RCW 42.56.590
Personal information
—
Notice of security breaches.
(1) Any agency that owns or licenses data that includes personal information shall disclose any breach of the security of the system to any resident of this state whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the personal information was not secured. Notice is not required if the breach of the security of the system is not reasonably likely to subject consumers to a risk of harm. The breach of secured personal information must be disclosed if the information acquired and accessed is not secured during a security breach or if the confidential process, encryption key, or other means to decipher the secured information was acquired by an unauthorized person.
(2) Any agency that maintains or possesses data that may include personal information that the agency does not own or license shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(3) The notification required by this section may be delayed if the data owner or licensee contacts a law enforcement agency after discovery of a breach of the security of the system and a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(4) For purposes of this section and except under subsection (5) of this section and RCW 42.56.592, notice may be provided by one of the following methods:
(a) Written notice;
(b) Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. Sec. 7001; or
(c) Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars, or that the affected class of subject persons to be notified exceeds five hundred thousand, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(i) Email notice when the agency has an email address for the subject persons;
(ii) Conspicuous posting of the notice on the agency's website page, if the agency maintains one; and
(iii) Notification to major statewide media.
(5) An agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this section is in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(6) Any agency that is required to issue notification pursuant to this section shall meet all of the following requirements:
(a) The notification must be written in plain language; and
(b) The notification must include, at a minimum, the following information:
(i) The name and contact information of the reporting agency subject to this section;
(ii) A list of the types of personal information that were or are reasonably believed to have been the subject of a breach;
(iii) A time frame of exposure, if known, including the date of the breach and the date of the discovery of the breach; and
(iv) The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed personal information.
(7) Any agency that is required to issue a notification pursuant to this section to more than five hundred Washington residents as a result of a single breach shall notify the attorney general of the breach no more than thirty days after the breach was discovered.
(a) The notice to the attorney general must include the following information:
(i) The number of Washington residents affected by the breach, or an estimate if the exact number is not known;
(ii) A list of the types of personal information that were or are reasonably believed to have been the subject of a breach;
(iii) A time frame of exposure, if known, including the date of the breach and the date of the discovery of the breach;
(iv) A summary of steps taken to contain the breach; and
(v) A single sample copy of the security breach notification, excluding any personally identifiable information.
(b) The notice to the attorney general must be updated if any of the information identified in (a) of this subsection is unknown at the time notice is due.
(8) Notification to affected individuals must be made in the most expedient time possible, without unreasonable delay, and no more than thirty calendar days after the breach was discovered, unless the delay is at the request of law enforcement as provided in subsection (3) of this section, or the delay is due to any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. An agency may delay notification to the consumer for up to an additional fourteen days to allow for notification to be translated into the primary language of the affected consumers.
(9) For purposes of this section, "breach of the security of the system" means unauthorized acquisition of data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system when the personal information is not used or subject to further unauthorized disclosure.
(10)(a) For purposes of this section, "personal information" means:
(i) An individual's first name or first initial and last name in combination with any one or more of the following data elements:
(A) Social security number or the last four digits of the social security number;
(B) Driver's license number or Washington identification card number;
(C) Account number, credit or debit card number, or any required security code, access code, or password that would permit access to an individual's financial account, or any other numbers or information that can be used to access a person's financial account;
(D) Full date of birth;
(E) Private key that is unique to an individual and that is used to authenticate or sign an electronic record;
(F) Student, military, or passport identification number;
(G) Health insurance policy number or health insurance identification number;
(H) Any information about a consumer's medical history or mental or physical condition or about a health care professional's medical diagnosis or treatment of the consumer; or
(I) Biometric data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that is used to identify a specific individual;
(ii) User name or email address in combination with a password or security questions and answers that would permit access to an online account; and
(iii) Any of the data elements or any combination of the data elements described in (a)(i) of this subsection without the consumer's first name or first initial and last name if:
(A) Encryption, redaction, or other methods have not rendered the data element or combination of data elements unusable; and
(B) The data element or combination of data elements would enable a person to commit identity theft against a consumer.
(b) Personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(11) For purposes of this section, "secured" means encrypted in a manner that meets or exceeds the national institute of standards and technology standard or is otherwise modified so that the personal information is rendered unreadable, unusable, or undecipherable by an unauthorized person.
[
2020 c 65 s 1
;
2019 c 241 s 5
;
2015 c 64 s 3
;
2007 c 197 s 9
;
2005 c 368 s 1
. Formerly RCW 42.17.31922
.]
NOTES:
Effective date
—
2019 c 241:
See note following RCW 19.255.010
.
Intent
—
2015 c 64:
See note following RCW 19.255.010
.
Similar provision: RCW 19.255.010
.
RCW 42.56.592
Personal information
—
Covered entities.
A covered entity under the federal health insurance portability and accountability act of 1996, Title 42 U.S.C. Sec. 1320d et seq., is deemed to have complied with the requirements of this chapter with respect to protected health information if it has complied with section 13402 of the federal health information technology for economic and clinical health act, P.L. 111-5 as it existed on July 24, 2015. Covered entities shall notify the attorney general pursuant to RCW 42.56.590
(7) in compliance with the timeliness of notification requirements of section 13402 of the federal health information technology for economic and clinical health act, P.L. 111-5 as it existed on July 24, 2015, notwithstanding the timeline in RCW 42.56.590
(7).
[
2019 c 241 s 6
.]
NOTES:
Effective date
—
2019 c 241:
See note following RCW 19.255.010
.
RCW 42.56.594
Personal information
—
Consumer protection.
(1) Any waiver of the provisions of RCW 42.56.590
or
42.56.592
is contrary to public policy, and is void and unenforceable.
(2)(a) Any consumer injured by a violation of RCW 42.56.590
may institute a civil action to recover damages.
(b) Any agency that violates, proposes to violate, or has violated RCW 42.56.590
may be enjoined.
(c) The rights and remedies available under RCW 42.56.590
are cumulative to each other and to any other rights and remedies available under law.
[
2019 c 241 s 7
.]
NOTES:
Effective date
—
2019 c 241:
See note following RCW 19.255.010
.
RCW 42.56.600
Mediation communications.
Records of mediation communications that are privileged under chapter
7.07
RCW are exempt from disclosure under this chapter.
[
2006 c 209 s 15
.]
RCW 42.56.610
Certain information from dairies and feedlots limited
—
Rules.
The following information in plans, records, and reports obtained by state and local agencies from dairies, animal feeding operations, and concentrated animal feeding operations, not required to apply for a national pollutant discharge elimination system permit is disclosable only in ranges that provide meaningful information to the public while ensuring confidentiality of business information regarding: (1) Number of animals; (2) volume of livestock nutrients generated; (3) number of acres covered by the plan or used for land application of livestock nutrients; (4) livestock nutrients transferred to other persons; and (5) crop yields. The department of agriculture shall adopt rules to implement this section in consultation with affected state and local agencies.
[
2005 c 510 s 5
. Formerly RCW 42.17.31923
.]
RCW 42.56.615
Enumeration data used by the office of financial management for population estimates.
Actual enumeration data collected under RCW 35.13.260, 35A.14.700, 36.13.030, and chapter
43.62
RCW shall be used and retained only by the office of financial management and only for the purposes of RCW 35.13.260, 35A.14.700, 36.13.030, and chapter
43.62
RCW. The enumeration data collected is confidential, is exempt from public inspection and copying under this chapter, and in accordance with RCW 43.41.435, must be destroyed after it is used.
[
2014 c 14 s 1
.]
RCW 42.56.620
Cannabis research licensee reports.
Reports submitted by cannabis research licensees in accordance with rules adopted by the state liquor and cannabis board under RCW 69.50.372
that contain proprietary information are exempt from disclosure under this chapter.
[
2022 c 16 s 29
;
2015 2nd sp.s. c 4 s 1504
;
2015 c 71 s 4
.]
NOTES:
Intent
—
Finding
—
2022 c 16:
See note following RCW 69.50.101
.
Findings
—
Intent
—
Effective dates
—
2015 2nd sp.s. c 4:
See notes following RCW 69.50.334
.
RCW 42.56.625
Medical cannabis authorization database.
Records in the medical cannabis authorization database established in RCW 69.51A.230
containing names and other personally identifiable information of qualifying patients and designated providers are exempt from disclosure under this chapter.
[
2022 c 16 s 30
;
2015 c 70 s 22
.]
NOTES:
Intent
—
Finding
—
2022 c 16:
See note following RCW 69.50.101
.
Effective date
—
2015 c 70 ss 21, 22, 32, and 33:
See note following RCW 69.51A.230
.
Short title
—
Findings
—
Intent
—
References to Washington state liquor control board
—
Draft legislation
—
2015 c 70:
See notes following RCW 66.08.012
.
RCW 42.56.630
Registration information of members of cooperatives to produce and process medical cannabis.
(1) Registration information submitted to the state liquor and cannabis board under RCW 69.51A.250
including the names of all participating members of a cooperative, copies of each member's recognition card, location of the cooperative, and other information required for registration by the state liquor and cannabis board is exempt from disclosure under this chapter.
(2) The definitions in this section apply throughout this section unless the context clearly requires otherwise.
(a) "Cooperative" means a cooperative established under RCW 69.51A.250
to produce and process cannabis only for the medical use of members of the cooperative.
(b) "Recognition card" has the same meaning as provided in RCW 69.51A.010
.
[
2022 c 16 s 31
;
2015 2nd sp.s. c 4 s 1002
.]
NOTES:
Intent
—
Finding
—
2022 c 16:
See note following RCW 69.50.101
.
Findings
—
Intent
—
Effective dates
—
2015 2nd sp.s. c 4:
See notes following RCW 69.50.334
.
RCW 42.56.640
Vulnerable individuals, in-home caregivers for vulnerable populations.
(1) Sensitive personal information of vulnerable individuals and sensitive personal information of in-home caregivers for vulnerable populations is exempt from inspection and copying under this chapter.
(2) The following definitions apply to this section:
(a) "In-home caregivers for vulnerable populations" means: (i) Individual providers as defined in RCW 74.39A.240, (ii) home care aides as defined in RCW 18.88B.010, and (iii) family child care providers as defined in RCW 41.56.030
.
(b) "Sensitive personal information" means names, addresses, GPS [global positioning system] coordinates, telephone numbers, email addresses, social security numbers, driver's license numbers, or other personally identifying information.
(c) "Vulnerable individual" has the meaning set forth in RCW 9.35.005
.
[
2017 c 4 s 8
(Initiative Measure No. 1501, approved November 8, 2016).]
NOTES:
Intent
—
2017 c 4 ss 8, 10, and 11 (Initiative Measure No. 1501):
"It is the intent of part three of this act to protect seniors and vulnerable individuals from identity theft and other financial crimes by preventing the release of public records that could be used to victimize them. Sensitive personal information about in-home caregivers for vulnerable populations is protected because its release could facilitate identity crimes against seniors, vulnerable individuals, and other vulnerable populations that these caregivers serve." [
2017 c 4 s 7
(Initiative Measure No. 1501, approved November 8, 2016).]
Short title
—
Intent
—
Construction
—
2017 c 4 (Initiative Measure No. 1501):
See notes following RCW 9.35.005
.
RCW 42.56.645
Release of public information
—
2017 c 4 (Initiative Measure No. 1501).
[(1)] Nothing in chapter 4, Laws of 2017 shall prevent the release of public information in the following circumstances:
(a) The information is released to a governmental body, including the state's area agencies on aging, and the recipient agrees to protect the confidentiality of the information;
(b) The information concerns individuals who have been accused of or disciplined for abuse, neglect, exploitation, abandonment, or other acts involving the victimization of individuals or other professional misconduct;
(c) The information is being released as part of a judicial or quasi-judicial proceeding and subject to a court's order protecting the confidentiality of the information and allowing it to be used solely in that proceeding;
(d) The information is being provided to a representative certified or recognized under *RCW 41.56.240, or as necessary for the provision of fringe benefits to public employees, and the recipient agrees to protect the confidentiality of the information;
(e) The disclosure is required by federal law;
(f) The disclosure is required by a contract between the state and a third party, and the recipient agrees to protect the confidentiality of the information;
(g) The information is released to a person or entity under contract with the state to manage, administer, or provide services to vulnerable residents, or under contract with the state to engage in research or analysis about state services for vulnerable residents, and the recipient agrees to protect the confidentiality of the information; or
(h) Information about specific public employee(s) is released to a bona fide news organization that requests such information to conduct an investigation into, or report upon, the actions of such specific public employee(s).
(2) Nothing in chapter 4, Laws of 2017 shall prevent an agency from providing contact information for the purposes of RCW **
74.39A.056
(3) and
74.39A.250
. Nothing in chapter 4, Laws of 2017 shall prevent an agency from confirming the licensing or certification status of a caregiver on an individual basis to allow consumers to ensure the licensing or certification status of an individual caregiver.
[
2017 c 4 s 11
(Initiative Measure No. 1501, approved November 8, 2016).]
NOTES:
Reviser's note:
*(1) This RCW reference has been corrected to reflect the reorganization of chapter
41.56
RCW by
2025 c 290 s 2
.
**(2) RCW 74.39A.056
was amended by 2025 c 214 s 2, changing subsection (3) to subsection (4).
Intent
—
2017 c 4 ss 8, 10, and 11 (Initiative Measure No. 1501):
See note following RCW 42.56.640
.
Short title
—
Intent
—
Construction
—
2017 c 4 (Initiative Measure No. 1501):
See notes following RCW 9.35.005
.
RCW 42.56.650
Health carrier data.
(1) Any data submitted by health carriers to the health benefit exchange for purposes of establishing standardized health plans under RCW 43.71.095
are exempt from disclosure under this chapter. This subsection applies to health carrier data in the custody of the insurance commissioner for purposes of consulting with the health benefit exchange under RCW 43.71.095
(1).
(2) Any data submitted by health carriers to the health care authority for purposes of RCW 41.05.410
are exempt from disclosure under this chapter.
[
2019 c 364 s 2
.]
RCW 42.56.655
Explosives exemption report.
By December 1, 2023, the public records exemptions accountability committee, in addition to its duties in RCW 42.56.140, must prepare and submit a report to the legislature that includes recommendations on whether the exemption created in RCW 42.56.460
(2) should be continued, modified, or terminated. No recommendations or action from the committee or the legislature will result in the continuation of the exemption created in RCW 42.56.460
(2).
[
2019 c 125 s 2
.]
RCW 42.56.660
Agency employee records.
(1) Except by court order issued pursuant to subsection (3) of this section, an agency may not disclose as a response to a public records request made pursuant to this chapter records concerning an agency employee, as defined in subsection (5) of this section, if:
(a) The requestor is a person alleged in the claim of workplace sexual harassment or stalking to have harassed or stalked the agency employee who is named as the victim in the claim; and
(b) After conducting an investigation, the agency issued discipline resulting from the claim of workplace sexual harassment or stalking to the requestor described under (a) of this subsection.
(2)(a) When the requestor is someone other than a person described under subsection (1) of this section, the agency must immediately notify an agency employee upon receipt of a public records request for records concerning that agency employee if the agency conducted an investigation of the claim of workplace sexual harassment or stalking involving the agency employee and the agency issued discipline resulting from the claim.
(b) Upon notice provided in accordance with (a) of this subsection, the agency employee may bring an action in a court of competent jurisdiction to enjoin the agency from disclosing the records. The agency employee shall immediately notify the agency upon filing an action under this subsection. Except for the five-day notification required under RCW 42.56.520, the time for the employing agency to process a request for records is suspended during the pendency of an action filed under this subsection. Upon notice of an action filed under this subsection, the agency may not disclose such records unless by an order issued in accordance with subsection (3) of this section, or if the action is dismissed without the court granting an injunction.
(3)(a) A court of competent jurisdiction, following sufficient notice to the employing agency, may order the release of some or all of the records described in subsections (1) and (2) of this section after finding that, in consideration of the totality of the circumstances, disclosure would not violate the right to privacy under RCW 42.56.050
for the agency employee. An agency that is ordered in accordance with this subsection to disclose records is not liable for penalties, attorneys' fees, or costs under RCW 42.56.550
if the agency has complied with this section.
(b) For the purposes of this section, it is presumed to be highly offensive to a reasonable person under RCW 42.56.050
to disclose, directly or indirectly, records concerning an agency employee who has made a claim of workplace sexual harassment or stalking with the agency, or is named as a victim in the claim, to persons alleged in the claim to have sexually harassed or stalked the agency employee named as the victim and where the agency issued discipline resulting from the claim after conducting an investigation. The presumption set out under this subsection may be rebutted upon showing of clear, cogent, and convincing evidence that disclosure of the requested record or information to persons alleged in the claim to have sexually harassed or stalked the agency employee named as the victim in the claim is not highly offensive.
(4) Nothing in this section restricts access to records described under subsections (1) and (2) of this section where the agency employee consents in writing to disclosure.
(5) For the purposes of this section:
(a) "Agency" means a state agency, including every state office, department, division, bureau, board, commission, or other state agency.
(b) "Agency employee" means a state agency employee who has made a claim of workplace sexual harassment or stalking with the employing agency, or is named as the victim in the claim.
(c) "Records concerning an agency employee" do not include work product created by the agency employee as part of his or her official duties.
[
2019 c 373 s 2
.]
NOTES:
Findings
—
2019 c 373:
"The legislature finds that state agency employees operate in unique work environments in which there is a higher level of transparency surrounding their daily work activities. The legislature finds that we must act to protect the health and safety of state employees, but even more so when employees become the victims of sexual harassment or stalking. The legislature finds that when a state agency employee is the target of sexual harassment or stalking, there is a significant risk to the employee's physical safety and well-being. The legislature finds that workplace safety is of paramount importance and that the state has an interest in protecting against the inappropriate use of public resources to carry out actions of sexual harassment or stalking." [
2019 c 373 s 1
.]
Effective date
—
2019 c 373:
"This act takes effect July 1, 2020." [
2019 c 373 s 6
.]
RCW 42.56.665
Agency employee records
—
Civil liability.
(1) Any person who requests and obtains a record concerning an agency employee, as described in RCW 42.56.660, is subject to civil liability if he or she uses the record or information in the record to harass, stalk, threaten, or intimidate that agency employee, or provides the record or information in the record to a person, knowing that the person intends to use it to harass, stalk, threaten, or intimidate that agency employee.
(2) Any person liable under subsection (1) of this section may be sued in superior court by any aggrieved party, or in the name of the state by the attorney general or the prosecuting authority of any political subdivision. The court may order an appropriate civil remedy. The plaintiff may recover up to one thousand dollars for each record used in violation of this section, as well as costs and reasonable attorneys' fees.
(3) For the purposes of this section:
(a) "Agency" means a state agency, including every state office, department, division, bureau, board, commission, or other state agency.
(b) "Agency employee" means a state agency employee who has made a claim of workplace sexual harassment or stalking with the employing agency, or is named as the victim in the claim.
(c) "Record concerning an agency employee" does not include work product created by the agency employee as part of his or her official duties.
[
2019 c 373 s 3
.]
NOTES:
Effective date
—
Findings
—
2019 c 373:
See notes following RCW 42.56.660
.
RCW 42.56.670
Agency employee records
—
Model policies.
By January 1, 2020, the attorney general, in consultation with state agencies, shall create model policies for the implementation of chapter 373, Laws of 2019.
[
2019 c 373 s 4
.]
NOTES:
Effective date
—
Findings
—
2019 c 373:
See notes following RCW 42.56.660
.
RCW 42.56.675
Agency employee records
—
Lists of names.
A state agency may not disclose lists of the names of agency employees, as defined under RCW 42.56.660, maintained by the agency in order to administer RCW 42.56.660
.
[
2019 c 373 s 5
.]
NOTES:
Effective date
—
Findings
—
2019 c 373:
See notes following RCW 42.56.660
.
RCW 42.56.680
Residential real property information and borrower personal information.
Information obtained by the department of commerce under RCW 61.24.190
that reveals the name or other personal information of the borrower or the street address of the residential real property on which a notice of default was issued is exempt from disclosure under this chapter.
[
2021 c 151 s 12
.]
NOTES:
Effective date
—
2021 c 151 ss 5, 9, 11, and 12:
See note following RCW 61.24.135
.
Findings
—
Intent
—
2021 c 151:
See note following RCW 61.24.005
.
RCW 42.56.690
Victim and witness notification program.
Information and records related to notification or registration for notification as described in RCW 36.28A.455
are exempt from disclosure under this chapter.
[
2022 c 82 s 3
.]
NOTES:
Effective date
—
2022 c 82:
See note following RCW 72.09.712
.
RCW 42.56.692
Victim and witness notification program
—
Notification enrollment.
Information and records prepared, owned, used, or retained by the department of corrections that reveal any notification or request for notification regarding any specific individual, or that reveal the identity, location of, or any information submitted by a person who requests or is invited to enroll for notification under RCW 72.09.712
(2) or
72.09.710
(1), are exempt from public inspection and copying under this chapter.
[
2023 c 391 s 2
.]
RCW 42.56.695
Intelligent speed assistance devices.
(Effective January 1, 2029.)
Any data collected by an intelligent speed assistance device as defined in RCW 46.04.218
is exempt from disclosure under this chapter.
[
2025 c 228 s 7
.]
NOTES:
Intent
—
Finding
—
Short title
—
Effective date
—
2025 c 228:
See notes following RCW 46.20.760
.
RCW 42.56.700
Driver training education course voucher program.
Any recipient income data collected by the department of licensing as part of the driver training education course voucher program established under RCW 46.82.480
is exempt from disclosure under this chapter.
[
2025 c 299 s 12
.]
NOTES:
Findings
—
Intent
—
2025 c 299:
See note following RCW 46.20.1191
.
RCW 42.56.900
Purpose
—
2005 c 274 ss 402-429.
The purpose of sections 402 through 429 of this act is to reorganize the public inspection and copying exemptions in *RCW 42.17.310
through
42.17.31921
by creating smaller, discrete code sections organized by subject matter. The legislature does not intend that this act effectuate any substantive change to any public inspection and copying exemption in the Revised Code of Washington.
[
2005 c 274 s 401
.]
NOTES:
*Reviser's note:
The substance of RCW 42.17.310
through
42.17.31921
was recodified in chapter
42.56
RCW. See the Comparative Table in the Table of Disposition of Former RCW Sections.
RCW 42.56.904
Intent
—
2007 c 391.
It is the intent of the legislature to clarify that no reasonable construction of chapter
42.56
RCW has ever allowed attorney invoices to be withheld in their entirety by any public entity in a request for documents under that chapter. It is further the intent of the legislature that specific descriptions of work performed be redacted only if they would reveal an attorney's mental impressions, actual legal advice, theories, or opinions, or are otherwise exempt under chapter 391, Laws of 2007 or other laws, with the burden upon the public entity to justify each redaction and narrowly construe any exception to full disclosure. The legislature intends to clarify that the public's interest in open, accountable government includes an accounting of any expenditure of public resources, including through liability insurance, upon private legal counsel or private consultants.
[
2007 c 391 s 1
.]