[atlas:bill]

AN ACT Relating to protecting the privacy of financial information; adding a new chapter to Title 9 RCW; prescribing penalties; and providing an effective date.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION. Sec. 1. INTENT. (1) The legislature finds that financial information is personal and sensitive information that if improperly used or released may do significant harm to a person's privacy, financial security, and other interests. The legislature finds that the risks of improper use or release of private financial information is increasing as computer and communication technology improves and unscrupulous persons find ever more clever ways to improperly obtain and use financial information. The legislature intends to discourage improper use or release of financial information by requiring holders of such information to be more diligent in protecting it from improper use or release and by creating penalties for improperly obtaining or using financial information.

(2) The legislature also finds that many persons and institutions may have access to financial information in many different contexts and for many different purposes. It is the public policy of this state that a person's interest in the proper use and release of that person's financial information survives regardless of who holds the information.

NEW SECTION. Sec. 2. DEFINITIONS. As used in this chapter, unless the context clearly requires otherwise:

(1) "Financial information" means any information related to the assets, liabilities, or credit of an individual and is identifiable to the individual, including account numbers, account balances and other account data, transactional information concerning any account, and codes, passwords, and other means of access to accounts or means to initiate transactions, such as mother's maiden name. Financial information includes an individual's social security, driver's license, and tax identification number.

(2) "Financial institution" means any person engaged in the business of providing financial services to customers who have a credit, deposit, trust, stock, or other financial account or relationship with the person; it includes banks, credit unions, savings banks, lenders, credit card companies, insurers, and securities broker-dealers.

(3) "Individual" means an individual and his or her family.

(4) "Person" means an individual, partnership, corporation, or association.

NEW SECTION. Sec. 3. PROTECTING FINANCIAL INFORMATION‑-FINANCIAL INSTITUTIONS. (1) Financial institutions have an affirmative and continuing obligation to respect the privacy of their customers and to protect the security and confidentiality of customer's financial information. Financial institutions shall establish appropriate policies and procedures to safeguard the security and confidentiality of financial information and to protect against likely threats or hazards to the security or integrity of such records.

(2) A financial institution shall not disclose or provide customer financial information to a third party for their independent use except to the extent the disclosure of such information:

(a) Is necessary to complete a customer-initiated transaction;

(b) Has been requested or authorized by the customer and reasonable steps have been taken to identify the customer;

(c) Is required by law by a public agency or court as part of an investigation, subpoena, judgment, or other legal proceeding;

(d) Is traditionally supplied to a consumer reporting agency under chapter 19.182 RCW; or

(e) Is regarding whether the customer had checks returned for nonsufficient funds and is made to a financial institution where the customer is applying to open a checking account.

(3) A financial institution shall not be liable for unauthorized disclosure of financial or personal information if policies and procedures under subsection (1) of this section were followed in making the disclosure.

(4) Except as provided in subsection (3) of this section, a financial institution that violates this section is liable for five hundred dollars or actual damages, including costs to repair the customer's credit record, whichever is greater, and reasonable attorneys' fees.

NEW SECTION. Sec. 4. PROTECTING FINANCIAL INFORMATION‑-OTHERS. (1) Persons other than financial institutions with financial information on an individual have an affirmative and continuing obligation to respect the privacy of the individual and to not improperly or inappropriately disclose or provide an individual's financial information to a third party for their independent use.

(2) A person that violates this section is liable for five hundred dollars or actual damages, whichever is greater, and reasonable attorneys' fees. If the person that violates this section is a business that repeatedly violates this section, that person also violates the consumer protection act, chapter 19.86 RCW.

NEW SECTION. Sec. 5. PROHIBITING ATTEMPTS TO IMPROPERLY OBTAIN FINANCIAL INFORMATION. (1) No person may obtain or attempt to obtain, or cause to be disclosed or attempt to cause to be disclosed to any person, financial information of a financial institution's customer:

(a) By knowingly making a false, fictitious, or fraudulent statement or representation to an officer, employee, or agent of a financial institution with the intent to deceive the officer, employee, or agent into relying on that statement or representation for purposes of releasing the financial information;

(b) By knowingly making a false, fictitious, or fraudulent statement or representation to a customer of a financial institution with the intent to deceive the customer into releasing financial information or authorizing the release of such information;

(c) By knowingly providing any document to an officer, employee, or agent of a financial institution, knowing that the document is forged, counterfeit, lost, or stolen; was fraudulently obtained; or contains a false, fictitious, or fraudulent statement or representation, if the document is provided with the intent to deceive the officer, employee, or agent to release the financial information.

(2) No person may request another person to obtain financial information from a financial institution knowing or consciously avoiding knowing that the person will obtain or attempt to obtain the information from the financial institution in any manner described in subsection (1) of this section.

(3) This section does not apply to:

(a) Any action by a law enforcement agency in connection with the performance of the official duties of the agency;

(b) Efforts by the financial institution to test security procedures or systems of the financial institution for maintaining the confidentiality of customer information;

(d) Efforts to recover financial or personal information of the financial institution obtained or received by another person in any manner described in subsection (1) or (2) of this section.

(4) Violation of this section is a class C felony.

(5) A person that violates this section is liable for five hundred dollars or actual damages, whichever is greater, and reasonable attorneys' fees. If the person violating this section is a business that repeatedly violates this section, that person also violates the consumer protection act, chapter 19.86 RCW.

NEW SECTION. Sec. 6. PROHIBITING SALE OF FINANCIAL INFORMATION. (1) No person may knowingly provide or disclose financial information of another person without the consent of that person to a third party for compensation or other financial gain.

(2) This section does not apply to:

(a) Consumer reporting agencies when authorized under chapter 19.182 RCW; and

(b) Law enforcement agencies in connection with the performance of the official duties of the agency.

(3) Violation of this section is a class C felony.

(4) A person that violates this section is liable for five hundred dollars or actual damages, including costs to repair the person's credit record, whichever is greater, and reasonable attorneys' fees. If the person violating this section is a business that repeatedly violates this section, that person also violates the consumer protection act, chapter 19.86 RCW.

NEW SECTION. Sec. 7. PROHIBITING IDENTITY THEFT. (1) No person may knowingly use or transfer, without consent or lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, any unlawful activity harming the financial position or reputation of the person whose identity is used, or for committing any felony.

(2) For purposes of this section, "means of identification" means any information or item that is not describing finances or credit but is personal to or identifiable with any individual or other person, including any current or former name of the person, telephone number, and e-mail address of the individual or any member of his or her family, including the ancestor of such person; any information relating to a change in name, address, telephone number, or e-mail address of the individual or his or her family; any social security, driver's license, or tax identification number of the individual or any member of his or her family; and other information which could be used to identify the person, including unique biometric data.

(3) Violation of this section is a class C felony.

NEW SECTION. Sec. 8. EFFECTIVE DATE. This act takes effect January 1, 2000.

NEW SECTION. Sec. 9. CAPTIONS NOT LAW. Captions used in this act are not part of the law.

NEW SECTION. Sec. 10. SEVERABILITY CLAUSE. If any provision of this act or its application to any person or circumstance is held invalid, the remainder of the act or the application of the provision to other persons or circumstances is not affected.

NEW SECTION. Sec. 11. Sections 1 through 10 of this act constitute a new chapter in Title 9 RCW.