BILL REQ. #:  H-0278.1 

Prefiled 12/05/08. Read first time 01/12/09.   Referred to Committee on Technology, Energy & Communications.

     AN ACT Relating to internet privacy policies; and adding a new chapter to Title 19 RCW.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION.  Sec. 1   The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.
     (1) "Conspicuously post" means making the privacy policy available through any of the following means:
     (a) A web page on which the actual privacy policy is posted if the web page is the home page or first significant page after entering the web site;
     (b) An icon that hyperlinks to a web page on which the actual privacy policy is posted, if the icon is located on the home page or is the first significant page after entering the web site, and if the icon contains the word "privacy." The icon must also use a color that contrasts with the background color of the web page or is otherwise distinguishable;
     (c) A text link that hyperlinks to a web page on which the actual privacy policy is posted, if the text link:
     (i) Is located on the home page or the first significant page after entering the web site;
     (ii) Includes the word "privacy" in text that is ten-point font in size or greater; and
     (iii) Is set off from the surrounding text by symbols or other identifying marks that call attention to the text link.
     (2) "Consumer" means an individual who seeks or acquires, by purchase or lease, any goods, services, money, or credit for personal, family, or household purposes.
     (3) "Operator" means a person or business entity that owns a web site located on the internet or an online service that collects and maintains personally identifiable information from a consumer residing in Washington who uses or visits the web site or online service if the web site or online service is operated for commercial purposes. The term "operator" does not include any third party that operates, hosts, or manages, but does not own, a web site or online service on the owner's behalf or by processing information on behalf of the owner.
     (4) "Personally identifiable information" means individually identifiable information about an individual consumer collected online by the operator from that individual and maintained by the operator in an accessible form, including any of the following:
     (a) A first and last name;
     (b) A home or other physical address, including street name and name of a city or town;
     (c) An e-mail address;
     (d) An internet protocol address;
     (e) A telephone number;
     (f) A social security number;
     (g) Any other identifier that permits physical or online contact with a specific individual;
     (h) Information concerning a user that the web site or online service collects from the user and maintains in personally identifiable form in combination with an identifier outlined in (a) through (g) of this subsection.

NEW SECTION.  Sec. 2   (1) An operator of a commercial web site that collects personally identifiable information through the internet about an individual consumer residing in Washington who uses or visits its commercial web site shall conspicuously post its privacy policy on its web site.
     (2) An operator of a commercial web site that collects personally identifiable information shall make its privacy policy reasonably accessible to consumers of the online service.
     (3) The privacy policy required by subsections (1) and (2) of this section must:
     (a) Identify the categories of personally identifiable information that the operator collects through the web site or online service about individual consumers who use or visit its commercial web site or online service and the categories of third-party persons or entities with whom the operator may share that personally identifiable information;
     (b) Provide a description of a process for an individual consumer who uses or visits its commercial web site or online service to review and request changes to any of his or her personally identifiable information that is collected through the web site or online service, if such a process is available;
     (c) Describe the process by which the operator notifies consumers who use or visit its commercial web site or online service of material changes to the operator's privacy policy for that web site or online service; and
     (d) Identify its effective date.
     (4) An operator is in violation of this section only if the operator fails to post its privacy policy within thirty days after being notified of noncompliance by the office of the attorney general.

NEW SECTION.  Sec. 3   The legislature finds that the practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this chapter is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

NEW SECTION.  Sec. 4   Sections 1 through 3 of this act constitute a new chapter in Title 19 RCW.