Prohibits a person or entity conducting business in Washington that accepts an access device in connection with a transaction from retaining the card security code data, the PIN verification code number, or the full contents of any track of magnetic stripe data, subsequent to the authorization of the transaction or in the case of a PIN debit transaction, subsequent to forty-eight hours after authorization of the transaction.

Provides penalties.

Provides remedies for a breach of the security of the system occurring after January 1, 2010.