Data Breach Requirements: RCW § 19.255.005 et seq.
The numbering and internal citations herein are derived from the applicable state statute.
Personal Information
(2)(a) The term “personal information” means:
(i) An individual’s first name or first initial and last name in combination with any one or more of the following data elements:
(A) Social Security number;
(B) Driver’s license number or Washington identification card number;
(C) Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account, or any other numbers or information that can be used to access a person’s financial account;
(D) Full date of birth;
(E) Private key that is unique to an individual and that is used to authenticate or sign an electronic record;
(F) Student, military, or passport identification number;
(G) Health insurance policy number or health insurance identification number;
(H) Any information about a consumer’s medical history or mental or physical condition or about a health care professional’s medical diagnosis or treatment of the consumer; or
(I) Biometric data generated by automatic measurements of an individual’s biological characteristics such as a fingerprint, voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that are used to identify a specific individual;
(ii) Username or email address in combination with a password or security questions and answers that would permit access to an online account; and
(iii) Any of the data elements or any combination of the data elements described in (a)(i) of this subsection without the consumer’s first name or first initial and last name if: (A) Encryption, redaction, or other methods have not rendered the data element or combination of data elements unusable; and (B) The data element or combination of data elements would enable a person to commit identity theft against a consumer.
Security Breach Definition
The term “breach of the security of the system” means unauthorized acquisition of data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business.
Good Faith Exception
Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system when the personal information is not used or subject to further unauthorized disclosure.
Risk of Harm Analysis
A breach notice is not required if the breach of the security of the system is not reasonably likely to subject consumers to a risk of harm. The breach of secured personal information must be disclosed if the information acquired and accessed is not secured during a security breach or if the confidential process, encryption key, or other means to decipher the secured information was acquired by an unauthorized person.
Notification Timeline
The breach notification to affected consumers must be made in the most expedient time possible, without unreasonable delay, and no more than 30 calendar days after the breach was discovered, unless the delay is at the request of law enforcement, or the delay is due to any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
Security and Investigation Exceptions
The breach notification may be delayed if the data owner or licensee contacts a law enforcement agency after discovery of a breach of the security of the system and a law enforcement agency determines that the notification will impede a criminal investigation. The notification shall be made after the law enforcement agency determines that it will not compromise the investigation.
Notification Content Requirements
Any person or business that is required to issue a breach notification shall meet all of the following requirements:
(a) The notification must be written in plain language; and
(b) The notification must include, at a minimum, the following information:
(i) The name and contact information of the reporting person or business subject to this section;
(ii) A list of the types of personal information that were or are reasonably believed to have been the subject of a breach;
(iii) A time frame of exposure, if known, including the date of the breach and the date of the discovery of the breach; and
(iv) The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed personal information.
Delivery Methods
A breach notice may be provided by one of the following methods:
(a) Written notice;
(b) Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001 (The Electronic Signatures in Global and National Commerce Act);
(c) Substitute notice, if the person or business demonstrates that the cost of providing notice would exceed $250,000, or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information; or
(d)(i) If the breach of the security of the system involves personal information including a username or password, notice may be provided electronically or by email. The notice must also inform the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other appropriate steps to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same username or email address and password or security question or answer; (ii) However, when the breach of the security of the system involves login credentials of an email account furnished by the person or business, the person or business may not provide the notification to that email address, but must provide notice using another method described in this subsection (4). The notice must also inform the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other appropriate steps to protect the online account with the person or business and all other online accounts for which the person whose personal information has been breached uses the same username or email address and password or security question or answer.
Substitute Notice
Substitute notice shall consist of all of the following:
(i) Email notice when the person or business has an email address for the subject persons;
(ii) Conspicuous posting of the notice on the website page of the person or business, if the person or business maintains one; and
(iii) Notification to major statewide media.
Notice to Government Agencies
(a) Any person or business that is required to issue a breach notification to more than 500 Washington residents as a result of a single breach shall notify the attorney general of the breach no more than 30 days after the breach was discovered. The notice to the attorney general shall include the following information:
(i) The number of Washington consumers affected by the breach, or an estimate if the exact number is not known;
(ii) A list of the types of personal information that were or are reasonably believed to have been the subject of a breach;
(iii) A time frame of exposure, if known, including the date of the breach and the date of the discovery of the breach;
(iv) A summary of steps taken to contain the breach; and
(v) A single sample copy of the security breach notification, excluding any personally identifiable information.
(b) The notice to the attorney general must be updated if any of the information identified herein is unknown at the time notice is due.
Consumer Reporting Agencies
N/A
Preemption and Compliance
(1) A covered entity under the federal health insurance portability and accountability act of 1996, 42 U.S.C. Sec. 1320d et seq., is deemed to have complied with the requirements of this chapter with respect to protected health information if it has complied with section 13402 of the federal health information technology for economic and clinical health act, P.L. 111-5 as it existed on July 24, 2015. Covered entities shall notify the attorney general pursuant to RCW 19.255.010(7) in compliance with the timeliness of notification requirements of section 13402 of the federal health information technology for economic and clinical health act, P.L. 111-5 as it existed on July 24, 2015, notwithstanding the timeline in RCW 19.255.010(7).
(2) A financial institution under the authority of the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the National Credit Union Administration, or the Federal Reserve System is deemed to have complied with the requirements of this chapter with respect to “sensitive customer information” as defined in the interagency guidelines establishing information security standards, 12 C.F.R. Part 30, Appendix B, 12 C.F.R. Part 208, Appendix D-2, 12 C.F.R. Part 225, Appendix F, and 12 C.F.R. Part 364, Appendix B, and 12 C.F.R. Part 748, Appendices A and B, as they existed on July 24, 2015, if the financial institution provides notice to affected consumers pursuant to the interagency guidelines and the notice complies with the customer notice provisions of the interagency guidelines establishing information security standards and the interagency guidance on response programs for unauthorized access to customer information and customer notice under 12 C.F.R. Part 364 as it existed on July 24, 2015. The entity shall notify the attorney general pursuant to RCW 19.255.010 in addition to providing notice to its primary federal regulator.
Data Processor Obligations
Any person or business that maintains or possesses data that may include personal information that the person or business does not own or license shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
Data Disposal and Security: RCW § 19.215.010 et seq.
The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.
Key Terms
The term “destroy personal information” means shredding, erasing, or otherwise modifying personal information in records to make the personal information unreadable or undecipherable through any reasonable means.
The term “personal financial” and “health information” mean information that is identifiable to an individual and that is commonly used for financial or health care purposes, including account numbers, access codes or passwords, information gathered for account security purposes, credit card numbers, information held for the purpose of account access or transaction initiation, or information that relates to medical history or status.
The term “personal identification number issued by a government entity” means a taxpayer identification number, Social Security number, driver’s license or permit number, state identification card number issued by the department of licensing, or any other number or code issued by a government entity for the purpose of personal identification that is protected and is not available to the public under any circumstances.
The term “record” includes any material, regardless of the physical form, on which information is recorded or preserved by any means, including in written or spoken words, graphically depicted, printed, or electromagnetically transmitted.
Data Disposal
An entity must take all reasonable steps to destroy, or arrange for the destruction of, personal financial and health information and personal identification numbers issued by government entities in an individual’s records within its custody or control when the entity is disposing of records that it will no longer retain. This requirement does not apply to the disposal of records by a transfer of the records, not otherwise prohibited by law, to another entity, including a transfer to archive or otherwise preserve public records as required by law.
Other Information
An entity is not liable under these requirements for records it has relinquished to the custody and control of the individual to whom the records pertain.