AN ACT Relating to biometric identifiers; and adding a new section to chapter 19.215 RCW.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION.  Sec. 1.  A new section is added to chapter 19.215 RCW to read as follows:

(1) A person may not capture a biometric identifier of an individual for a commercial purpose unless the person:

(a) Informs the individual before capturing the biometric identifier; and

(b) Receives the individual's consent to capture the biometric identifier.

(2) A person who legally possesses a biometric identifier of an individual that is captured for a commercial purpose:

(a) May not sell, lease, or otherwise disclose the biometric identifier to another person unless:

(i) The individual consents to the disclosure for identification purposes in the event of the individual's disappearance or death or otherwise consents to the disclosure to third parties;

(ii) The biometric data is disclosed to a service provider or other third party as necessary to effect, administer, enforce, or complete a financial transaction that the individual requested, initiated, or authorized, provided that such a service provider or third party shall maintain confidentiality of the biometric data and not further disclose the biometric data except as permitted under this subsection (2)(a);

(iii) The disclosure is required or expressly permitted by a federal statute or by a state statute; or

(iv) The disclosure is made to a law enforcement agency for a law enforcement purpose in response to a warrant;

(b) Shall store, transmit, and protect from disclosure the biometric identifier using reasonable care and in a manner that is the same as or more protective than industry standards relating to administrative, technical, and physical safeguards for digital copies, biometric identifiers, and other personal identifying information; and

(c) Must retain the biometric identifier no longer than is legally permissible by statute, rule, or public records retention schedule specified under federal, state, or local authority, as necessary to protect against or prevent actual or potential fraud, criminal activity, claims, or liability, except as provided by subsection (3) of this section.

(3)(a) If a biometric identifier captured for a commercial purpose has been collected for contractual purposes, the purpose for collecting the identifier under subsection (2)(c) of this section continues until the latter of the termination of the continuous contractual relationship, the time period necessary to carry out the terms of the contract, or for as long as is permitted or required by law.

(b) If a biometric identifier captured for a commercial purpose has been collected for security purposes by an employer, the purpose for collecting the identifier under subsection (2)(c) of this section is presumed to expire on termination of the employment relationship.

(4) If a biometric identifier was initially captured for any purpose other than a commercial purpose, it is a violation of this act to use the biometric identifier at a later time for a commercial purpose without an individual's consent.

(5) For the purpose of subsection (4) of this section, consent means that an individual must actively opt-in to the use of the biometric identifier. An active opt-in by an individual provides consent for the use of the biometric identifier for no longer than twenty-four hours.

(6) For purposes of this section, the following definitions apply unless the context clearly requires otherwise:

(a) "Biometric identifier" means a characteristic, whether biological, behavioral, or both, that uniquely identifies and enables automated recognition of an individual, including but not limited to fingerprints, DNA, hand geometry, palm print, and iris scan. "Biometric identifier" also includes less sensitive identifiers including, but not limited to, facial imaging, voice, and gait, only when used for automated identification purposes. Video surveillance and photographs derived from biometric identifiers are not considered biometric identifiers.

(b) "Consent" means an authorization by an individual, given after the individual has received clear and conspicuous notice in writing of the purposes for which the biometric identifier may be disclosed. When an individual consents to disclose his or her biometric identifier to law enforcement without a warrant, consent must be made separate from any other consent provided.

(7) The legislature finds that the practices covered by this section are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this chapter is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

(8) Nothing in this act shall be construed to expand or limit the authority of a Washington state law enforcement officer acting within the scope of his or her authority, including, but not limited to, executing lawful searches and seizures.

--- END ---