H-1111.1

HOUSE BILL 1799

ByRepresentatives Kloba and Berry

AN ACT Relating to the registration of business entities that qualify as data brokers; adding a new chapter to Title 19 RCW; prescribing penalties; and providing an effective date.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

(1) "Brokered personal data" means any of the following computerized data elements about a resident individual, if categorized or organized for sale or licensing to another entity:

(a) The resident individual's name or the name of a member of the resident individual's immediate family or household;

(b) The resident individual's address or an address for a member of the resident individual's immediate family or household;

(c) The resident individual's date or place of birth;

(d) The maiden name of the resident individual's mother;

(e) Biometric information about the resident individual;

(f) The resident individual's social security number or the number of any other government-issued identification for the resident individual; or

(g) Other information that, alone or in combination with other information that is sold or licensed, can reasonably be associated with the resident individual.

(2)(a) "Business entity" means:

(i) A resident individual who regularly engages in commercial activity for the purpose of generating income;

(ii) A corporation or nonprofit corporation, limited liability company, partnership or limited liability partnership, business trust, joint venture, or other form of business organization the constituent parts of which share a common economic interest;

(iii) A financial institution, as defined in RCW 9A.56.280; or

(iv) An individual that controls, is controlled by, or is under common control with a person described in (a)(ii) or (iii) of this subsection (2).

(b) "Business entity" does not include the state or a state agency, a local government, or a business entity or other person during a period in which the business entity or person is acting solely on behalf of and at the direction of the state, a state agency, or the local government.

(3) "Data broker" means a business entity or part of a business entity that collects and sells or licenses brokered personal data to another person and does not include:

(a) A consumer reporting agency, as defined in Title 15 U.S.C. Sec. 1681a, a person that furnishes information to a consumer reporting agency, as provided in Title 15 U.S.C. Sec. 1681s-2, or a user of a consumer report, as defined in Title 15 U.S.C. Sec. 1681a, to the extent that the consumer reporting agency, the person that furnishes information to a consumer reporting agency, or the user of a consumer report engages in activities that are subject to regulation under the federal fair credit reporting act, Title 15 U.S.C. Sec. 1681 et seq.;

(b) A financial institution, an affiliate, or a nonaffiliated third party, as those terms are defined in Title 15 U.S.C. Sec. 6809, to the extent that the financial institution, affiliate, or nonaffiliated third party is subject to regulation under Title V of the Gramm-Leach-Bliley act, Title 15 U.S.C. Secs. 6801 to 6809, and regulations adopted under Title V of the Gramm-Leach-Bliley act;

(c) A business entity that collects information about a resident individual if the resident individual is or was:

(i) A customer, subscriber, or user of the business entity's goods or services;

(ii) An employee or agent of the business entity or is in a contractual relationship with the business entity;

(iii) An investor in the business entity;

(iv) A donor to the business entity; or

(v) In another relationship with the business entity the nature of which is similar to the relationships described in this subsection; or

(d) A business entity that performs services for, acts on behalf of, or acts as an agent of a business entity described in (c) of this subsection.

(4) "Department" means the department of licensing.

(5) "Resident individual" means a person who resides in Washington state.

(2) A data broker may collect, sell, or license brokered personal data without registering with the department if the collection, sale, or licensing involves any of the following:

(a) Providing publicly available information that is related to a resident individual's business or profession;

(b) Providing publicly available information as part of a service that provides alerts for health or safety purposes;

(c) Providing information that is lawfully available from federal, state, or local government records;

(d) Publishing, selling, reselling, distributing, or providing digital access to journals, books, periodicals, newspapers, magazines, news media, or educational, academic, or instructional works;

(e) Developing or maintaining an electronic commerce service or software;

(f) Providing directory assistance or directory information services as, or on behalf of, a telecommunications carrier; or

(g) Selling the assets of a business entity or a part of a business entity a single time, or only occasionally, as part of a transfer of control over the assets that is not part of the ordinary conduct of the business entity or a part of the business entity.

(a) Submit on a form and in a format the department specifies:

(i) The name of the data broker;

(ii) The street address and telephone number of the data broker; and

(iii) The data broker's primary website and email address;

(b) Pay a fee in an amount the department specifies by rule. The department shall set the fee in an amount that is sufficient to pay the costs of administering the registration program;

(c) Include with the application form a declaration in which the data broker:

(i) States whether resident individuals may opt out of all or a portion of the data broker's collection, sale, or licensing of the resident individuals' brokered personal data;

(ii) Identifies which of the data broker's activities of collecting, selling, or licensing brokered personal data a resident individual may opt out of or which portion of the resident individual's brokered personal data the resident individual may opt out of providing or permitting the data broker to collect, sell, or license;

(iii) Describes the method by which a resident individual may exercise the choices described in (a) and (b) of this subsection; and

(iv) States whether a resident individual may authorize an individual to exercise the choice described in (c)(i) of this subsection on the resident individual's behalf and, if so, the appropriate process for the authorization.

(2) If a data broker complies with the requirements set forth in this section, the department must approve the registration. A registration under this section is valid until December 31st of the year in which the department approves the registration.

(3) The department may approve and renew a registration under this section by means of an agreement with the nationwide multistate licensing system and may, by rule, conform the practices, procedures, and information that the department uses to approve or renew a registration to the requirements of the nationwide multistate licensing system.

(2) The total amount of penalties that may be imposed on a data broker may not exceed $10,000 during any calendar year.

(3) If the data broker fails to pay the civil penalty, the attorney general may recover the amount imposed by action in the appropriate court.

--- END ---