BILL REQ. #:  H-0181.2 

Prefiled 12/05/08. Read first time 01/12/09.   Referred to Committee on Technology, Energy & Communications.

     AN ACT Relating to regulating the use of identification devices; amending RCW 19.300.010; and adding new sections to chapter 19.300 RCW.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

Sec. 1   RCW 19.300.010 and 2008 c 138 s 2 are each amended to read as follows:
     The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.
     (1) "Identification device" means an item that uses radio frequency identification technology or facial recognition technology.
     (2) "Person" means a natural person who resides in Washington.
     (3) "Personal information" has the same meaning as in RCW 19.255.010.
     (4) "Data" means personal information, numerical values associated with a person's facial features, or unique personal identifier numbers stored on an identification device.
     (5) "Radio frequency identification" means ((a technology that uses radio waves to transmit data remotely to readers)) the use of electromagnetic radiating waves or reactive field coupling in the radio frequency portion of the spectrum to communicate to or from a tag through a variety of modulation and encoding schemes to uniquely read the identity of a radio frequency tag or other data stored on it.
     (6) (("Reader" means a scanning device that is capable of using radio waves to communicate with an identification device and read the data transmitted by that identification device.
     (7))) "Remotely" means that no physical contact between the identification device and the reader is necessary in order to transmit data.
     (((8))) (7) "Unique personal identifier number" means a randomly assigned string of numbers or symbols that is encoded on the identification device and is intended to identify the identification device.

NEW SECTION.  Sec. 2   A new section is added to chapter 19.300 RCW to read as follows:
     (1) Except as provided in subsection (2) of this section, a person, governmental entity, or business entity may not intentionally scan a person's identification device remotely for any purpose without obtaining that person's opt-in consent. Opt-in consent may be secured in writing or electronically. In obtaining a person's opt-in consent, the governmental entity or business entity shall unambiguously disclose to the person that by consenting, the person agrees to have the governmental entity or business entity collect, use, or retain data gathered from the identification device for any purpose.
     (2) This section does not apply to the following:
     (a) The scanning of an identification device for triage or medical care during a disaster and immediate hospitalization or immediate outpatient care directly relating to a disaster;
     (b) The scanning of an identification device by an emergency responder or health care professional for reasons relating to the health or safety of that person;
     (c) The scanning of a person's identification device issued to a patient for emergency purposes;
     (d) The scanning of an identification device of a person pursuant to court-ordered electronic monitoring;
     (e) The scanning of an identification device of a person who is incarcerated in a correctional institution, juvenile detention facility, or mental health facility;
     (f) The scanning of an identification device by law enforcement or government personnel who need to read a lost identification device when the owner is unavailable for notice, knowledge, or consent, or those parties specifically authorized by law enforcement or government personnel for the limited purpose of reading a lost identification device when the owner is unavailable for notice, knowledge, or consent;
     (g) The scanning of an identification device by law enforcement personnel who need to read a person's identification device after an accident in which the person is unavailable for notice, knowledge, or consent;
     (h) The scanning of an identification device by a person or entity that in the course of operating its own identification device system collects data from another identification device, provided that the inadvertently received data comports with all of the following:
     (i) The data is not disclosed to any other party;
     (ii) The data is not used for any purpose; and
     (iii) The data is not stored or is promptly destroyed;
     (i) The scanning of a person's identification device in the course of an act of good faith security research, experimentation, or scientific inquiry including, but not limited to, activities useful in identifying and analyzing security flaws and vulnerabilities; and
     (j) The scanning of an identification device by law enforcement personnel who need to scan a person's identification device pursuant to a search warrant.
     (3) The legislature finds that the practices covered by this section are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this chapter is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

NEW SECTION.  Sec. 3   A new section is added to chapter 19.300 RCW to read as follows:
     (1) A governmental entity or business entity may not collect, use, or store data associated with a person for purposes other than completing a sales transaction or providing a service, unless the governmental entity or business entity has obtained the express, opt-in consent of the person associated with the data. The person's consent must be obtained either in writing or electronically. In obtaining the person's consent, the governmental entity or business entity shall unambiguously disclose that, by consent, the person agrees to have the governmental entity or business entity collect, use, or retain data associated with them.
     (2) A person who has provided their express, opt-in consent under subsection (1) of this section may, at any time, opt out of the collection of data. The person may opt out either in writing or electronically.

NEW SECTION.  Sec. 4   A new section is added to chapter 19.300 RCW to read as follows:
     The office of the attorney general shall, on an annual basis, make recommendations to the legislature on other personally invasive technologies that may warrant further legislative action.