H-3921

AN ACT Relating to privacy; adding new sections to chapter 9.73 RCW; creating a new section; and prescribing penalties.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION. Sec. 1. The Constitution of the state of Washington provides that "no person shall be disturbed in his private affairs, or his home invaded, without authority of law." The legislature finds that the advancement of technology has made electronic transfer of personal data quick, easy, and commonplace, and it is in the interest of the state to regulate the dissemination of that information in order that its citizens' right to privacy is not abused. Therefore, the legislature prescribes certain safeguards for the use of private information maintained by public and private entities that collect personally identifying information.

NEW SECTION. Sec. 2. A new section is added to chapter 9.73 RCW to read as follows:

(1) Prior to the sale, marketing, transmission, release, or dissemination of personally identifying information, other than name, address, and telephone number, a public or private entity must obtain the written consent of the person identified in the information. Written consent under this subsection may be for a specific purpose or for all purposes, but shall be valid for no longer than one year. A request for consent under this subsection shall include a notice of the purposes for which consent is sought and the entities that are likely to receive the information. A person who has given permission for the dissemination of personally identifying information under this subsection at any time may request the entity providing the information to provide a copy of the information. Any person who has given written consent under this subsection to the dissemination of personally identifiable information may rescind that permission in writing. The entity disseminating the information shall cease making available the personally identifying information within thirty days after the date of the written notice.

(2) A public or private entity may disseminate the name, address, or telephone number of a person unless that person has requested in writing that the person's name not be disseminated. The entity disseminating the name, address, or telephone number shall cease making the information available within thirty days after the date of the written request.

(3) Information which can personally identify a person includes, but is not limited to: The type or nature of purchases; usage patterns, such as use of electricity, gas, or telephone and amount of usage, time of day of usage, or types or frequencies of phone calls made; personal financial information and credit worthiness; and demographic information by individual or family.

(4) This section shall not apply to the dissemination of personally identifiable information specifically authorized by other statute or disseminated during the course of a criminal investigation.

NEW SECTION. Sec. 3. A new section is added to chapter 9.73 RCW to read as follows:

(1) Upon written request of the customer, a consumer reporting agency shall provide to a person who is the subject of a consumer report a copy of all information and sources of that information contained in the consumer report and a list of all persons receiving a copy of the information within the report during the previous twelve months. The information in the copy provided to the consumer shall be disclosed in an easily understandable format and shall not include codes or trade language not readily understandable by a person not engaged in the consumer reporting business. In a twelve-month period, a customer is entitled to one copy without charge of the information required to be disclosed by this subsection.

(2) If a customer has been denied credit, employment, or insurance, or if any other adverse action has been taken based on information in a consumer report, upon written request of the consumer, the consumer reporting agency shall provide a copy of the consumer report to the consumer at no charge to the consumer.

(3) If a consumer alleges that a consumer report contains factual errors, the consumer reporting agency shall investigate the disputed information within thirty days of written notification by the consumer. The consumer reporting agency shall make a determination concerning the accuracy of the information within sixty days after receiving the written notification. If a consumer establishes that a consumer report contains errors, the consumer reporting agency shall correct the errors in its records. The consumer reporting agency within seven days shall notify the consumer and any person who has received a copy of the inaccurate information within the previous twelve months of the corrected information.

(4) For the purposes of this section the following terms have the following meanings:

(a) "Consumer" means an individual;

(b) "Consumer report" has the meaning in the federal fair credit reporting act, 15 U.S.C. Sec. 1681a(d); and

NEW SECTION. Sec. 4. A new section is added to chapter 9.73 RCW to read as follows:

(1) The dissemination of personally identifying information is a matter affecting the public interest for the purpose of applying chapter 19.86 RCW. The dissemination of personally identifying information without permission and the failure to disclose a consumer report to a consumer is not reasonable in relation to the development and preservation of business. A violation of section 2 or 3 of this act constitutes an unfair or deceptive act or practice in trade or commerce for the purpose of applying chapter 19.86 RCW. In addition to any other remedies, any aggrieved person may commence a civil action for damages for invasion of privacy against a public or private entity that violates section 2 or 3 of this act, including special damages of not less than ten thousand dollars.

(2) Any person who intentionally disseminates personally identifying information in violation of section 2 of this act is guilty of a gross misdemeanor as provided in chapter 9A.20 RCW.