[atlas:bill]

AN ACT Relating to protecting personal information; adding a new chapter to Title 19 RCW; and prescribing penalties.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION. Sec. 1. The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.

(1) "Entity" includes a sole proprietor, partnership, corporation, limited liability company, trust, association, financial institution, governmental entity, other than the federal government, and any other individual or group, engaged in a trade, occupation, enterprise, governmental function, or similar activity in this state, however organized and whether organized to operate at a profit.

(2) "Destroy personal information" means shredding, erasing, or otherwise modifying personal information in records to make the personal information unreadable or undecipherable through any means.

(3) "Individual" means a natural person, except that if the individual is under a legal disability, "individual" includes a parent or duly appointed legal representative.

(4) "Personal information" includes information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, medical history or status, or financial information, including a bank account number, credit card number, and debit card number.

(5) "Record" includes any material, regardless of the physical form, on which information is recorded or preserved by any means, including in written or spoken words, graphically depicted, printed, or electromagnetically transmitted. "Record" does not include publicly available directories containing information an individual has voluntarily consented to have publicly disseminated or listed, such as name, address, or telephone number.

NEW SECTION. Sec. 2. (1) An entity must take all reasonable steps to destroy, or arrange for the destruction of, personal information in an individual's records within its custody or control when the entity is disposing of records that it will no longer retain. This subsection does not apply to the disposal of records by a transfer of the records, not otherwise prohibited by law, to another entity, including a transfer to archive or otherwise preserve public records as required by law.

(2) An individual injured by the failure of an entity to comply with subsection (1) of this section may bring a civil action in a court of competent jurisdiction. The court may:

(a) If the failure to comply is inadvertent, award actual damages;

(b) If the failure to comply is due to negligence, award a penalty of five hundred dollars or actual damages, whichever is greater, and costs and reasonable attorneys' fees; and

(c) If the failure to comply is willful, award a penalty of one thousand five hundred dollars or damages equal to three times actual damages, whichever is greater, and costs and reasonable attorneys' fees.

(3) An individual having reason to believe that he or she may be injured by an act or failure to act that does not comply with subsection (1) of this section may apply to a court of competent jurisdiction to enjoin the act or failure to act. The court may grant an injunction with terms and conditions as the court may deem equitable.

(4) The attorney general may bring a civil action in the name of the state for damages, injunctive relief, or both, against an entity that fails to comply with subsection (1) of this section. The court may award damages that are the same as those awarded to individual plaintiffs under subsection (2) of this section.

(5) The legislature finds that the practices covered by this section are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A failure to comply with subsection (1) of this section is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

(6) The rights and remedies provided under this section are in addition to any other rights or remedies provided by law.

NEW SECTION. Sec. 3. Sections 1 and 2 of this act constitute a new chapter in Title 19 RCW.