BILL REQ. #:  H-2393.1 

READ FIRST TIME 02/26/07.   

     AN ACT Relating to electronic communication devices; adding a new chapter to Title 19 RCW; creating a new section; and prescribing penalties.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION.  Sec. 1   The legislature finds that Washington state, from its inception, has recognized the importance of maintaining individual privacy. The legislature further finds that protecting the confidentiality and privacy of an individual's personal information, especially when collected from the individual without his or her knowledge or consent, is critical to maintaining the safety and well-being of its citizens.
     The legislature recognizes that inclusion of technologies like radio frequency identification or other electronic communication devices that broadcast data or enable data or information to be collected or scanned secretly and/or remotely will greatly magnify the potential risk to individual privacy, safety, and economic well-being that can occur from unauthorized interception and use of personal information. The legislature further recognizes that inclusion of electronic communication devices will also make it possible for a person or entity with access to a reader or other scanning device to engage in the tracking of the citizens of Washington state without their knowledge or consent.
     Therefore, it is the intent of the legislature to establish individual privacy rights in an era of innovation of new technologies. It is further the intent of the legislature to establish such rights so that manufacturers and sellers of new, innovative technologies have a predictable set of known, individual rights to be aware of before offering their technology for sale or use in the state of Washington.
     It is the further intent of the legislature that all consumers have the following fundamental rights with respect to the sale or issuance of electronic communications devices:
     (1) The right to receive notice prior to a person selling or issuing an electronic communication device;
     (2) The right to expect that a person selling or issuing an electronic communication device will label the device in a clear and conspicuous manner;
     (3) The right to expect that a person selling or issuing an electronic communication device will implement security measures to ensure that any personal information stored about their consumers is secure; and
     (4) The right to seek private remedies if a person fails to comply with any of the principles outlined in subsections (1) through (3) of this section.

NEW SECTION.  Sec. 2   The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.
     (1) "Clear and conspicuous" means that the notice is reasonably understandable and designed to call attention to the nature and significance of the information contained in the notice.
     (2) "Consent acknowledgment" is an electronic or written record, form, statement, or writing used to obtain consent from a consumer in order for a person to collect, maintain, and disclose information gathered by an electronic communication device. This acknowledgment must, at a minimum, specify in a clear and conspicuous manner the person's privacy policy and the manner in which information pertaining to the consumer will be collected and disseminated.
     (3) "Consumer" means an individual who purchases or is issued an electronic communication device for use in Washington.
     (4) "Electronic communication device" means a device that passively or actively uses radio frequency identification technology in the 902-928 MHz frequency range or the 2.4 GHz frequency authorized by the federal communications commission, or any subsequent frequency range authorized by the federal communications commission for radio frequency identification technology as may be provided by the federal communications commission by rule, consistent with the purposes of this act.
     (5) "Identify" means to establish the name, identification number, or other identifying characteristic of an individual, including information linking an individual to previous transactions or activities.
     (6) "Manifest assent" is a deliberate act whereby a consumer volunteers to be identified with the use of information gathered by, or contained within, an electronic communication device. The permission granted by an act of manifest assent for purposes of this chapter shall not apply to more than one specific instance unless permission is secured in the form of a written contract. Manifest assent may refer to the act of a consumer who voluntarily submits his or her electronic communication device in order that it might be scanned or read for the purpose of completing a wholesale or retail transaction.
     (7) "Person" means a government, government subdivision, agency or instrumentality, person, or a legal or commercial entity licensed to do business in the state.
     (8) "Personal information" includes any of the following data elements to the extent they are used alone or in conjunction with any other information to identify a consumer: (a) First or last name; (b) social security number; (c) driver's license number or Washington state identification card number; (d) bank, credit card, or other financial institution account number; (e) credit or debit card number; (f) automated or electronic signature; (g) unique biometric data; (h) an unlisted telephone number; (i) medical information; (j) address; (k) date of birth; (l) ethnicity or nationality; (m) religion; (n) political affiliation; (o) sexual orientation; or (p) a private group affiliation not available in the public domain.
     (9) "Radio frequency identification" means technologies that use radio waves to identify individual items.
     (10) "Universally accepted symbol" means a graphical system designed to provide a standard way to show the presence of an RFID transponder, its frequency, and its data structure.

NEW SECTION.  Sec. 3   Any person that sells or issues an electronic communication device to a consumer that is not disabled, deactivated, or removed at the point of sale or issuance must clearly and conspicuously label the electronic communication device. The label must contain a universally accepted symbol for radio frequency identification technology. The label shall be affixed to the electronic communication device or its packaging and must be clear and conspicuous.

NEW SECTION.  Sec. 4   (1) Any person that sells or issues an electronic communication device to a consumer that is not disabled, deactivated, or removed at the point of sale or issuance shall:
     (a) Post signs providing information to the consumer about the existence of a universally accepted symbol for identifying an electronic communication device; or
     (b) Distribute information to the consumer that explains the meaning of the universally accepted symbol.
     (2) The signs shall be posted in prominent areas near the point of sale or issuance. The signs and lettering shall be clearly visible to consumers. The sign shall display the following information:
     (a) An explanation of the universally accepted symbol or emblem, which indicates that the person is selling or issuing an electronic communication device;
     (b) An explanation of how an electronic communication device may send, gather, or transmit information about the consumer, which could be read by an unauthorized third party; and
     (c) Instructions on whether it is technically feasible to deactivate or remove the electronic communication device, and if technically feasible, instructions on (i) the specific location of the electronic communication device and (ii) how the consumer may seek deactivation or removal of the electronic communication device.

NEW SECTION.  Sec. 5   If an electronic communication device does transmit personal information about a consumer, a person must, prior to sale or issuance of the device, notify the consumer as specified in section 4 of this act and secure a consent acknowledgment or manifest assent from the consumer.

NEW SECTION.  Sec. 6   (1) If the consumer consents to the use of the electronic communication device, either through a consent acknowledgment or manifest assent, but later requests removal or deactivation of the electronic communication device, the consumer may be held responsible for any costs associated with deactivation or removal.
     (2) A consumer shall not be coerced into keeping an electronic communication device active in order for the consumer to be able to exchange, return, repair, or service an item.
     (3) Once an electronic communication device has been deactivated, it shall not be reactivated without the manifest assent of the consumer identified with the electronic communication device.

NEW SECTION.  Sec. 7   (1) Any person who sells or issues an electronic communication device that has not been disabled, deactivated, or removed at the point of sale or issuance must use industry accepted best standards to secure the electronic communication device.
     (2) Any person who retains personal information gathered through an electronic communication device must implement adequate security measures. The security measures should be consistent with industry standards that are commensurate with the amount and sensitivity of the information being stored on the system.

NEW SECTION.  Sec. 8   (1) It is a violation of this act for a person to remotely scan or read or attempt to scan or read an electronic communication device to identify a consumer without obtaining a consent acknowledgment or manifest assent from the consumer.
     (2) This section shall not apply to the following:
     (a) Scanning or reading an electronic communication device, or using information gathered through an electronic communication device, in order to comply with federal law or regulations, or state law;
     (b) Scanning or reading an electronic communication device, or using information gathered through an electronic communication device, in order to comply with properly authorized civil, criminal, administrative, or regulatory investigation or subpoena or summons by federal, state, or local authorities; or
     (c) Scanning or reading an electronic communication device, or using information gathered through an electronic communication device, in order to respond to judicial process or government regulatory authorities having jurisdiction over the person for examination, compliance, or other purposes as authorized by law.

NEW SECTION.  Sec. 9   (1) The attorney general may bring an action against a person who violates sections 3 through 8 of this act to enjoin further violations and to recover the greater of:
     (a) Actual damages; or
     (b) Ten thousand dollars for each separate violation of sections 3 through 8 of this act.
     (2) For purposes of subsection (1) of this section, multiple violations of sections 3 through 8 of this act resulting from any single action or conduct shall constitute one violation.
     (3) In an action under subsection (1) of this section, a court may:
     (a) Increase the damages up to three times the damages allowed by subsection (1) of this section where the defendant has engaged in a pattern and practice of violating sections 3 through 8 of this act; and
     (b) Award costs and reasonable attorneys' fees to a prevailing party.

NEW SECTION.  Sec. 10   Sections 3 through 8 of this act do not apply to the resale of an electronic communication device by a consumer.

NEW SECTION.  Sec. 11   If any provision of this act or its application to any person or circumstance is held invalid, the remainder of the act or the application of the provision to other persons or circumstances is not affected.

NEW SECTION.  Sec. 12   Sections 2 through 11 of this act constitute a new chapter in Title 19 RCW.