ENGROSSED SUBSTITUTE HOUSE BILL 2200


State of Washington	65th Legislature	2017 Regular Session

By House Technology & Economic Development (originally sponsored by Representatives Hansen, Taylor, Smith, Buys, Harmsworth, Graves, Maycumber, J. Walsh, Kraft, Haler, Condotta, Nealey, Bergquist, Steele, Van Werven, Stonier, Macri, Farrell, Cody, Slatter, Tarleton, Senn, Kagi, Pollet, Frame, Chapman, Dye, Hudgins, Stanford, Reeves, Dent, Hayes, Ryu, Peterson, Sells, Kloba, Santos, Johnson, Fitzgibbon, Holy, Ormsby, Caldier, Sawyer, Wylie, Hargrove, Kilduff, Blake, Orcutt, Gregerson, Young, Appleton, Shea, Koster, Morris, Tharinger, Irwin, Muri, Schmick, Volz, Goodman, Clibborn, McCaslin, Pellicciotti, Doglio, Jinkins, Dolan, Kirby, Sullivan, Lytton, Kretz, Riccelli, Rodne, McBride, McCabe, and Pettigrew)

READ FIRST TIME 04/17/17.

AN ACT Relating to protecting the privacy and security of internet users; adding a new chapter to Title 19 RCW; providing an effective date; and providing a contingent expiration date.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION. Sec. 1. The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.

(1) "Broadband internet access service" or "BIAS" means a mass market retail service by wire or radio that provides the capability to transmit data to and receive data from all or substantially all internet endpoints, including any capabilities that are incidental to and enable the operation of the communications service, but excluding dial-up internet access service. This term also encompasses any service that the federal communications commission finds to be providing a functional equivalent of the service described in this subsection.

(2) "Broadband internet access service provider" or "BIAS provider" means a person engaged in the provision of BIAS.

(3) "Customer" means: (a) A current or former subscriber to a BIAS; or (b) an applicant for a BIAS.

(4) "Customer proprietary information" means any of the following a BIAS provider acquires in connection with its provision of BIAS:

(a) Content of communication;

(b) Call detail information;

(d) Health information;

(e) Information pertaining to children;

(f) Social security numbers;

(g) Precise geolocation information;

(h) Web browsing history, application usage history, and the functional equivalents of either; and

(i) Other personally identifiable information, which consists of any information that is linked or reasonably linkable to an individual or device.

(5) "Opt-in approval" means affirmative, express customer consent to an activity under section 2 of this act, after the customer is provided appropriate notification.

NEW SECTION. Sec. 2. (1) Except with the opt-in approval of the customer, a BIAS provider may not:

(a) Sell or transfer customer proprietary information; or

(b) Send or display to a customer an advertisement selected to be sent or displayed based on the customer's proprietary information.

(2) A BIAS provider must solicit the approval required under subsection (1) of this section at the point of sale. A BIAS provider must obtain new approval for any changes in the actions described in subsection (1) of this section, if those changes are inconsistent with the terms or conditions provided at the time of prior customer approval.

(3) A BIAS provider must provide access to a mechanism that is reasonably designed to be readily available and understandable for a customer to grant, deny, or withdraw approval for the BIAS provider to take any of the actions described in subsection (1) of this section. The exact notice and mechanism to obtain opt-in approval or to deny or withdraw that approval is context dependent.

(4) For the purposes of this section, "transfer" does not include the use or disclosure of customer proprietary information for the provision of internet access service from which such information is derived or the provision of services necessary to, or used in, the provision of such services.

(5) Subsection (1)(a) of this section does not apply to the sale or transfer of customer proprietary information as part of any merger, acquisition, sale of all, or substantially all, company assets, or transition of service to another provider.

NEW SECTION. Sec. 3. (1) A BIAS provider must not condition, or effectively condition, provision of BIAS on a customer's agreement to waive privacy rights guaranteed by law or rule, including this chapter. A BIAS provider must not terminate service or otherwise refuse to provide BIAS as a direct or indirect consequence of a customer's refusal to waive any such privacy rights.

(2) A BIAS provider that offers a financial incentive in exchange for any customer approvals described in section 2(1) of this act must provide the customer with the terms and conditions of the use of the customer proprietary information, including the type of information sought, the purposes of its use, and the categories of entities to which the information may be disclosed.

(3) For any customer that has agreed to participate in a financial incentive program as described in subsection (2) of this section, a BIAS provider must provide access to a mechanism for customers to withdraw participation from such a program at any time.

NEW SECTION. Sec. 4. The utilities and transportation commission is authorized to adopt rules, consistent with the purposes of this chapter, that do either or both of the following:

(1) Further define the definitions in section 1 of this act; and

(2) Prescribe appropriate notice and the form of such a notice to be provided to customers under sections 2 and 3 of this act.

NEW SECTION. Sec. 5. The legislature finds that the practices covered by this chapter are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. Notwithstanding the provisions of RCW 19.86.170, a violation of this chapter, including the violation of any rule adopted by the utilities and transportation commission pursuant to section 4 of this act, is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this chapter by a public service company providing broadband internet access service may be subject to enforcement by the utilities and transportation commission under Title 80 RCW.

NEW SECTION. Sec. 6. The consumer privacy and security account is created in the state treasury. All receipts from recoveries by the office of the attorney general for lawsuits related to the consumer protection act under the provisions of this chapter, or otherwise designated to this account, must be deposited into the account. Moneys in the account may be spent only after appropriation. Expenditures from the account may be used only for costs incurred by the office of the attorney general in the administration and enforcement of this chapter.

NEW SECTION. Sec. 7. Sections 1 through 6 of this act expire upon determination by the utilities and transportation commission that the federal government has established BIAS customer protections standards substantially equivalent to the levels of protection provided in this chapter. The utilities and transportation commission must provide notice of the expiration date of sections 1 through 6 of this act to affected parties, the chief clerk of the house of representatives, the secretary of the senate, the office of the code reviser, and others as deemed appropriate by the utilities and transportation commission.

NEW SECTION. Sec. 8. Sections 1 through 7 of this act take effect December 31, 2018.

NEW SECTION. Sec. 9. Sections 1 through 7 of this act constitute a new chapter in Title 19 RCW.

--- END ---