(1) A person may not capture or obtain private or proprietary customer information for a commercial purpose unless the person:

(a) Informs the retail electric customer before capturing or obtaining private or proprietary customer information; and

(b) Receives the retail electric customer's written or electronic permission to capture or obtain private or proprietary customer information.

(2) A person who legally possesses private or proprietary customer information that is captured or obtained for a commercial purpose may not sell, lease, or otherwise disclose the private or proprietary customer information to another person unless:

(a) The retail electric customer consents to the disclosure;

(b) The private or proprietary customer information is disclosed to an electric utility or other third party as necessary to effect, administer, enforce, or complete a financial transaction that the retail electric customer requested, initiated, or authorized, provided that the electric utility or third party maintains confidentiality of the private or proprietary customer information and does not further disclose the information except as permitted under this subsection (2); or

(c) The disclosure is required or expressly permitted by a federal statute or by a state statute.

(3) For the purposes of this section, "person" means any individual, partnership, corporation, limited liability company, or other organization or commercial entity, except that "person" does not include an electric utility.

(4) Except as provided in RCW 19.29A.120, the legislature finds that the practices covered by this section are matters vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW. A violation of this section is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.