Instruments
Each one links to its
LexLint note, which carries what it requires and what it flags on.
Biometric privacy
cite RCW 19.375; HB 1493, chapter 299, Laws of 2017
stage In effect
since 2017-07-23
source official codified statute text, Revised Code of Washington, and the official Washington State Legislature bill history for HB 1493
Requires a person to provide notice, obtain consent, or provide a mechanism to prevent use, before enrolling an individual's biometric identifier in a database for a commercial purpose.
Biometric identifier is defined as data from automatic measurement of biological characteristics such as fingerprint, voiceprint, retina, or iris, but the definition excludes any identifier generated from a photo, video, or audio recording and any HIPAA covered information, so a faceprint or voiceprint pulled from an existing recording falls outside this statute even though the same identifier is covered as consumer health data under the My Health My Data Act.
An enrolled identifier may be retained no longer than reasonably necessary for the purpose it was enrolled for, a legal retention duty, or fraud and security prevention, and the chapter separately exempts Gramm-Leach-Bliley financial institutions and law enforcement.
What it asks of an app →
Breach notification
cite RCW 19.255, as amended by HB 1071 (2019 c 241); originally enacted 2005 c 368
stage In effect
since 2020-03-01
source official codified statute text, Revised Code of Washington, and the official Washington State Legislature bill history for HB 1071
Requires a person or business conducting business in Washington and owning or licensing data that includes personal information to notify affected residents of a breach of unsecured personal information in the most expedient time possible and no more than 30 calendar days after discovery, and to notify the Attorney General where a breach affects more than 500 Washington residents.
Personal information expressly includes biometric data generated by automatic measurement of biological characteristics such as a fingerprint, voiceprint, retina, or iris, and unlike the state's dedicated Biometric Privacy Law, this definition carries no exclusion for an identifier extracted from a photograph, video, or audio recording.
What it asks of an app →
Sensitive categories
cite RCW 19.373; HB 1155, chapter 191, Laws of 2023
stage In effect
since 2024-03-31
source official codified statute text, Revised Code of Washington, and the official Washington State Legislature bill history for HB 1155
Requires a private regulated entity to obtain separate, affirmative opt-in consent before collecting or sharing a Washington consumer's health data, a category that includes biometric data extracted from imagery or voice recordings with no exclusion for a recording-derived identifier, and a further signed authorization before selling it.
Bans geofencing within 2,000 feet of a health care facility to identify, track, or notify consumers seeking care, and grants consumers the right to confirm, access, withdraw consent to, and delete their data within 45 days, extendable once by 45 more days.
What it asks of an app →
