BILL REQ. #:  H-5131.2 

READ FIRST TIME 02/01/08.   

     AN ACT Relating to identification documents; amending RCW 19.192.020, 42.56.230, and 42.56.330; adding new sections to chapter 19.192 RCW; creating a new section; and prescribing penalties.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

NEW SECTION.  Sec. 1   The legislature finds that:
     (1) Washington state recognizes the importance of protecting the confidentiality and privacy of an individual's personal information contained in drivers' licenses and identicards.
     (2) Machine-readable features found on drivers' licenses and identicards are intended to facilitate verification of age or identity, not to facilitate collection of personal information about individuals, nor to facilitate the creation of private databases of transactional information associated with those individuals.
     (3) Easy access to the information found on drivers' licenses and identicards facilitates the crime of identity theft, a crime that is a major concern in Washington.

NEW SECTION.  Sec. 2   A new section is added to chapter 19.192 RCW to read as follows:
     (1) The definitions in this subsection apply throughout this section unless the context clearly requires otherwise.
     (a) "Electronically" means relating to technology having electrical, digital, magnetic, wireless, optical, electromagnetic, or similar capabilities.
     (b) "Personal information" includes any of the following: An individual's name, address, date of birth, photograph, fingerprint or other biometric image of the individual, driver's license or identicard number, or any other unique personal identifier or number.
     (2)(a) A nongovernmental entity may only electronically read an individual's driver's license or identicard to verify the authenticity of the document, verify the individual's age or identity, or to comply with federal or state laws or regulations requiring identification verification.
     (b) When a nongovernmental entity electronically reads a driver's license or identicard for one of the purposes permitted in (a) of this subsection, and except as otherwise permitted in subsection (3) of this section, the entity may not store, sell, or share personal information collected from the driver's license or identicard without written consent of the individual.
     (3) A business may only verify a consumer's age when providing an age-restricted good or service or for which there is a discount based on the consumer's age. A business may only verify a consumer's identity and the accuracy of personal information submitted by a consumer when the consumer pays with a method other than cash or returns an item. A business may only store or share the personal information collected from a consumer's driver's license or identicard for the purposes of preventing fraud. Any personal information collected from a driver's license or identicard must be destroyed within sixty days. A business may not deny a consumer or prospective consumer a good or service when the consumer or prospective consumer exercises the right under this section not to allow his or her driver's license or identicard to be read electronically for other purposes or exercises the right not to allow storage, sale, or sharing of personal information, except as permitted by this subsection or as required by federal or state laws or regulations requiring identification verification.
     (4) A governmental entity may only electronically read an individual's driver's license or identicard when the individual knowingly makes the driver's license or identicard available to the governmental entity or the governmental entity lawfully seizes the driver's license or identicard.
     (5) A nongovernmental entity or governmental entity may electronically read an individual's driver's license or identicard to provide emergency assistance when the individual is unconscious or otherwise unable to make the driver's license or identicard available.
     (6) Any waiver of a provision of this section is contrary to public policy and is void and unenforceable.
     (7) In addition to any other remedy provided by law, an individual whose personal information is read, stored, shared, sold, or otherwise used in violation of this section may bring an action to recover actual damages or one thousand dollars, whichever is greater, and equitable relief, if available. A court shall award a prevailing individual reasonable costs and attorneys' fees. If a court finds that a violation of this section was willful or knowing, the court may increase the amount of the award to no more than three times the amount otherwise available.

NEW SECTION.  Sec. 3   A new section is added to chapter 19.192 RCW to read as follows:
     The legislature finds that the practices covered by section 2 of this act are matters vitally affecting the public interest for the purpose of applying chapter 19.86 RCW. A violation of section 2 of this act is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying chapter 19.86 RCW.

Sec. 4   RCW 19.192.020 and 2003 c 89 s 2 are each amended to read as follows:
     (1) Any provision of a contract between a merchant or retailer and a credit or debit card issuer, financial institution, or other person that prohibits the merchant or retailer from verifying the identity of a customer who offers to pay for goods or services with a credit or debit card by requiring or requesting that the customer present additional identification is void for violation of public policy.
     (2) Nothing in this ((section)) chapter shall be interpreted as((: (a))) compelling merchants or retailers to verify identification((; or (b) interfering with the ability of the owner or manager of a retail store or chain to make and enforce its own policies regarding verification of identification)).

Sec. 5   RCW 42.56.230 and 2005 c 274 s 403 are each amended to read as follows:
     The following personal information is exempt from public inspection and copying under this chapter:
     (1) Personal information in any files maintained for students in public schools, patients or clients of public institutions or public health agencies, or welfare recipients;
     (2) Personal information in files maintained for employees, appointees, or elected officials of any public agency to the extent that disclosure would violate their right to privacy;
     (3) Information required of any taxpayer in connection with the assessment or collection of any tax if the disclosure of the information to other persons would (a) be prohibited to such persons by RCW 84.08.210, 82.32.330, 84.40.020, or 84.40.340 or (b) violate the taxpayer's right to privacy or result in unfair competitive disadvantage to the taxpayer; ((and))
     (4) Credit card numbers, debit card numbers, electronic check numbers, card expiration dates, or bank or other financial account numbers, except when disclosure is expressly required by or governed by other law; and
     (5) Documents and related materials and scanned images of documents and related materials used to prove identity, age, residential address, social security number, or other personal information required to apply for a driver's license or identicard.

Sec. 6   RCW 42.56.330 and 2007 c 197 s 5 are each amended to read as follows:
     The following information relating to public utilities and transportation is exempt from disclosure under this chapter:
     (1) Records filed with the utilities and transportation commission or attorney general under RCW 80.04.095 that a court has determined are confidential under RCW 80.04.095;
     (2) The residential addresses and residential telephone numbers of the customers of a public utility contained in the records or lists held by the public utility of which they are customers, except that this information may be released to the division of child support or the agency or firm providing child support enforcement for another state under Title IV-D of the federal social security act, for the establishment, enforcement, or modification of a support order;
     (3) The names, residential addresses, residential telephone numbers, and other individually identifiable records held by an agency in relation to a vanpool, carpool, or other ride-sharing program or service; however, these records may be disclosed to other persons who apply for ride-matching services and who need that information in order to identify potential riders or drivers with whom to share rides;
     (4) The personally identifying information of current or former participants or applicants in a paratransit or other transit service operated for the benefit of persons with disabilities or elderly persons;
     (5) The personally identifying information of persons who acquire and use transit passes and other fare payment media including, but not limited to, stored value smart cards and magnetic strip cards, except that an agency may disclose this information to a person, employer, educational institution, or other entity that is responsible, in whole or in part, for payment of the cost of acquiring or using a transit pass or other fare payment media, or to the news media when reporting on public transportation or public safety. This information may also be disclosed at the agency's discretion to governmental agencies or groups concerned with public transportation or public safety;
     (6) Any information obtained by governmental agencies that is collected by the use of a motor carrier intelligent transportation system or any comparable information equipment attached to a truck, tractor, or trailer; however, the information may be given to other governmental agencies or the owners of the truck, tractor, or trailer from which the information is obtained. As used in this subsection, "motor carrier" has the same definition as provided in RCW 81.80.010; ((and))
     (7) The personally identifying information of persons who acquire and use transponders or other technology to facilitate payment of tolls. This information may be disclosed in aggregate form as long as the data does not contain any personally identifying information. For these purposes aggregate data may include the census tract of the account holder as long as any individual personally identifying information is not released. Personally identifying information may be released to law enforcement agencies only for toll enforcement purposes. Personally identifying information may be released to law enforcement agencies for other purposes only if the request is accompanied by a court order; and
     (8) The personally identifying information of persons who acquire and use a driver's license or identicard that includes a radio frequency identification chip or similar technology to facilitate border crossing. This information may be disclosed in aggregate form as long as the data does not contain any personally identifying information. Personally identifying information may be released to law enforcement agencies only for United States customs and border protection enforcement purposes. Personally identifying information may be released to law enforcement agencies for other purposes only if the request is accompanied by a court order.