SECOND ENGROSSED SUBSTITUTE HOUSE BILL 1094
| | |
State of Washington | 64th Legislature | 2015 Regular Session |
By House Technology & Economic Development (originally sponsored by Representative Morris)
READ FIRST TIME 02/09/15.
AN ACT Relating to biometric identifiers; adding a new chapter to Title
19 RCW; and creating a new section.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:
NEW SECTION. Sec. 1. The legislature finds that citizens of Washington are increasingly asked to disclose sensitive biological information that uniquely identifies them for commerce, security, and convenience. The commercial collection and marketing of biometric information about individuals, without consent or knowledge of the individual whose data is collected, is of increasing concern. The legislature intends to require a business to provide notice and obtain consent from an individual before enrolling an individual's biometric identifiers in a database for commercial purposes.
NEW SECTION. Sec. 2. (1) A person may not enroll a biometric identifier of an individual in a database for a commercial purpose without providing clear and conspicuous notice and obtaining the individual's affirmative consent.
(2) Clear and conspicuous notice is notice that is given through a procedure reasonably designed to be prominent, timely, relevant, and easily accessible. It should address the type of biometric identifier that the person is capturing, the commercial purposes for which the biometric identifier is being enrolled, and the circumstances in which the biometric identifier may be disclosed to third parties. The exact notice required to achieve this standard is context-dependent.
(3) A person who has enrolled an individual's biometric identifier may not sell, lease, or otherwise disclose the biometric identifier to another person for a commercial purpose unless the disclosure:
(a) Is consistent with the notice and consent described in subsections (1) and (2) of this section;
(b) Is necessary to provide a product or service requested by the individual;
(c) Is necessary to effect, administer, enforce, or complete a financial transaction that the individual requested, initiated, or authorized, and the third party to whom the biometric data is disclosed maintains confidentiality of the biometric data and does not further disclose the biometric data except as otherwise permitted under this subsection (3);
(d) Is required or expressly authorized by a federal or state statute, administrative code, or court order;
(e) Is made in good faith in response to a request from a law enforcement officer that has represented to the person that such disclosure is necessary to facilitate law enforcement's response to an ongoing incident in which there is an imminent threat of danger or harm to an individual;
(f) Is made to a third party who contractually promises that the biometric identifier will not be further disclosed and will not be enrolled in a database for a commercial purpose inconsistent with the notice provided to the individual under subsections (1) and (2) of this section; or
(g) Is made to prepare for litigation or to respond to or participate in judicial process.
(4) A person who possesses a biometric identifier of an individual that has been enrolled for a commercial purpose:
(a) Must take reasonable care to guard against unauthorized access to biometric identifiers that is in the possession or under the control of the person; and
(b) May retain the biometric identifier no longer than is reasonably necessary to:
(i) Comply with a court order, statute, or administrative rule;
(ii) Protect against or prevent actual or potential fraud, criminal activity, claims, security threats, or liability; or
(iii) Effectuate the purposes for which an individual has provided consent to the capture, enrollment, and disclosure of the biometric information.
(5) A person who enrolls a biometric identifier of an individual pursuant to this section may not use or disclose it in a manner that is materially inconsistent with the terms under which the biometric identifier was originally provided without obtaining consent.
(6) The limitations on disclosure and retention of biometric identifiers provided in this section do not apply to disclosure or retention of biometric identifiers that have been anonymized so as to prevent the possibility of ascertaining the identity of a unique individual.
NEW SECTION. Sec. 3. For purposes of this chapter, the following definitions apply unless the context clearly requires otherwise:
(1) "Biometric sample" means a measurable physical characteristic or personal behavioral trait obtained from a biometric sensor device that can be used for identification of the individual.
(2) "Biometric identifier" means data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, voice print, eye retinas or irises, or other unique biological characteristic, which are used by the person or licensee to uniquely authenticate an individual's identity when the individual accesses a system or account.
(3) "Biometric system" means an automated system capable of capturing a biometric sample from an individual, extracting and processing biometric data from that sample, storing the extracted information in a database, comparing the biometric data with data contained in one or more references, determining whether the biometric data matches the reference, and indicating whether or not an identification has been achieved.
(4) "Capture" means the process of using a sensor to collect a biometric sample and related contextual data from a scene or an individual, or both, with or without the individual's knowledge.
(5) "Commercial purpose" means a purpose in furtherance of the sale or disclosure of biometric data for the purpose of marketing of goods or services when such goods or services are unrelated to the initial commercial transaction in which a person first gains possession of an individual's biometric identifier. "Commercial purpose" does not include a security purpose.
(6) "Enroll" means to collect a biometric sample of an individual, convert it into a reference template, and store it in the biometric system's database for later comparison. Biometric samples converted in a reference template format cannot be reconstructed into the original output image.
(7) "Federal peace officer" has the meaning in RCW
10.93.020.
(8) "Identification" is the task by which a biometric system searches a database for a reference matching a biometric sample and, if found, returns a corresponding identity.
(9) "Law enforcement officer" means a law enforcement officer as defined in RCW
9.41.040 or a federal peace officer.
(11) "Security purpose" means the purpose of preventing shoplifting, fraud, or any other misappropriation or theft of a thing of value, including tangible and intangible goods and services.
NEW SECTION. Sec. 4. The legislature finds that the practices covered by this section are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A material violation of this chapter is not reasonable in relation to the development and preservation of business, is an unfair or deceptive act in trade or commerce and an unfair method of competition, and may be enforced by the attorney general under the consumer protection act, chapter 19.86 RCW. NEW SECTION. Sec. 5. (1) Nothing in this act shall be construed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated thereunder.
(2) Nothing in this act shall be construed to expand or limit the authority of a law enforcement officer acting within the scope of his or her authority, including, but not limited to, the authority of a state law enforcement officer in executing lawful searches and seizures.
NEW SECTION. Sec. 6. Sections 2 through 5 constitute a new chapter in Title 19 RCW. --- END ---