H-1248.1
HOUSE BILL 1552
State of Washington | 67th Legislature | 2021 Regular Session |
ByRepresentatives Boehnke, Chambers, Schmick, and Robertson
Read first time 03/10/21.Referred to Committee on State Government & Tribal Relations.
AN ACT Relating to protecting personal data collected by state agencies; adding new sections to chapter
43.105 RCW; and creating a new section.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:
NEW SECTION. Sec. 1. The legislature finds that the state of Washington has been selling the personal data of its citizens to third-party vendors. This practice violates the state's obligation to respect and protect its citizens' personal property and it must come to an end. The legislature therefore intends to prohibit state agencies from selling personal data to third parties.
NEW SECTION. Sec. 2. A new section is added to chapter
43.105 RCW to read as follows:
(1) The sale of personal data by a state agency to a third party is prohibited.
(2) By December 31st of each year, a state agency must certify compliance with the requirements of this section to the office of privacy and data protection.
(3) As used in this section:
(a) "Personal data" means any information relating to a natural person that is collected by a state agency.
(b) "Sale" means the exchange of personal data for monetary consideration, other than cost recovery as permitted by law, to a third party.
NEW SECTION. Sec. 3. A new section is added to chapter
43.105 RCW to read as follows:
(1) A state agency must be transparent and accountable for its processing of personal data by making available to state residents and property owners a privacy notice that includes:
(a) The categories of personal data collected by the state agency;
(b) The categories of personal data that the state agency shares with third parties, if any, and the purposes for which that data is shared; and
(c) The categories of third parties, if any, with whom the state agency shares personal data.
(2) As used in this section:
(a) "Personal data" has the same meaning as defined in section 2 of this act.
(b) "Processing" means any operation or set of operations that is performed on personal data or sets of personal data, such as collection, storage, alteration, retrieval, use, disclosure, or dissemination.
--- END ---