Law note · Washington
Notice of security breaches involving personal information
Requires a person or business conducting business in Washington and owning or licensing data that includes personal information to notify affected residents of a breach of unsecured personal information in the most expedient time possible and no more than 30 calendar days after discovery, and to notify the Attorney General where a breach affects more than 500 Washington residents.
Personal information expressly includes biometric data generated by automatic measurement of biological characteristics such as a fingerprint, voiceprint, retina, or iris, and unlike the state's dedicated Biometric Privacy Law, this definition carries no exclusion for an identifier extracted from a photograph, video, or audio recording.
What it asks of an app
- Notify affected Washington residents of a breach of unsecured personal information, including biometric identifiers, in the most expedient time possible and no more than 30 calendar days after discovery.
- Notify the Washington Attorney General of any breach affecting more than 500 Washington residents.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice
Primary source: official codified statute text, Revised Code of Washington, and the official Washington State Legislature bill history for HB 1071