processing of personal data, it is a controller with respect to the processing.

NEW SECTION.  Sec. 9. RESPONSIBILITIES OF CONTROLLERS.(1)(a) Controllers shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes:

(i) The categories of personal data processed by the controller;

(ii) The purposes for which the categories of personal data are processed;

(iii) How and where consumers may exercise the rights contained in section 5 of this act, including how a consumer may appeal a controller's action with regard to the consumer's request;

(iv) The categories of personal data that the controller shares with third parties, if any; and

(v) The categories of third parties, if any, with whom the controller shares personal data.

(b) If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller must clearly and conspicuously disclose the processing, as well as the manner in which a consumer may exercise the right to opt out of the processing, in a clear and conspicuous manner.

(2) A controller's collection of personal data must be limited to what is reasonably necessary in relation to the purposes for which the data is processed.

(3) A controller's collection of personal data must be adequate, relevant, and limited to what is reasonably necessary in relation to the purposes for which the data is processed.

(4) Except as provided in this chapter, a controller may not process personal data for purposes that are not reasonably necessary to, or compatible with, the purposes for which the personal data is processed unless the controller obtains the consumer's consent.

(5) A controller shall establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data. The data security practices must be appropriate to the volume and nature of the personal data at issue.

(6) A controller shall not process personal data on the basis of a consumer's or a class of consumers' actual or perceived race, color, ethnicity, religion, national origin, sex, gender, gender identity, sexual orientation, familial status, lawful source of income, or disability, in a manner that unlawfully discriminates against the consumer or class of consumers with respect to the offering or provision of: (a) Housing; (b) employment; (c) credit; (d) education; or (e) the goods, services, facilities, privileges, advantages, or accommodations of any place of public accommodation.

(7) A controller may not discriminate against a consumer for exercising any of the rights contained in this chapter, including denying goods or services to the consumer, charging different prices or rates for goods or services, and providing a different level of quality of goods and services to the consumer. This subsection does not prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the offering is in connection with a consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program. If a consumer exercises their right pursuant to section 5(5) of this act, a controller may not sell personal data to a third-party controller as part of such a program unless: (a) The sale is reasonably necessary to enable the third party to provide a benefit to which the consumer is entitled; (b) the sale of personal data to third parties is clearly disclosed in the terms of the program; and (c) the third party uses the personal data only for purposes of facilitating such a benefit to which the consumer is entitled and does not retain or otherwise use or disclose the personal data for any other purpose.

(8) Except as otherwise provided in this chapter, a controller may not process sensitive data concerning a consumer without obtaining the consumer's consent or, in the case of the processing of sensitive data of a known child, without obtaining consent from the child's parent or lawful guardian, in accordance with the children's online privacy protection act requirements.

(9) Any provision of a contract or agreement of any kind that purports to waive or limit in any way a consumer's rights under this chapter is deemed contrary to public policy and is void and unenforceable.

NEW SECTION.  Sec. 10. PROCESSING DEIDENTIFIED DATA OR PSEUDONYMOUS DATA.(1) This chapter does not require a controller or processor to do any of the following solely for purposes of complying with this chapter:

(a) Reidentify deidentified data;

(b) Comply with an authenticated consumer request to access, correct, delete, or port personal data pursuant to section 5 (1) through (4) of this act, if all of the following are true:

(i)(A) The controller is not reasonably capable of associating the request with the personal data; or (B) it would be unreasonably burdensome for the controller to associate the request with the personal data;

(ii) The controller does not use the personal data to recognize or respond to the specific consumer who is the subject of the personal data, or associate the personal data with other personal data about the same specific consumer; and

(iii) The controller does not sell the personal data to any third party or otherwise voluntarily disclose the personal data to any third party other than a processor, except as otherwise permitted in this section; or

(c) Maintain data in identifiable form, or collect, obtain, retain, or access any data or technology, in order to be capable of associating an authenticated consumer request with personal data.

(2) The rights contained in section 5 (1) through (4) of this act do not apply to pseudonymous data in cases where the controller is able to demonstrate any information necessary to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing such information.

(3) A controller that uses pseudonymous data or deidentified data must exercise reasonable oversight to monitor compliance with any contractual commitments to which the pseudonymous data or deidentified data are subject and must take appropriate steps to address any breaches of contractual commitments.

NEW SECTION.  Sec. 11. DATA PROTECTION ASSESSMENTS.(1) Controllers must conduct and document a data protection assessment of each of the following processing activities involving personal data:

(a) The processing of personal data for purposes of targeted advertising;

(b) The processing of personal data for the purposes of the sale of personal data;

(c) The processing of personal data for purposes of profiling, where such profiling presents a reasonably foreseeable risk of: (i) Unfair or deceptive treatment of, or disparate impact on, consumers; (ii) financial, physical, or reputational injury to consumers; (iii) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; or (iv) other substantial injury to consumers;

(d) The processing of sensitive data; and

(e) Any processing activities involving personal data that present a heightened risk of harm to consumers.

Such data protection assessments must take into account the type of personal data to be processed by the controller, including the extent to which the personal data are sensitive data, and the context in which the personal data are to be processed.

(2) Data protection assessments conducted under subsection (1) of this section must identify and weigh the benefits that may flow directly and indirectly from the processing to the controller, consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks. The use of deidentified data and the reasonable expectations of consumers, as well as the context of the processing and the relationship between the controller and the consumer whose personal data will be processed, must be factored into this assessment by the controller.

(3) The attorney general may request, in writing, that a controller disclose any data protection assessment that is relevant to an investigation conducted by the attorney general. The controller must make a data protection assessment available to the attorney general upon such a request. The attorney general may evaluate the data protection assessments for compliance with the responsibilities contained in section 9 of this act and, if it serves a civil investigative demand, with RCW 19.86.110. Data protection assessments are confidential and exempt from public inspection and copying under chapter 42.56 RCW. The disclosure of a data protection assessment pursuant to a request from the attorney general under this subsection does not constitute a waiver of the attorney-client privilege or work product protection with respect to the assessment and any information contained in the assessment unless otherwise subject to case law regarding the applicability of attorney-client privilege or work product protections.

(4) Data protection assessments conducted by a controller for the purpose of compliance with other laws or regulations may qualify under this section if they have a similar scope and effect.

NEW SECTION.  Sec. 12. LIMITATIONS AND APPLICABILITY.(1) The obligations imposed on controllers or processors under this chapter do not restrict a controller's or processor's ability to:

(a) Comply with federal, state, or local laws, rules, or regulations;

(b) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities;

(c) Cooperate with law enforcement agencies concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local laws, rules, or regulations;

(d) Investigate, establish, exercise, prepare for, or defend legal claims;

(e) Provide a product or service specifically requested by a consumer or the parent or guardian of a child, perform a contract to which the consumer or the parent or guardian of a child is a party, or take steps at the request of the consumer or the parent or guardian of a child prior to entering into a contract;

(f) Take immediate steps to protect an interest that is essential for the life of the consumer or of another natural person, and where the processing cannot be manifestly based on another legal basis;

(g) Prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action;

(h) Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board, human subjects research ethics review board, or a similar independent oversight entity that determines: (i) If the research is likely to provide substantial benefits that do not exclusively accrue to the controller; (ii) the expected benefits of the research outweigh the privacy risks; and (iii) if the controller has implemented reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with reidentification; or

(i) Assist another controller, processor, or third party with any of the obligations under this subsection.

(2) The obligations imposed on controllers or processors under this chapter do not restrict a controller's or processor's ability to collect, use, or retain data to:

(a) Identify and repair technical errors that impair existing or intended functionality; or

(b) Perform solely internal operations that are reasonably aligned with the expectations of the consumer based on the consumer's existing relationship with the controller, or are otherwise compatible with processing in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party when those internal operations are performed during, and not following, the consumer's relationship with the controller.

(3) The obligations imposed on controllers or processors under this chapter do not apply where compliance by the controller or processor with this chapter would violate an evidentiary privilege under Washington law and do not prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under Washington law as part of a privileged communication.

(4) A controller or processor that discloses personal data to a third-party controller or processor in compliance with the requirements of this chapter is not in violation of this chapter if the recipient processes such personal data in violation of this chapter, provided that, at the time of disclosing the personal data, the disclosing controller or processor did not have actual knowledge that the recipient intended to commit a violation. A third-party controller or processor receiving personal data from a controller or processor in compliance with the requirements of this chapter is likewise not in violation of this chapter for the obligations of the controller or processor from which it receives such personal data.

(5) Obligations imposed on controllers and processors under this chapter shall not:

(a) Adversely affect the rights or freedoms of any persons, such as exercising the right of free speech pursuant to the First Amendment to the United States Constitution; or

(b) Apply to the processing of personal data by a natural person in the course of a purely personal or household activity.

(6) Processing personal data solely for the purposes expressly identified in subsection (1)(a) through (g) of this section does not, by itself, make an entity a controller with respect to the processing.

(7) If a controller processes personal data pursuant to an exemption in this section, the controller bears the burden of demonstrating that the processing qualifies for the exemption and complies with the requirements in subsection (8) of this section.

(8)(a) Personal data that is processed by a controller pursuant to this section must not be processed for any purpose other than those expressly listed in this section.

(b) Personal data that is processed by a controller pursuant to this section may be processed solely to the extent that such processing is: (i) Necessary, reasonable, and proportionate to the purposes listed in this section; (ii) adequate, relevant, and limited to what is necessary in relation to the specific purpose or purposes listed in this section; and (iii) insofar as possible, taking into account the nature and purpose of processing the personal data, subjected to reasonable administrative, technical, and physical measures to protect the confidentiality, integrity, and accessibility of the personal data, and to reduce reasonably foreseeable risks of harm to consumers.

NEW SECTION.  Sec. 13. REGISTRATION FEE.(1) By January 31st following each year in which a controller or a processor meets the jurisdictional scope pursuant to section 4 of this act and is subject to the requirements of this chapter, a controller or a processor shall register with the commission pursuant to the requirements of this section.

(2) In registering with the commission pursuant to subsection (1) of this section, a controller or processor shall:

(a) Pay a registration fee in an amount determined by the commission, not to exceed the reasonable costs of establishing and maintaining the website required in section 16 of this act; and

(b) Provide the following information:

(i) The name of the controller or processor and its primary physical, email, and internet website addresses;

(ii) Any information on how consumers can exercise the rights specified in section 5 of this act; and

(iii) Any additional information or explanation the controller or processor chooses to provide concerning its data collection and processing practices.

(3) A controller or processor that fails to register as required in this section is liable for: (a) A civil penalty of $50 for each day, not to exceed a total of $10,000 for each year, it fails to register pursuant to this section; (b) an amount equal to the fees due under this section during the period it failed to register pursuant to this section; and (c) other penalties imposed by law.

(4) This section does not apply to a covered entity, a health care facility, or a health care provider.

NEW SECTION.  Sec. 14. UNIVERSAL OPT OUT.(1)(a) By January 1, 2024, the commission must adopt rules, pursuant to chapter 34.05 RCW, that detail the technical specifications for one or more universal opt-out mechanisms that clearly communicate a consumer's affirmative, freely given, and unambiguous choice to exercise the rights under section 5(5) (a) and (b) of this act. The commission may update these rules as needed to reflect the means by which consumers interact with controllers.

(b) The rules must:

(i) Not permit the manufacturer of a platform, browser, device, or any other product offering a universal opt-out mechanism to unfairly disadvantage another controller;

(ii) Require controllers to inform consumers about the opt-out choices available under section 5(5) (a) and (b) of this act;

(iii) Not adopt a mechanism that is a default setting, but rather clearly represents the consumer's affirmative, freely given, and unambiguous choice to opt out of processing pursuant to section 5(5) (a) or (b) of this act;

(iv) Adopt a mechanism that is consumer-friendly, clearly described, and easy to use by the average consumer;

(v) Adopt a mechanism that is as consistent as possible with any other similar mechanism required by law or regulation in the United States; and

(vi) Permit the controller to accurately authenticate the consumer as a Washington resident and determine that the mechanism represents a legitimate request to opt out of the processing of personal data for purposes of targeted advertising or the sale of personal data pursuant to section 5(5) (a) or (b) of this act.

(2)(a) Beginning July 1, 2024, a controller that processes personal data of a consumer for the purposes of targeted advertising or the sale of personal data shall allow consumers to exercise the rights under section 5(5) (a) and (b) of this act through a user-selected universal opt-out mechanism that meets the technical specifications established by the commission pursuant to subsection (1) of this section.

(b) Notwithstanding a consumer's decision to exercise the rights under section 5(5) (a) or (b) of this act through a user-selected universal opt-out mechanism, a controller may enable a consumer to consent, through a web page, application, or a similar method, to the processing of the consumer's personal data for purposes of targeted advertising or the sale of personal data. This consent takes precedence over any choice reflected through the universal opt-out mechanism.

(c) Before obtaining a consumer's consent to process personal data for purposes of targeted advertising or the sale of personal data pursuant to this subsection, a controller shall provide the consumer with a clear and conspicuous notice: (i) Informing the consumer about the choices available under this section; (ii) describing the categories of personal data to be processed and the purposes for which they will be processed; and (iii) explaining how and where the consumer may withdraw consent.

(d) The web page, application, or other means by which a controller obtains a consumer's consent to process personal data for purposes of targeted advertising or the sale of personal data must also allow the consumer to revoke the consent as easily as it is affirmatively provided.

(3)(a) Beginning January 1, 2025, the commission shall conduct an analysis of the rule requirements specified in subsection (1)(b) of this section to determine if any revisions or clarifications are needed in order to establish technical specifications that enable a consumer to exercise their rights under section 5(5) (a) and (b) of this act through a universal opt-out mechanism more effectively and efficiently. The commission's analysis may also include an examination of other market trends and regulatory requirements regarding universal opt-out mechanisms to assess whether specifications, such as default opt-out settings, are increasing in adoption rates.

(b) By November 1, 2025, the commission must submit a report of its findings and recommendations for any requirement revisions or clarifications based on the analysis conducted in (a) of this subsection to the governor and the appropriate committees of the legislature.

NEW SECTION.  Sec. 15. WASHINGTON STATE CONSUMER DATA PRIVACY COMMISSION.(1) The Washington state consumer data privacy commission is created and vested with administrative powers and rule-making and administrative enforcement authority to implement and enforce this act and the rules adopted by the commission.

(2) The commission is composed of three commissioners appointed by the governor, with the advice and consent of the senate, as provided in this subsection:

(a) One commissioner must be a representative of the public and a lawyer with demonstrated expertise in the area of data privacy, appointed from a mutually agreed to list of not less than three active or judicial members of the Washington state bar association, submitted to the governor by the two organizations defined in (b) and (c) of this subsection;

(b) One commissioner must be a representative of consumers and selected from a list of not less than three names submitted to the governor by an independent, nonprofit member organization that represents consumers in the marketplace; and

(c) One commissioner must be a representative of controllers and processors, appointed from a list of at least three names submitted to the governor by a recognized statewide organization of controllers and processors, representing a majority of controllers and processors.

(3) Each commissioner shall:

(a) Have qualifications, experience, and skills, in particular in the areas of privacy and technology, required to perform the duties of the commission and exercise its powers and authority;

(b) Maintain the confidentiality of information that has come to their knowledge in the course of the performance of their tasks or exercise of their powers, except to the extent that disclosure is required by chapter 42.56 RCW;

(c) Remain free from external influence, whether direct or indirect, and neither seek nor take instructions from another;

(d) Refrain from any action incompatible with their duties or engage in any incompatible occupation, whether gainful or not, during their term;

(e) Have the right of access to all information made available by the commission to the chair of the commission;

(f) Be precluded, for a period of one year after leaving office, from accepting employment with a controller or processor that was subject to an enforcement action or civil action under this chapter during the member's tenure or during the five-year period preceding the member's appointment; and

(g) Be precluded for a period of two years after leaving office from acting, for compensation, as an agent or attorney for, or otherwise representing, any other person in a matter pending before the commission if the purpose is to influence an action of the commission.

(4) Each commissioner must receive a salary as may be fixed by the governor in accordance with the provisions of RCW 43.03.040.

(5) The commission must appoint an executive director and set, within the limits established by the office of financial management under RCW 43.03.028, the executive director's compensation. The executive director shall perform such duties and have such powers as the commission may prescribe and delegate to implement and enforce this chapter efficiently and effectively. The commission may not delegate its authority to:

(a) Adopt, amend, or rescind rules;

(b) Determine that a violation of this chapter has occurred; or

(c) Assess penalties for violations.

(6) The commission may employ technical, administrative, and other staff as necessary to carry out the commission's duties and powers as prescribed in this chapter. The Washington utilities and transportation commission shall provide all administrative staff support for the Washington state consumer data privacy commission, which shall otherwise retain its independence in exercising its powers, functions, and duties and its supervisory control over nonadministrative staff.

NEW SECTION.  Sec. 16. COMMISSION—DUTIES, POWERS, AND RULE MAKING.(1) The Washington state consumer data privacy commission must:

(a) Review and investigate consumer complaints, or complaints initiated on its own, of alleged violations of this act pursuant to section 17 of this act;

(b) Adopt, amend, and rescind suitable rules under chapter 34.05 RCW, the administrative procedure act, to carry out the purposes and provisions of this chapter;

(c) Administer, implement, and enforce through administrative actions this chapter and rules adopted by the commission;

(d) Develop guidance for consumers regarding their rights and for controllers and processors regarding their obligations under this chapter;

(e) Provide technical assistance and advice to the legislature, upon request, with respect to privacy-related legislation;

(f) Monitor relevant developments relating to the protection of personal data and, in particular, the development of information and communication technologies and commercial practices;

(g) Cooperate with other jurisdictions with similar consumer data privacy laws to ensure consistent application of consumer data privacy protections;

(h) Periodically review statutory definitions and make recommendations to the legislature to update the definitions based on changes in the industry;

(i) Establish and collect an annual fee pursuant to section 20 of this act;

(j) Detail the technical specifications for one or more universal opt-out mechanisms that clearly communicate a consumer's affirmative, freely given, and unambiguous choice to exercise the rights under section 5(5) (a) and (b) of this act pursuant to section 14 of this act;

(k) Perform all other acts necessary and appropriate in the exercise of its power, authority, and jurisdiction to protect consumer rights pursuant to this chapter and seek to balance the goals of strengthening protections for consumers' fundamental right to privacy while giving attention to the impact on controllers and processors; and

(l) Establish and maintain a page on its internet website where the information provided by controllers under section 13 of this act is accessible to the public.

(2) The commission may consult with the office of privacy and data protection created in RCW 43.105.369 in the provisions of subsection (1)(d) through (h) of this section.

(3) The commission may order a controller or processor to provide any information the commission requires for the performance of its duties pursuant to this chapter, including access to a controller's or processor's premises and data processing equipment and means.

(4) The commission may subpoena witnesses, compel their attendance, administer oaths, take the testimony of any person under oath, and require by subpoena the production of any books, papers, records, or other items material to the performance of the commission's duties or exercise of its powers including, but not limited to, its power to audit a controller's or processor's compliance with this chapter and any rules adopted by the commission pursuant to subsection (1)(b) of this section.

NEW SECTION.  Sec. 17. ADMINISTRATIVE ENFORCEMENT.(1) Upon the complaint of a consumer or on its own initiative, the Washington state consumer data privacy commission may investigate alleged violations by a controller or processor of this chapter or any rules issued by the commission. The commission may decide not to investigate a complaint. In making a decision not to investigate or provide more time to cure, the commission may consider the following:

(a) Lack of intent to violate this chapter or any rules issued by the commission; and

(b) Voluntary efforts undertaken by the controller or processor to cure the alleged violation prior to being notified by the commission of the complaint.

(2) The commission shall provide written notification to the consumer who made the complaint of the action, if any, the commission has taken or plans to take on the complaint, together with the reasons for that action or nonaction.

(3)(a) The commission may not make a finding that there is reason to believe that a violation has occurred unless, at least 30 days prior to the commission's consideration of the alleged violation, the alleged violator is:

(i) Notified of the alleged violation by service of process or registered mail with return receipt requested;

(ii) Provided with a summary of the evidence; and

(iii) Informed of their right to be present in person and represented by counsel at any proceeding of the commission held for the purpose of considering whether there is reason to believe that a violation has occurred.

(b) Notice to the alleged violator is deemed made on the date of service, the date the registered mail receipt is signed, or if the registered mail receipt is not signed, the date returned by the post office.

(c) A proceeding held for the purpose of considering whether there is reason to believe that a violation has occurred is private unless the alleged violator files with the commission a written request that the proceeding be public.

(4)(a) If the commission determines there is reason to believe that this chapter or a rule adopted by the commission has been violated, prior to holding a hearing pursuant to subsection (5) of this section, the commission shall issue to the controller or processor a warning letter identifying specific provisions of this chapter or rules adopted by the commission it believes have been or are being violated.

(b) Within 30 days of the issuance of the warning letter, the controller or processor shall provide the commission with a written response to explain that the alleged violation has not been committed or to summarize how the violation has been cured.

(c) Upon the receipt of the controller's or processor's response, the commission shall make a written finding as to whether a violation has been committed and whether the violation has been cured. If the commission finds that no violation has been committed or the violation has been cured, the commission shall close the matter. If the commission finds the violation has not been cured, the commission may proceed with the administrative hearing pursuant to subsection (5) of this section.

(5)(a) When the commission determines there is reason to believe that this chapter or a rule adopted by the commission has been violated and that the violation has not been cured pursuant to subsection (4) of this section, it shall hold a hearing to determine if a violation has occurred. Notice must be given and the hearing conducted in accordance with chapter 34.05 RCW, the administrative procedure act. The commission shall have all the powers granted by that chapter.

(b)(i) If the commission determines on the basis of the hearing conducted pursuant to (a) of this subsection that a violation has occurred, the commission shall issue an order that may require the violator to do all or any of the following:

(A) Cease and desist the violation; or

(B) Pay an administrative fine of up to $2,500 for each violation, or up to $7,500 for each intentional violation and each violation involving the personal data of a child.

(ii) In addition to any other remedies provided by law, the commission's order issued pursuant to this subsection (5)(b) may be enforced in accordance with chapter 34.05 RCW.

(c) All receipts from the imposition of administrative fines under this section must be deposited into the consumer privacy account created in section 21 of this act.

(d) When the commission determines that no violation has occurred, it shall publish a declaration so stating.

(6) Any decision of the commission with respect to a complaint or administrative fine is subject to judicial review in an action brought by a party to the complaint or administrative fine and is subject to an abuse of discretion standard.

(7)(a) Upon reviewing a complaint, the commission may refer the complaint to the attorney general for civil enforcement under the consumer protection act, chapter 19.86 RCW. The commission and the attorney general may consult prior to referral to determine the appropriate enforcement mechanism.

(b) If the commission retains the complaint for enforcement under the commission's authority pursuant to this chapter and reaches a final determination pursuant to subsection (5)(b) of this section, then the attorney general shall not pursue enforcement of the complaint on the same alleged violation under the consumer protection act, chapter 19.86 RCW.

(c) If the commission and the attorney general determine that the attorney general should assume enforcement as to the complaint, then the commission shall not pursue enforcement of a complaint on the same alleged violation under this chapter.

NEW SECTION.  Sec. 18. PRIVATE RIGHT OF ACTION.(1) Nothing in this chapter creates an independent cause of action, except for the actions brought by the attorney general to enforce this chapter. No person, except for the attorney general, may enforce the rights and protections created by this chapter in any action whatsoever, whether based on statute, including a chapter 19.86 RCW claim, tort or otherwise, and whether as an individual or in a class or other representative basis.

(2) Except as provided in subsection (1) of this section, nothing in this chapter limits a person to bring, participate in, or benefit from any independent cause of action, including any constitutional, statutory, administrative, or common law rights or causes of action, whether as an individual or in a class or other representative basis so long as the cause of action is not based upon an alleged violation of the rights and protections created in this chapter. The rights and protections in this chapter are not exclusive, and to the extent that a person has the rights and protections in this chapter because of another law other than this chapter, the person continues to have those rights and protections notwithstanding the existence of this chapter. Included within those existing rights and protections are any rights and protections derived from other laws in this or any other state or in any federal jurisdiction that are independent from the rights and protections in this chapter.

NEW SECTION.  Sec. 19. ENFORCEMENT BY THE ATTORNEY GENERAL.(1) This chapter may be enforced solely by the attorney general under the consumer protection act, chapter 19.86 RCW.

(2) In actions brought by the attorney general, the legislature finds: (a) The practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW, and (b) a violation of this chapter is not reasonable in relation to the development and preservation of business, is an unfair or deceptive act in trade or commerce, and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

(3) The legislative declarations in this section shall not apply to any claim or action by any party other than the attorney general alleging that conduct regulated by this chapter violates chapter 19.86 RCW, and this chapter does not incorporate RCW 19.86.093.

(4) In the event of a controller's or processor's violation under this chapter, prior to filing a complaint, the attorney general must provide the controller or processor with a warning letter identifying the specific provisions of this chapter the attorney general alleges have been or are being violated. If, after 30 days of issuance of the warning letter, the attorney general believes the controller or processor has failed to cure any alleged violation, the attorney general may bring an action against the controller or processor as provided under this chapter.

(5) In determining a civil penalty under this chapter, the court must consider as mitigating factors a controller's or processor's good faith efforts to comply with the requirements of this chapter and any actions to cure or remedy the violations before an action is filed.

(6) All receipts from the imposition of civil penalties under this chapter must be deposited into the consumer privacy account created in section 21 of this act.

(7) No action may be filed by the attorney general under this section for any violation of this chapter by a controller or processor after the commission has issued a determination pursuant to section 17(5)(b) of this act against that controller or processor for the same violation.

NEW SECTION.  Sec. 20. ANNUAL FEE.(1) The commission, in consultation with the department of revenue, shall determine an annual fee structure, not to exceed, in aggregate, $10,000,000 annually, for controllers and processors subject to this chapter to pay to the commission with the purpose of funding the operating costs of the commission.

(2) By December 1, 2023, the commission shall submit the annual fee structure determined in subsection (1) of this section and recommendations for potential legislation for implementing the annual fee structure to the governor and the appropriate committees of the legislature.

NEW SECTION.  Sec. 21. CONSUMER PRIVACY ACCOUNT.The consumer privacy account is created in the state treasury. All receipts from the imposition of civil penalties under this chapter must be deposited into the account. Moneys in the account may be spent only after appropriation. Moneys in the account may only be used for the purposes of recovery of costs and attorneys' fees accrued by the attorney general in enforcing this chapter and for the operating costs incurred by the commission. Moneys may not be used to supplant general fund appropriations to either agency.

NEW SECTION.  Sec. 22. PREEMPTION.(1) Except as provided in this section, this chapter supersedes and preempts laws, ordinances, regulations, or the equivalent adopted by any local entity regarding the processing of personal data by controllers or processors.

(2) Laws, ordinances, or regulations regarding the processing of personal data by controllers or processors that are adopted by any local entity prior to July 1, 2021, are not superseded or preempted.

NEW SECTION.  Sec. 24. A new section is added to chapter 42.56 RCW to read as follows:

Data protection assessments submitted by a controller to the attorney general in accordance with requirements under section 11 of this act are exempt from disclosure under this chapter.

On page 1, line 1 of the title, after "data;" strike the remainder of the title and insert "adding a new section to chapter 42.56 RCW; adding a new chapter to Title 19 RCW; creating a new section; prescribing penalties; and providing an effective date."