United States of America (Washington)
Existence or non-existence of a system forthe protection of personal information

Although no comprehensive legislation currently exists, comprehensive privacy legislation has been discussed
four times in the past and should be kept in mind.
Representative laws applicable to individual fields include the following laws.
■Washington Revised Code §§ 19.255.010 and 42.56.590 (Hereinafter referred to as "Data Breach NotificationAct").
- URL：https://app.leg.wa.gov/RCW/default.aspx?cite=19.255.010
https://apps.leg.wa.gov/rcw/default.aspx?cite=42.56.590- Enforcement status: Enacted on March 1, 2020
- Target institutions: State or local agencies that own or license data containing personal information, andindividuals or businesses operating in Washington State- Information covered:"Personal Information (PI)"The following are considered personal information (PI) if they meet any of the criteria below. However,information lawfully made available to the general public from federal, state, or local government records is notincluded.
A. The combination of an individual's name or initials with their surname, along with one or more of thefollowing data elements:(1) Social Security number or the last four digits of the Social Security number; (2) driver's license number or
Washington ID card number, (3) account number, credit card number, debit card number, or any required
security code, access code, password, or other number or information that allows access to an individual'sfinancial account, (4) the complete date of birth, (5) the individual's unique private key, which is used toauthenticate or sign electronic records; (6) student ID, military ID, passport ID number, (7) health insurance
policy number or health insurance subscriber identification number, (8) any information relating to a
consumer's medical history, mental or physical condition, or medical diagnosis or treatment by a healthcare
professional, (9) biometric data generated by automated measurement of an individual's biologicalcharacteristics, such as fingerprints, voiceprints, eye retina, iris, or other unique biological patterns orcharacteristics used to identify a particular individual data.
B. Username or e-mail address combined with a password or security question and answer that allows
access to the online accountC. The following cases, where the consumer's name or initials with their surname are not included, but any
combination of the above data elements or those listed in (A):When the data elements or combinations thereof are not rendered unusable through encryption, redaction, orother means.
When the data elements or combination of data elements would allow identity theft to be committed against
the consumer■Washington Revised Code §§ 19.375.020 and 40.26.020 (Hereinafter referred to as "Biometrics Act")- URL：https://app.leg.wa.gov/RCW/default.aspx?cite=19.375.020
https://app.leg.wa.gov/RCW/default.aspx?cite=40.26.020- Enforcement status: effective July 23, 2017
- Target institutions: Any entity that owns, licenses, maintains, stores, supervises, collects, processes, orobtains personal information about Washington State citizens (including entities outside of Washington State)- Information covered: Biometric identifiers (such as fingerprints, voiceprints, retinal scans, iris scans, andother unique biological patterns or characteristics) are data generated by automatic measurements of anindividual's biological features and used to identify specific individuals. This does not include photographs, video
recordings, audio recordings, or data derived from them, nor does it include information collected, used, orstored under the Federal law 'Health Insurance Portability and Accountability Act.
■Uniform Health Care Information Act, Washington Revised Code Chapter 70.02- URL：https://app.leg.wa.gov/rcw/default.aspx?cite=70.02- Enforcement status: Enacted July 28, 1991; amended July 1, 2014
- Target institutions: Health care providers that collect, maintain, use, or possess health care information
about Washington State residents- Information covered: Medical Information" (any care, service, or procedure provided by a health careprovider to diagnose, treat, or maintain a patient's physical or mental condition, or to affect the structure orfunction of the human body)

Information that could serve as an indicator EU Sufficiency Certification*1: None
about the system for the protection of
APEC's CBPR System*2: July 25, 2012 Participation
personal information

The obligations of businesses and otheretities or rights of the individual comply
with the eight principles of the OECDprivacy guidelines*3

In the case of economies participating in the APEC CBPR system, for the private sector, it is not necessary toprovide information on this item, since a certain degree of predictability for the individual regarding the risks
associated with the provision of personal data to third parties located abroad is considered to be guaranteed toa certain degree. Therefore, it is not necessarily required to provide information regarding this matter.
However, since the above regulations are state laws, information related to this item is provided. Regarding theobligations of businesses or entities to comply with the OECD Privacy Guidelines' 8 Principles or the rights ofindividuals, they are as follows:(1) Principle of collection restriction

Partially stipulated in the Biometrics Authentication
Law.

(2) Principle of data content

The relevant provision is inapplicable.

(3) Principle of clarification ofpurpose

Partially stipulated in the Biometrics Authentication
Law.

(4) Principle of Restrictions on Use(5) Principles of Safety andProtection

Other systems that may have a significant
impact on the rights and interests of theindividual

It is partially provided for in the Data Breach
Notification Law and the Biometric Authentication
Law.
This is provided for in the Data Breach Notification
Law, the Biometric Authentication Law, and theUnified Medical Information Law.

(6) Principle of Publicity

The relevant provision is inapplicable.

(7) Principle of IndividualParticipation

It is partially provided for in the Uniform Health
Information Law.

(8) Principle of Accountability

This is provided for in the Data Breach Notification
Law, the Biometric Authentication Law, and theUnified Medical Information Law.

■Systems related to the obligation to preserve personal information intrastate, which may have a significant
impact on the rights and interests of the individual.
■A system that imposes an obligation on businesses to cooperate with government information collection
activities, which may have a significant impact on the rights and interests of the individual.

1. The countries or regions that have obtained the EU Sufficiency Certification are those countries or regions that have been determined by the European
Commission to have an adequate level of data protection based on the GDPR or its predecessor, the Data Protection Directive, which is a system for theprotection of personal information in the EU (EU Member States and Iceland, Norway and Liechtenstein, which are part of the European Economic Area),
which the Commission has designated as countries or regions with systems for the protection of personal information that are deemed to have an equivalentlevel of protection to our country.
In this sense, the fact that a country or region has obtained EU adequacy certification constitutes "information that may serve as an indicator regarding thesystem for the protection of personal information".

2. As a prerequisite for participation in the APEC CBPR system, it is stipulated that, like our country, has legislation that conforms to the APEC Privacy
Framework and has enforcement authorities to investigate and rectify complaints or issues that cannot be resolved by CBPR-certified businesses or
accountability agents. Therefore, economies participating in the APEC CBPR system, like our coutry, have laws that conform to the APEC Privacy Frameworkand enforcement authorities to enforce such laws, thus generally expecting protection of personal information similar to that in our country.
In this sense, the fact that an economy participates in APEC's CBPR system constitutes "information that can be used as an indicator of a system for theprotection of personal information". The APEC CBPR system covers the private sector.

3. The eight principles of the OECD Privacy Guidelines serve as fundamental principles referenced by OECD member countries as well as internationally intheir efforts to protect personal information. They are used as global standard effectively when countries develop their personal information protectionsystems.

(Updated October 28, 2022)