Washington State
House of Representatives
Office of Program Research
BILL
ANALYSIS
State Government & Tribal Relations Committee
HB 1552
Brief Description: Concerning personal data collected by state agencies.
Sponsors: Representatives Boehnke, Chambers, Schmick and Robertson.
Brief Summary of Bill
  • Prohibits state agencies from selling personal data to third parties.
  • Requires state agencies to provide a privacy notice that includes the categories of personal data collected by the state agency, and to whom and for what purposes the data is shared.
Hearing Date: 3/22/21
Staff: Jason Zolle (786-7124).
Background:

The Right to Privacy.
Personal information and privacy interests are protected under various provisions of state law.  The state Constitution provides that no person shall be disturbed in his private affairs without authority of law.  The Public Records Act prevents the state from sharing information that violates a person's right to privacy under certain circumstances as well.
 
Consolidated Technology Services.
The Consolidated Technology Services agency (WaTech) supports state agencies as a centralized provider and procurer of certain information technology services.  Within WaTech, the Office of Privacy and Data Protection (OPDP) serves as a central point of contact for state agencies on policy matters involving data privacy and data protection.
 
Within the statutes governing WaTech, the term "state agency" is defined as every state office, department, division, bureau, board, commission, or other state agency, including offices headed by a statewide elected official.
Summary of Bill:

State agencies are prohibiting from selling personal data to third parties.
 
"Personal data" is defined as any information relating to a natural person that is collected by a state agency.  "Sale" is defined as the exchange of personal data for monetary consideration, other than cost recovery as permitted by law, to a third party.
 
State agencies must provide a notice to state residents and property owners that informs them:

  • the categories of personal data collected by the state agency;
  • the categories of personal data that the state agency shares with third parties, if any;
  • the purposes for which that data is shared; and
  • the categories of third parties, if any, with whom the state agency shares personal data.

 
By December 31 of each year, each state agency must certify to the OPDP that it is not selling personal data to third parties.

 
Appropriation: None.
Fiscal Note: Requested on March 10, 2021.
Effective Date: The bill takes effect 90 days after adjournment of the session in which the bill is passed.