AN ACT Relating to biometric identifiers; amending RCW 19.86.080; and adding a new section to chapter 19.215 RCW.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION.  Sec. 1.  A new section is added to chapter 19.215 RCW to read as follows:

(1) A person may not capture a biometric identifier of an individual for a commercial purpose unless the person:

(a) Informs the individual before capturing the biometric identifier; and

(b) Receives the individual's consent to capture the biometric identifier.

(2) A person who possesses a biometric identifier of an individual that is captured for a commercial purpose:

(a) May not sell, lease, or otherwise disclose the biometric identifier to another person unless:

(i) The individual consents to the disclosure for identification purposes in the event of the individual's disappearance or death;

(ii) The disclosure completes a financial transaction that the individual requested or authorized;

(iii) The disclosure is required or expressly permitted by a federal statute or by a state statute; or

(iv) The disclosure is made by or to a law enforcement agency for a law enforcement purpose in response to a warrant;

(b) Shall store, transmit, and protect from disclosure the biometric identifier using reasonable care and in a manner that is the same as or more protective than industry standards relating to administrative, technical, and physical safeguards for digital copies, biometric identifiers, and other personal identifying information; and

(c) Must retain the biometric identifier no longer than is legally necessary as required by statute, rule, or public records retention schedule specified under federal, state, or local authority, except as provided by subsection (3) of this section.

(3)(a) If a biometric identifier captured for a commercial purpose has been collected for contractual purposes, the purpose for collecting the identifier under subsection (2)(c) of this section expires upon termination of the continuous contractual relationship.

(b) If a biometric identifier captured for a commercial purpose has been collected for security purposes by an employer, the purpose for collecting the identifier under subsection (2)(c) of this section is presumed to expire on termination of the employment relationship.

(4) For purposes of this section, "biometric identifier" means a characteristic, whether biological, behavioral, or both, that enables automated recognition of an individual and is inherently sensitive, including but not limited to fingerprints, DNA, hand geometry, palm print, and iris scan. "Biometric identifier" also includes less sensitive identifiers, including, but not limited to facial imaging, voice, and gait when used specifically for identification purposes.

(5) The legislature finds that the practices covered by this section are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this chapter is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

Sec. 2.  RCW 19.86.080 and 2007 c 66 s 1 are each amended to read as follows:

(1)(a) The attorney general may bring an action in the name of the state, or as parens patriae on behalf of persons residing in the state, against any person to restrain and prevent the doing of any act herein prohibited or declared to be unlawful; and, except as provided in (b) of this subsection, the prevailing party may, in the discretion of the court, recover the costs of said action including a reasonable attorney's fee.

(2) The court may make such additional orders or judgments as may be necessary to restore to any person in interest any moneys or property, real or personal, which may have been acquired by means of any act herein prohibited or declared to be unlawful.

(3) Upon a violation of RCW 19.86.030, 19.86.040, 19.86.050, or 19.86.060, the court may also make such additional orders or judgments as may be necessary to restore to any person in interest any moneys or property, real or personal, which may have been acquired, regardless of whether such person purchased or transacted for goods or services directly with the defendant or indirectly through resellers. The court shall exclude from the amount of monetary relief awarded in an action pursuant to this subsection any amount that duplicates amounts that have been awarded for the same violation. The court should consider consolidation or coordination with other related actions, to the extent practicable, to avoid duplicate recovery.

--- END ---