BILL REQ. #:  H-0397.2 

Prefiled 12/27/2006. Read first time 01/08/2007.   Referred to Committee on Technology, Energy & Communications.

     AN ACT Relating to electronic communication devices; adding new sections to chapter 9.73 RCW; creating a new section; and prescribing penalties.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION.  Sec. 1   The legislature finds that Washington state, from its inception, has recognized the importance of maintaining individual privacy. The legislature further finds that protecting the confidentiality and privacy of an individual's personal information, especially when collected from the individual without his or her knowledge or consent, is critical to maintaining the safety and well-being of its citizens.
     The legislature recognizes that inclusion of technologies like radio frequency identification or other electronic communication devices that broadcast data or enable data or information to be collected or scanned secretly and/or remotely will greatly magnify the potential risk to individual privacy, safety, and economic well-being that can occur from unauthorized interception and use of personal information. The legislature further recognizes that inclusion of those devices will also make it possible for a person or entity with access to a reader or other scanning device to engage in the tracking of the citizens of Washington state without their knowledge or consent.
     Therefore, it is the intent of the legislature to establish individual privacy rights in an era of innovation of new technologies. It is further the intent of the legislature to establish such rights so that manufacturers and sellers of new, innovative technologies have a predictable set of known, individual rights to be aware of before offering their technology for sale or use in the state of Washington.

NEW SECTION.  Sec. 2   All consumers shall have the following fundamental rights with respect to electronic privacy:
     (1) The right to receive notice of an entity's information practices before any personal information is collected about them;
     (2) The right to receive choices as to how any personal information collected from an individual may be used;
     (3) The right to access one's personal information and to contest the accuracy of such information;
     (4) The right to expect that collectors of data will implement security measures to ensure that their data is accurate and secure; and
     (5) The right to seek private remedies if an entity fails to comply with any of the principles outlined in subsections (1) through (4) of this section.

NEW SECTION.  Sec. 3   The definitions in this section apply throughout sections 2 through 9 of this act unless the context clearly requires otherwise.
     (1) "Consumer" means a person who uses or purchases items for use or resale within the state of Washington.
     (2) "Electronic communication device" means any device that can transfer signs, signals, writing, images, sounds, data, or intelligence of any nature in whole or in part by a wire, radio, electromagnetic, photoelectronic, or photo-optical system, but does not include:
     (a) Any written or oral communication;
     (b) Any communication made through a tone-only paging device; or
     (c) Any communication from a tracking device.
     (3) "Item" means an individual unit that can be scanned. For purposes of this chapter, "item" may refer to government-issued identification documents or swipe cards, or credit cards, as well as merchandise offered for sale or resale.
     (4) "Person" means an individual, corporation, business trust, estate, trust, partnership, limited liability company, association, joint venture, government, government subdivision, agency or instrumentality, public corporation, or any other legal or commercial entity.
     (5) "Personal information" includes any of the following information associated with an individual: (a) Social security number; (b) driver's license number; (c) bank account number; (d) credit or debit card number; (e) personal identification number; (f) automated or electronic signature; (g) unique biometric data; (h) account passwords; (i) telephone number; (j) address; (k) e-mail address; (l) date of birth; or (m) any other piece of information that can be used to access an individual's financial accounts or to obtain goods or services, or offer goods or services based on that information without an individual's consent.
     (6) "Unique identifier number" means a number associated with an identification document or item, but not otherwise related to the individual that the document or item identifies. A unique identifier number may not be based on the individual's social security number or any other personal identifier associated with the individual.

NEW SECTION.  Sec. 4   (1) Any person that sells, issues, or distributes items containing an electronic communication device shall post a notice informing a consumer of the use of such technology. The notice shall be posted in a form that can be reasonably read by the consumer. The notice shall disclose the following:
     (a) The item contains or may contain an electronic communication device;
     (b) The consumer has the right under Washington state law to request that an item containing an electronic communication device be removed or deactivated before the item leaves the premises; and
     (c) The consumer has the right to request, in writing, a copy of all personal information collected about himself or herself through an electronic communication device, including the identity of any person who has had access to the requester's personal information.
     (2) A person shall not sell, use, or distribute an item that contains an electronic communication device without labeling such item with a notice stating that such item contains an electronic device capable of engaging in electronic communication and that the device can transmit personal information to an independent reader or scanner both before and after purchase or issuance.
     (3) Upon written request by a consumer, any person who has gathered personal information about a consumer shall release to the consumer all of the stored personal information pertaining to the requester, including the identity of any individual or entity, external or internal, who has had access to the requester's personal information.
     (4) After reviewing his or her personal information, the consumer must be given the opportunity to:
     (a) Contest the accuracy, completeness, timeliness, relevance, or dissemination of his or her personal data;
     (b) Correct or amend the data; and
     (c) Request that the information be removed or destroyed from the database, unless removal or destruction of the information would be contrary to applicable state or federal law.
     (5) Upon request by a consumer, a person who sells, issues, or distributes an item containing an electronic communication device must remove or deactivate the device before the consumer leaves the premises. Any costs associated with removal or deactivation of the device shall not be borne by the consumer.
     (6) A consumer shall not be coerced into keeping an electronic communication device active on an item in order for the consumer to be able to exchange, return, repair, or service the item, or as a condition of employment. Once an electronic communication device in an item has been deactivated, it shall not be reactivated without the express, written consent of the consumer associated with the item.

NEW SECTION.  Sec. 5   No person shall combine or link a consumer's personal information with information gathered by, or contained within, a device capable of engaging in electronic communication.

NEW SECTION.  Sec. 6   Any person who sells or utilizes an electronic communication device must implement adequate security measures to ensure that information is secure from unauthorized access, loss, or tampering. These security measures should be consistent with industry standards that are commensurate with the amount and sensitivity of the information being stored on the system.

NEW SECTION.  Sec. 7   It is a violation of sections 2 through 9 of this act for a person to engage in any of the following activities:
     (1) Use an electronic communication device to remotely scan or attempt to scan an item associated with a consumer without that consumer's knowledge;
     (2) Disclose, either directly or through an affiliate, a consumer's personal information associated with information gathered by, or contained within, a device capable of engaging in electronic communication; or
     (3) Use, either directly or through an affiliate or nonaffiliated third party, information gathered by, or contained within, a device capable of engaging in electronic communication in order to identify a consumer.

NEW SECTION.  Sec. 8   (1) A person who is injured under sections 2 through 9 of this act may bring a civil action in district or superior court to enjoin further violations, and to seek up to five hundred dollars per violation, or actual damages, whichever is greater.
     (2) In any action under this section, a court may increase the damages up to three times the damages allowed under subsection (1) of this section if the defendant has engaged in a pattern and practice of violating sections 2 through 9 of this act. The court may award costs and reasonable attorneys' fees to a prevailing party.

NEW SECTION.  Sec. 9   (1) A person who willfully violates any of the provisions of sections 2 through 9 of this act is guilty of a gross misdemeanor.
     (2) A person who willfully violates any of the provisions of sections 2 through 9 of this act in conjunction with the commission of another unlawful act is guilty of a class B felony.

NEW SECTION.  Sec. 10   Sections 2 through 9 of this act are each added to chapter 9.73 RCW.