Bill Summary – FastDemocracy

H-2184.2
                                HOUSE BILL 2277
     State of Washington       68th Legislature           2024 Regular Session
     By Representatives Kloba, Pollet, Slatter, Duerr, Ramel, Ryu, Fosse,
     Cortes, Morgan, and Nance
     Read first time 01/10/24.       Referred     to   Committee   on   Consumer
     Protection & Business.
      AN ACT Relating to licensing of business entities engaged in the
  act of brokering data; amending RCW 18.235.020; adding a new chapter
  to Title 19 RCW; creating a new section; and providing an effective
  date.
  BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:
     NEW SECTION. Sec. 1. (1) The legislature finds that:
     (a) The data consumers generate in nearly every moment of their
 modern lives in today's highly technological world enables the
 constant surveillance of any individual any time of the day and every
 day of the year. There has been rapid growth in the volume and
 variety of this personal data, which is known as behavioral surplus,
 being collected, analyzed, packaged, sold, purchased, monetized, and
 used in ways that are both helpful and harmful. This process is
 largely invisible to consumers and often happens without their
 awareness or consent. This growth has the potential for great
 benefits to human knowledge, technological innovation, and economic
 growth, but also the potential to harm individual privacy and
 freedom;
     (b) Privacy is a deeply held value of Washington state residents,
 and Washington explicitly recognizes its citizens' right to privacy
 under Article I, section 7 of the state Constitution. Fundamental
                                     p. 1                                HB 2277
 privacy rights have long been and continue to be integral to
 protecting   Washingtonians  and   to   safeguarding  the   democratic
 republic. Washington residents should have the right to a reasonable
 expectation of privacy in their movements, and thus should be free
 from ubiquitous and surreptitious surveillance;
     (c) Washington is a technology leader on a national and global
 level and recognizes its distinctive position in promoting the
 efficient balance of consumer privacy and economic benefits. In
 addition, the technology industry has been a tremendous driver of
 economic growth in Washington state, but should not be based on the
 exploitation of its residents at the expense of their privacy; and
     (d) Technological advances have outpaced the legislature's
 ability to protect consumers. Technology and businesses continue to
 push the limits of data collection with exponential rapidity. Laws
 must keep pace as technology and business practices evolve.
     (2) The legislature intends to lay the groundwork for improved
 protection of the privacy of the residents of Washington. Creating a
 policy that offers greater transparency and accountability of the
 actions of data brokers will allow consumers to understand which
 companies are engaged in brokering personal data. It is the intention
 of the legislature for this to lead to the creation of more robust
 privacy safeguards and improved ability of consumers to make informed
 decisions about how their personal data is collected and used.
     NEW SECTION.    Sec. 2.     The definitions in this section apply
 throughout   this   chapter   unless   the  context   clearly    requires
 otherwise.
     (1)(a) "Biometric information" means a record of one or more
 measurable biological or behavioral characteristics that can be used
 alone or in combination with each other or with other information for
 automated recognition of a known or unknown individual. Examples
 include, but are not limited to: fingerprints, retina and iris
 patterns, voiceprints, DNA sequence, facial characteristics, gait,
 handwriting, key stroke dynamics, and mouse movements.
     (b) "Biometric information" does not include writing samples,
 written   signatures,   human   biological   samples   used   for   valid
 scientific    testing   or    screening,   demographic    data,    tattoo
 descriptions, or physical descriptions, such as height, weight, hair
 color, or eye color. "Biometric information" does not include donated
 organs, tissues, or parts, or blood or serum stored on behalf of
                                       p. 2                           HB 2277
 recipients or potential recipients of living or cadaveric transplants
 and obtained or stored by a federally designated organ procurement
 agency.
     (2) "Brokered personal data" means any of the following
 computerized   data  elements   about   a  resident   individual,  if
 categorized or organized for sale or licensing to another entity:
     (a) The resident individual's name or the name of a member of the
 resident individual's immediate family or household;
     (b) The resident individual's address or an address for a member
 of the resident individual's immediate family or household;
     (c) The resident individual's date or place of birth;
     (d) The maiden name of the resident individual's mother;
     (e) Biometric information about the resident individual;
     (f) The resident individual's social security number or the
 number of any other government-issued identification for the resident
 individual; or
     (g) Other information that, alone or in combination with other
 information that is sold or licensed, can reasonably be associated
 with the resident individual.
     (3)(a) "Business entity" means:
     (i) A resident individual who regularly engages in commercial
 activity for the purpose of generating income;
     (ii) A corporation or nonprofit corporation, limited liability
 company, partnership or limited liability partnership, business
 trust, joint venture, or other form of business organization the
 constituent parts of which share a common economic interest;
     (iii) A financial institution, as defined in RCW 9A.56.280; or
     (iv) An individual that controls, is controlled by, or is under
 common control with a person described in (a)(ii) or (iii) of this
 subsection (3).
     (b) "Business entity" does not include the state or a state
 agency, a local government, or a business entity or other person
 during a period in which the business entity or person is acting
 solely on behalf of and at the direction of the state, a state
 agency, or the local government.
     (4) "Data broker" means any business entity that engages in data
 brokering and does not include:
     (a) A consumer reporting agency, as defined in Title 15 U.S.C.
 Sec. 1681a, a person that furnishes information to a consumer
 reporting agency, as provided in Title 15 U.S.C. Sec. 1681s-2, or a
                                     p. 3                          HB 2277
 user of a consumer report, as defined in Title 15 U.S.C. Sec. 1681a,
 to the extent that the consumer reporting agency, the person that
 furnishes information to a consumer reporting agency, or the user of
 a consumer report engages in activities that are subject to
 regulation under the federal fair credit reporting act, Title 15
 U.S.C. Sec. 1681 et seq.; and
     (b) A financial institution, an affiliate, or a nonaffiliated
 third party, as those terms are defined in Title 15 U.S.C. Sec. 6809,
 to the extent that the financial institution, affiliate, or
 nonaffiliated third party is subject to regulation under Title V of
 the Gramm-Leach-Bliley act, Title 15 U.S.C. Secs. 6801 to 6809, and
 regulations adopted under Title V of the Gramm-Leach-Bliley act.
     (5) "Data brokering" means the act of collecting, aggregating,
 analyzing, buying, selling, and sharing brokered personal data,
 irrespective of the business entity's relationship with the resident
 individual whose data is being brokered.
     (6) "Department" means the department of licensing.
     (7) "Resident individual" means a person who          resides   in
 Washington.
     NEW SECTION. Sec. 3. (1) Except as provided in subsection (2)
 of this section, a data broker who engages in data brokering must
 register with the department as provided in section 4 of this act.
     (2) A data broker is not required to register with the department
 if the brokered personal data involves any of the following:
     (a) Providing publicly available information that is related to a
 resident individual's business or profession;
     (b) Providing publicly available information as part of a service
 that provides alerts for health or safety purposes;
     (c) Providing directory assistance or directory information
 services as, or on behalf of, a telecommunications carrier; or
     (d) Selling the assets of a business entity or a part of a
 business entity a single time, or only occasionally, as part of a
 transfer of control over the assets that is not part of the ordinary
 conduct of the business entity or a part of the business entity.
     NEW SECTION.   Sec. 4.   (1) Annually, on or before January 31st
 following a year in which a business entity meets the definition of
 data broker as provided in section 2 of this act, a data broker must:
     (a) Submit on a form and in a format the department specifies:
                                     p. 4                          HB 2277
       (i) The name of the data broker;
       (ii) The street address and telephone number of the data broker;
 and
     (iii) The data broker's primary website and email address;
     (b) Pay a fee in an amount the department specifies by rule. The
 department shall set the fee in an amount that is sufficient to pay
 the costs of administering the registration program as provided in
 RCW 43.24.086. Any fees or fines collected under the authority of
 this chapter must be deposited into the business and professions
 account created in RCW 43.24.150; and
     (c) Include with the application form a declaration in which the
 data broker:
     (i) States whether a resident individual's precise geolocation
 information is a part of their data brokering activity;
     (ii) States whether resident individuals' consumer health data,
 as defined in RCW 19.373.010, is a part of their data brokering
 activity;
     (iii) States whether resident individuals may opt out of all or a
 portion of the data broker's use of their brokered personal data;
     (iv)(A) Identifies which of the data broker's activities a
 resident individual may opt out of; and
     (B) Identifies which portion of the resident individual's
 brokered personal data the resident individual may opt out of
 providing or permitting the data broker to use;
     (v) Describes the method by which a resident individual may
 exercise the choices described in (c)(iii) and (iv) of this
 subsection (1); and
     (vi) States whether a resident individual may authorize an
 individual to exercise the choice described in (c)(iii) of this
 subsection (1) on the resident individual's behalf and, if so, the
 appropriate process for the authorization.
     (2) If a data broker complies with the requirements set forth in
 this section, the department must approve the registration. A
 registration under this section is valid until December 31st of the
 year in which the department approves the registration.
     NEW SECTION.     Sec. 5.    (1) The department shall make the
 information that business entities submit for registration under this
 chapter publicly available on the department's website.
                                       p. 5                         HB 2277
     (2) The department shall report to the governor and to the
 legislature in accordance with RCW 43.01.036 annually, beginning
 December 31, 2026, on the following:
     (a) How many business entities registered with the department as
 data brokers in that year;
     (b) The fee the department charged for registration per data
 broker, and the total revenue collected;
     (c) How many business entities were fined for noncompliance with
 this chapter; and
     (d) Any other information the department deems relevant.
     NEW SECTION.    Sec. 6.  The uniform regulation of business and
 professions act, chapter 18.235 RCW governs unlicensed practice, the
 issuance and denial of licenses, and the discipline of licensees
 under this chapter.
     NEW SECTION.   Sec. 7.   The department may adopt rules that are
 necessary to implement the provisions of this chapter.
     Sec. 8. RCW 18.235.020 and 2017 c 281 s 37 are each amended to
 read as follows:
     (1) This chapter applies only to the director and the boards and
 commissions having jurisdiction in relation to the businesses and
 professions licensed under the chapters specified in this section.
 This chapter does not apply to any business or profession not
 licensed under the chapters specified in this section.
     (2)(a) The director has authority under this chapter in relation
 to the following businesses and professions:
     (i) Auctioneers under chapter 18.11 RCW;
     (ii) Bail bond agents and bail bond recovery agents under chapter
 18.185 RCW;
     (iii) Camping resorts' operators and salespersons under chapter
 19.105 RCW;
     (iv) Commercial telephone solicitors under chapter 19.158 RCW;
     (v) Cosmetologists, barbers, manicurists, and estheticians under
 chapter 18.16 RCW;
     (vi) Court reporters under chapter 18.145 RCW;
     (vii) Driver training schools and instructors under chapter 46.82
 RCW;
     (viii) Employment agencies under chapter 19.31 RCW;
                                     p. 6                          HB 2277
     (ix) For hire vehicle operators under chapter 46.72 RCW;
     (x) Limousines under chapter 46.72A RCW;
     (xi) Notaries public under chapter 42.45 RCW;
     (xii) Private investigators under chapter 18.165 RCW;
     (xiii) Professional boxing, martial arts, and wrestling     under
 chapter 67.08 RCW;
     (xiv) Real estate appraisers under chapter 18.140 RCW;
     (xv) Real estate brokers and salespersons under chapters    18.85
 and 18.86 RCW;
      (xvi) Scrap metal processors, scrap metal recyclers, and   scrap
 metal suppliers under chapter 19.290 RCW;
     (xvii) Security guards under chapter 18.170 RCW;
     (xviii) Sellers of travel under chapter 19.138 RCW;
     (xix) Timeshares and timeshare salespersons under chapter   64.36
 RCW;
      (xx) Whitewater river outfitters under chapter 79A.60 RCW;
      (xxi) Home inspectors under chapter 18.280 RCW;
      (xxii) Body artists, body piercers, and tattoo artists, and body
 art, body piercing, and tattooing shops and businesses, under chapter
 18.300 RCW; ((and))
     (xxiii) Appraisal management companies under chapter 18.310 RCW;
 and
      (xxiv) Data brokers under chapter 19.--- RCW (the new chapter
 created in section 9 of this act).
      (b) The boards and commissions having authority under this
 chapter are as follows:
      (i) The state board for architects established in chapter 18.08
 RCW;
     (ii) The Washington state collection agency board established in
 chapter 19.16 RCW;
      (iii) The state board of registration for professional engineers
 and land surveyors established in chapter 18.43 RCW governing
 licenses issued under chapters 18.43 and 18.210 RCW;
      (iv) The funeral and cemetery board established in chapter 18.39
 RCW governing licenses issued under chapters 18.39 and 68.05 RCW;
      (v) The state board of licensure for landscape architects
 established in chapter 18.96 RCW; and
      (vi) The state geologist licensing board established in chapter
 18.220 RCW.
                                     p. 7                          HB 2277
      (3) In addition to the authority to discipline license holders,
  the disciplinary authority may grant or deny licenses based on the
  conditions and criteria established in this chapter and the chapters
  specified in subsection (2) of this section. This chapter also
  governs any investigation, hearing, or proceeding relating to denial
  of licensure or issuance of a license conditioned on the applicant's
  compliance with an order entered under RCW 18.235.110 by the
  disciplinary authority.
     NEW SECTION.     Sec. 9.    Sections 2    through   7   of   this   act
 constitute a new chapter in Title 19 RCW.
    NEW SECTION.   Sec. 10.   This act takes effect January 1, 2026.
                                   --- END ---
                                      p. 8                             HB 2277
Statutes affected: 
Original Bill: 18.235.020