Documents and indexes to be made public—Statement of costs.
(1) Each agency, in accordance with published rules, shall make available for public inspection and copying all public records, unless the record falls within the specific exemptions of subsection (8) of this section, this chapter, or other statute which exempts or prohibits disclosure of specific information or records. To the extent required to prevent an unreasonable invasion of personal privacy interests protected by this chapter, an agency shall delete identifying details in a manner consistent with this chapter when it makes available or publishes any public record; however, in each case, the justification for the deletion shall be explained fully in writing.
(2) For informational purposes, each agency shall publish and maintain a current list containing every law, other than those listed in this chapter, that the agency believes exempts or prohibits disclosure of specific information or records of the agency. An agency's failure to list an exemption shall not affect the efficacy of any exemption.
(3) Each local agency shall maintain and make available for public inspection and copying a current index providing identifying information as to the following records issued, adopted, or promulgated after January 1, 1973:
(a) Final opinions, including concurring and dissenting opinions, as well as orders, made in the adjudication of cases;
(b) Those statements of policy and interpretations of policy, statute, and the Constitution which have been adopted by the agency;
(c) Administrative staff manuals and instructions to staff that affect a member of the public;
(d) Planning policies and goals, and interim and final planning decisions;
(e) Factual staff reports and studies, factual consultant's reports and studies, scientific reports and studies, and any other factual information derived from tests, studies, reports, or surveys, whether conducted by public employees or others; and
(f) Correspondence, and materials referred to therein, by and with the agency relating to any regulatory, supervisory, or enforcement responsibilities of the agency, whereby the agency determines, or opines upon, or is asked to determine or opine upon, the rights of the state, the public, a subdivision of state government, or of any private party.
(4) A local agency need not maintain such an index, if to do so would be unduly burdensome, but it shall in that event:
(a) Issue and publish a formal order specifying the reasons why and the extent to which compliance would unduly burden or interfere with agency operations; and
(b) Make available for public inspection and copying all indexes maintained for agency use.
(5) Each state agency shall, by rule, establish and implement a system of indexing for the identification and location of the following records:
(a) All records issued before July 1, 1990, for which the agency has maintained an index;
(b) Final orders entered after June 30, 1990, that are issued in adjudicative proceedings as defined in RCW
34.05.010 and that contain an analysis or decision of substantial importance to the agency in carrying out its duties;
(c) Declaratory orders entered after June 30, 1990, that are issued pursuant to RCW
34.05.240 and that contain an analysis or decision of substantial importance to the agency in carrying out its duties;
(d) Interpretive statements as defined in RCW
34.05.010 that were entered after June 30, 1990; and
(e) Policy statements as defined in RCW
34.05.010 that were entered after June 30, 1990.
Rules establishing systems of indexing shall include, but not be limited to, requirements for the form and content of the index, its location and availability to the public, and the schedule for revising or updating the index. State agencies that have maintained indexes for records issued before July 1, 1990, shall continue to make such indexes available for public inspection and copying. Information in such indexes may be incorporated into indexes prepared pursuant to this subsection. State agencies may satisfy the requirements of this subsection by making available to the public indexes prepared by other parties but actually used by the agency in its operations. State agencies shall make indexes available for public inspection and copying. State agencies may charge a fee to cover the actual costs of providing individual mailed copies of indexes.
(6) A public record may be relied on, used, or cited as precedent by an agency against a party other than an agency and it may be invoked by the agency for any other purpose only if:
(a) It has been indexed in an index available to the public; or
(b) Parties affected have timely notice (actual or constructive) of the terms thereof.
(7) Each agency may establish, maintain, and make available for public inspection and copying a statement of the actual costs that it charges for providing photocopies or electronically produced copies, of public records and a statement of the factors and manner used to determine the actual costs. Any statement of costs may be adopted by an agency only after providing notice and public hearing.
(a)(i) In determining the actual cost for providing copies of public records, an agency may include all costs directly incident to copying such public records including:
(A) The actual cost of the paper and the per page cost for use of agency copying equipment; and
(B) The actual cost of the electronic production or file transfer of the record and the use of any cloud-based data storage and processing service.
(ii) In determining other actual costs for providing copies of public records, an agency may include all costs directly incident to:
(A) Shipping such public records, including the cost of postage or delivery charges and the cost of any container or envelope used; and
(B) Transmitting such records in an electronic format, including the cost of any transmission charge and use of any physical media device provided by the agency.
(b) In determining the actual costs for providing copies of public records, an agency may not include staff salaries, benefits, or other general administrative or overhead charges, unless those costs are directly related to the actual cost of copying the public records. Staff time to copy and send the requested public records may be included in an agency's costs.
(8) This chapter shall not be construed as giving authority to any agency, the office of the secretary of the senate, or the office of the chief clerk of the house of representatives to give, sell or provide access to lists of individuals requested for commercial purposes, and agencies, the office of the secretary of the senate, and the office of the chief clerk of the house of representatives shall not do so unless specifically authorized or directed by law: PROVIDED, HOWEVER, That lists of applicants for professional licenses and of professional licensees shall be made available to those professional associations or educational organizations recognized by their professional licensing or examination board, upon payment of a reasonable charge therefor: PROVIDED FURTHER, That such recognition may be refused only for a good cause pursuant to a hearing under the provisions of chapter
34.05 RCW, the administrative procedure act.
NOTES:
Part headings—Severability—1997 c 409: See notes following RCW
43.22.051.
Effective date—1989 c 175: See note following RCW
34.05.010.
Intent—Severability—1987 c 403: See notes following RCW
42.56.050.
Exemption for registered trade names: RCW
19.80.065.
Paid family and medical leave information: RCW
50A.05.020(4).
Investigative, law enforcement, and crime victims. (Effective until January 1, 2025.)
The following investigative, law enforcement, and crime victim information is exempt from public inspection and copying under this chapter:
(1) Specific intelligence information and specific investigative records compiled by investigative, law enforcement, and penology agencies, and state agencies vested with the responsibility to discipline members of any profession, the nondisclosure of which is essential to effective law enforcement or for the protection of any person's right to privacy;
(2) Information revealing the identity of persons who are witnesses to or victims of crime or who file complaints with investigative, law enforcement, or penology agencies, other than the commission, if disclosure would endanger any person's life, physical safety, or property. If at the time a complaint is filed the complainant, victim, or witness indicates a desire for disclosure or nondisclosure, such desire shall govern. However, all complaints filed with the commission about any elected official or candidate for public office must be made in writing and signed by the complainant under oath;
(3) Any records of investigative reports prepared by any state, county, municipal, or other law enforcement agency pertaining to sex offenses contained in chapter
9A.44 RCW or sexually violent offenses as defined in RCW
71.09.020, which have been transferred to the Washington association of sheriffs and police chiefs for permanent electronic retention and retrieval pursuant to RCW
40.14.070(2)(b);
(4) License applications under RCW
9.41.070, except that copies of license applications or information on the applications may be released to law enforcement or corrections agencies or to persons and entities as authorized under RCW
9.41.815;
(5) Information revealing the specific details that describe an alleged or proven child victim of sexual assault under age eighteen, or the identity or contact information of an alleged or proven child victim of sexual assault who is under age eighteen. Identifying information includes the child victim's name, addresses, location, photograph, and in cases in which the child victim is a relative, stepchild, or stepsibling of the alleged perpetrator, identification of the relationship between the child and the alleged perpetrator. Contact information includes phone numbers, email addresses, social media profiles, and user names and passwords;
(6) Information contained in a local or regionally maintained gang database as well as the statewide gang database referenced in RCW
43.43.762;
(7) Data from the electronic sales tracking system established in RCW
69.43.165;
(8) Information submitted to the statewide unified sex offender notification and registration program under RCW
36.28A.040(6) by a person for the purpose of receiving notification regarding a registered sex offender, including the person's name, residential address, and email address;
(9) Personally identifying information collected by law enforcement agencies pursuant to local security alarm system programs and vacation crime watch programs. Nothing in this subsection shall be interpreted so as to prohibit the legal owner of a residence or business from accessing information regarding his or her residence or business;
(10) The felony firearm offense conviction database of felony firearm offenders established in RCW
43.43.822;
(11) The identity of a state employee or officer who has in good faith filed a complaint with an ethics board, as provided in RCW
42.52.410, or who has in good faith reported improper governmental action, as defined in RCW
42.40.020, to the auditor or other public official, as defined in RCW
42.40.020;
(12) The following security threat group information collected and maintained by the department of corrections pursuant to RCW
72.09.745: (a) Information that could lead to the identification of a person's security threat group status, affiliation, or activities; (b) information that reveals specific security threats associated with the operation and activities of security threat groups; and (c) information that identifies the number of security threat group members, affiliates, or associates;
(13) The global positioning system data that would indicate the location of the residence of an employee or worker of a criminal justice agency as defined in RCW
10.97.030;
(14) Body worn camera recordings to the extent nondisclosure is essential for the protection of any person's right to privacy as described in RCW
42.56.050, including, but not limited to, the circumstances enumerated in (a) of this subsection. A law enforcement or corrections agency shall not disclose a body worn camera recording to the extent the recording is exempt under this subsection.
(a) Disclosure of a body worn camera recording is presumed to be highly offensive to a reasonable person under RCW
42.56.050 to the extent it depicts:
(i)(A) Any areas of a medical facility, counseling, or therapeutic program office where:
(I) A patient is registered to receive treatment, receiving treatment, waiting for treatment, or being transported in the course of treatment; or
(II) Health care information is shared with patients, their families, or among the care team; or
(B) Information that meets the definition of protected health information for purposes of the health insurance portability and accountability act of 1996 or health care information for purposes of chapter
70.02 RCW;
(ii) The interior of a place of residence where a person has a reasonable expectation of privacy;
(iii) An intimate image;
(iv) A minor;
(v) The body of a deceased person;
(vi) The identity of or communications from a victim or witness of an incident involving domestic violence as defined in RCW
10.99.020 or sexual assault as defined in RCW
70.125.030, or disclosure of intimate images as defined in RCW
9A.86.010. If at the time of recording the victim or witness indicates a desire for disclosure or nondisclosure of the recorded identity or communications, such desire shall govern; or
(vii) The identifiable location information of a community-based domestic violence program as defined in RCW
70.123.020, or emergency shelter as defined in RCW
70.123.020.
(b) The presumptions set out in (a) of this subsection may be rebutted by specific evidence in individual cases.
(c) In a court action seeking the right to inspect or copy a body worn camera recording, a person who prevails against a law enforcement or corrections agency that withholds or discloses all or part of a body worn camera recording pursuant to (a) of this subsection is not entitled to fees, costs, or awards pursuant to RCW
42.56.550 unless it is shown that the law enforcement or corrections agency acted in bad faith or with gross negligence.
(d) A request for body worn camera recordings must:
(i) Specifically identify a name of a person or persons involved in the incident;
(ii) Provide the incident or case number;
(iii) Provide the date, time, and location of the incident or incidents; or
(iv) Identify a law enforcement or corrections officer involved in the incident or incidents.
(e)(i) A person directly involved in an incident recorded by the requested body worn camera recording, an attorney representing a person directly involved in an incident recorded by the requested body worn camera recording, a person or his or her attorney who requests a body worn camera recording relevant to a criminal case involving that person, or the executive director from either the Washington state commission on African American affairs, Asian Pacific American affairs, or Hispanic affairs, has the right to obtain the body worn camera recording, subject to any exemption under this chapter or any applicable law. In addition, an attorney who represents a person regarding a potential or existing civil cause of action involving the denial of civil rights under the federal or state Constitution, or a violation of a United States department of justice settlement agreement, has the right to obtain the body worn camera recording if relevant to the cause of action, subject to any exemption under this chapter or any applicable law. The attorney must explain the relevancy of the requested body worn camera recording to the cause of action and specify that he or she is seeking relief from redaction costs under this subsection (14)(e).
(ii) A law enforcement or corrections agency responding to requests under this subsection (14)(e) may not require the requesting individual to pay costs of any redacting, altering, distorting, pixelating, suppressing, or otherwise obscuring any portion of a body worn camera recording.
(iii) A law enforcement or corrections agency may require any person requesting a body worn camera recording pursuant to this subsection (14)(e) to identify himself or herself to ensure he or she is a person entitled to obtain the body worn camera recording under this subsection (14)(e).
(f)(i) A law enforcement or corrections agency responding to a request to disclose body worn camera recordings may require any requester not listed in (e) of this subsection to pay the reasonable costs of redacting, altering, distorting, pixelating, suppressing, or otherwise obscuring any portion of the body worn camera recording prior to disclosure only to the extent necessary to comply with the exemptions in this chapter or any applicable law.
(ii) An agency that charges redaction costs under this subsection (14)(f) must use redaction technology that provides the least costly commercially available method of redacting body worn camera recordings, to the extent possible and reasonable.
(iii) In any case where an agency charges a requestor for the costs of redacting a body worn camera recording under this subsection (14)(f), the time spent on redaction of the recording shall not count towards the agency's allocation of, or limitation on, time or costs spent responding to public records requests under this chapter, as established pursuant to local ordinance, policy, procedure, or state law.
(g) For purposes of this subsection (14):
(i) "Body worn camera recording" means a video and/or sound recording that is made by a body worn camera attached to the uniform or eyewear of a law enforcement or corrections officer while in the course of his or her official duties; and
(ii) "Intimate image" means an individual or individuals engaged in sexual activity, including sexual intercourse as defined in RCW
9A.44.010 and masturbation, or an individual's intimate body parts, whether nude or visible through less than opaque clothing, including the genitals, pubic area, anus, or postpubescent female nipple.
(h) Nothing in this subsection shall be construed to restrict access to body worn camera recordings as otherwise permitted by law for official or recognized civilian and accountability bodies or pursuant to any court order.
(i) Nothing in this section is intended to modify the obligations of prosecuting attorneys and law enforcement under Brady v. Maryland, 373 U.S. 83, 83 S. Ct. 1194, 10 L. Ed. 2d 215 (1963), Kyles v. Whitley, 541 U.S. 419, 115 S. Ct. 1555, 131 L. Ed.2d 490 (1995), and the relevant Washington court criminal rules and statutes.
(j) A law enforcement or corrections agency must retain body worn camera recordings for at least sixty days and thereafter may destroy the records in accordance with the applicable records retention schedule;
(15) Any records and information contained within the statewide sexual assault kit tracking system established in RCW
43.43.545;
(16)(a) Survivor communications with, and survivor records maintained by, campus-affiliated advocates.
(b) Nothing in this subsection shall be construed to restrict access to records maintained by a campus-affiliated advocate in the event that:
(i) The survivor consents to inspection or copying;
(ii) There is a clear, imminent risk of serious physical injury or death of the survivor or another person;
(iii) Inspection or copying is required by federal law; or
(iv) A court of competent jurisdiction mandates that the record be available for inspection or copying.
(c) "Campus-affiliated advocate" and "survivor" have the definitions in RCW
28B.112.030;
(17) Information and records prepared, owned, used, or retained by the Washington association of sheriffs and police chiefs and information and records prepared, owned, used, or retained by the Washington state patrol pursuant to chapter 261, Laws of 2017; and
(18) Any and all audio or video recordings of child forensic interviews as defined in chapter
26.44 RCW. Such recordings are confidential and may only be disclosed pursuant to a court order entered upon a showing of good cause and with advance notice to the child's parent, guardian, or legal custodian. However, if the child is an emancipated minor or has attained the age of majority as defined in RCW
26.28.010, advance notice must be to the child. Failure to disclose an audio or video recording of a child forensic interview as defined in chapter
26.44 RCW is not grounds for penalties or other sanctions available under this chapter.
NOTES:
Effective dates—2022 c 268: See note following RCW
7.105.010.
Retroactive application—2018 c 171 s 7: "Section 7 of this act applies retroactively to all outstanding public records requests submitted prior to March 22, 2018." [
2018 c 171 s 8.]
Effective date—2018 c 171: See note following RCW
26.44.188.
Finding—Intent—2017 c 72: See note following RCW
28B.112.030.
Finding—Intent—2016 c 173: See note following RCW
43.43.545.
Finding—Intent—2016 c 163: "The legislature finds that technological developments present opportunities for additional truth-finding, transparency, and accountability in interactions between law enforcement or corrections officers and the public. The legislature intends to promote transparency and accountability by permitting access to video and/or sound recordings of interactions with law enforcement or corrections officers, while preserving the public's reasonable expectation that the recordings of these interactions will not be publicly disclosed to enable voyeurism or exploitation." [
2016 c 163 s 1.]
Finding—2013 c 190: See note following RCW
42.52.410.
Severability—Part headings, subheadings not law—2008 c 276: See notes following RCW
36.28A.200.
Restrictions on dissemination of child forensic interview recordings: RCW
26.44.187 and
26.44.188.
Investigative, law enforcement, and crime victims. (Effective January 1, 2025, until July 1, 2025.)
The following investigative, law enforcement, and crime victim information is exempt from public inspection and copying under this chapter:
(1) Specific intelligence information and specific investigative records compiled by investigative, law enforcement, and penology agencies, and state agencies vested with the responsibility to discipline members of any profession, the nondisclosure of which is essential to effective law enforcement or for the protection of any person's right to privacy;
(2) Information revealing the identity of persons who are witnesses to or victims of crime or who file complaints with investigative, law enforcement, or penology agencies, other than the commission, if disclosure would endanger any person's life, physical safety, or property. If at the time a complaint is filed the complainant, victim, or witness indicates a desire for disclosure or nondisclosure, such desire shall govern. However, all complaints filed with the commission about any elected official or candidate for public office must be made in writing and signed by the complainant under oath;
(3) Any records of investigative reports prepared by any state, county, municipal, or other law enforcement agency pertaining to sex offenses contained in chapter
9A.44 RCW or sexually violent offenses as defined in RCW
71.09.020, which have been transferred to the Washington association of sheriffs and police chiefs for permanent electronic retention and retrieval pursuant to RCW
40.14.070(2)(b);
(4) License applications under RCW
9.41.070, except that copies of license applications or information on the applications may be released to law enforcement or corrections agencies or to persons and entities as authorized under RCW
9.41.815;
(5) Information revealing the specific details that describe an alleged or proven child victim of sexual assault under age eighteen, or the identity or contact information of an alleged or proven child victim of sexual assault who is under age eighteen. Identifying information includes the child victim's name, addresses, location, photograph, and in cases in which the child victim is a relative, stepchild, or stepsibling of the alleged perpetrator, identification of the relationship between the child and the alleged perpetrator. Contact information includes phone numbers, email addresses, social media profiles, and user names and passwords;
(6) Information contained in a local or regionally maintained gang database as well as the statewide gang database referenced in RCW
43.43.762;
(7) Data from the electronic sales tracking system established in RCW
69.43.165;
(8) Information submitted to the statewide unified sex offender notification and registration program under RCW
36.28A.040(6) by a person for the purpose of receiving notification regarding a registered sex offender, including the person's name, residential address, and email address;
(9) Personally identifying information collected by law enforcement agencies pursuant to local security alarm system programs and vacation crime watch programs. Nothing in this subsection shall be interpreted so as to prohibit the legal owner of a residence or business from accessing information regarding his or her residence or business;
(10) The felony firearm offense conviction database of felony firearm offenders established in RCW
43.43.822;
(11) The identity of a state employee or officer who has in good faith filed a complaint with an ethics board, as provided in RCW
42.52.410, or who has in good faith reported improper governmental action, as defined in RCW
42.40.020, to the auditor or other public official, as defined in RCW
42.40.020;
(12) The following security threat group information collected and maintained by the department of corrections pursuant to RCW
72.09.745: (a) Information that could lead to the identification of a person's security threat group status, affiliation, or activities; (b) information that reveals specific security threats associated with the operation and activities of security threat groups; and (c) information that identifies the number of security threat group members, affiliates, or associates;
(13) The global positioning system data that would indicate the location of the residence of an employee or worker of a criminal justice agency as defined in RCW
10.97.030;
(14) Body worn camera recordings to the extent nondisclosure is essential for the protection of any person's right to privacy as described in RCW
42.56.050, including, but not limited to, the circumstances enumerated in (a) of this subsection. A law enforcement or corrections agency shall not disclose a body worn camera recording to the extent the recording is exempt under this subsection.
(a) Disclosure of a body worn camera recording is presumed to be highly offensive to a reasonable person under RCW
42.56.050 to the extent it depicts:
(i)(A) Any areas of a medical facility, counseling, or therapeutic program office where:
(I) A patient is registered to receive treatment, receiving treatment, waiting for treatment, or being transported in the course of treatment; or
(II) Health care information is shared with patients, their families, or among the care team; or
(B) Information that meets the definition of protected health information for purposes of the health insurance portability and accountability act of 1996 or health care information for purposes of chapter
70.02 RCW;
(ii) The interior of a place of residence where a person has a reasonable expectation of privacy;
(iii) An intimate image;
(iv) A minor;
(v) The body of a deceased person;
(vi) The identity of or communications from a victim or witness of an incident involving domestic violence as defined in RCW
10.99.020 or sexual assault as defined in RCW
70.125.030, or disclosure of intimate images as defined in RCW
9A.86.010. If at the time of recording the victim or witness indicates a desire for disclosure or nondisclosure of the recorded identity or communications, such desire shall govern; or
(vii) The identifiable location information of a community-based domestic violence program as defined in RCW
70.123.020, or emergency shelter as defined in RCW
70.123.020.
(b) The presumptions set out in (a) of this subsection may be rebutted by specific evidence in individual cases.
(c) In a court action seeking the right to inspect or copy a body worn camera recording, a person who prevails against a law enforcement or corrections agency that withholds or discloses all or part of a body worn camera recording pursuant to (a) of this subsection is not entitled to fees, costs, or awards pursuant to RCW
42.56.550 unless it is shown that the law enforcement or corrections agency acted in bad faith or with gross negligence.
(d) A request for body worn camera recordings must:
(i) Specifically identify a name of a person or persons involved in the incident;
(ii) Provide the incident or case number;
(iii) Provide the date, time, and location of the incident or incidents; or
(iv) Identify a law enforcement or corrections officer involved in the incident or incidents.
(e)(i) A person directly involved in an incident recorded by the requested body worn camera recording, an attorney representing a person directly involved in an incident recorded by the requested body worn camera recording, a person or his or her attorney who requests a body worn camera recording relevant to a criminal case involving that person, or the executive director from either the Washington state commission on African American affairs, Asian Pacific American affairs, or Hispanic affairs, has the right to obtain the body worn camera recording, subject to any exemption under this chapter or any applicable law. In addition, an attorney who represents a person regarding a potential or existing civil cause of action involving the denial of civil rights under the federal or state Constitution, or a violation of a United States department of justice settlement agreement, has the right to obtain the body worn camera recording if relevant to the cause of action, subject to any exemption under this chapter or any applicable law. The attorney must explain the relevancy of the requested body worn camera recording to the cause of action and specify that he or she is seeking relief from redaction costs under this subsection (14)(e).
(ii) A law enforcement or corrections agency responding to requests under this subsection (14)(e) may not require the requesting individual to pay costs of any redacting, altering, distorting, pixelating, suppressing, or otherwise obscuring any portion of a body worn camera recording.
(iii) A law enforcement or corrections agency may require any person requesting a body worn camera recording pursuant to this subsection (14)(e) to identify himself or herself to ensure he or she is a person entitled to obtain the body worn camera recording under this subsection (14)(e).
(f)(i) A law enforcement or corrections agency responding to a request to disclose body worn camera recordings may require any requester not listed in (e) of this subsection to pay the reasonable costs of redacting, altering, distorting, pixelating, suppressing, or otherwise obscuring any portion of the body worn camera recording prior to disclosure only to the extent necessary to comply with the exemptions in this chapter or any applicable law.
(ii) An agency that charges redaction costs under this subsection (14)(f) must use redaction technology that provides the least costly commercially available method of redacting body worn camera recordings, to the extent possible and reasonable.
(iii) In any case where an agency charges a requestor for the costs of redacting a body worn camera recording under this subsection (14)(f), the time spent on redaction of the recording shall not count towards the agency's allocation of, or limitation on, time or costs spent responding to public records requests under this chapter, as established pursuant to local ordinance, policy, procedure, or state law.
(g) For purposes of this subsection (14):
(i) "Body worn camera recording" means a video and/or sound recording that is made by a body worn camera attached to the uniform or eyewear of a law enforcement or corrections officer while in the course of his or her official duties; and
(ii) "Intimate image" means an individual or individuals engaged in sexual activity, including sexual intercourse as defined in RCW
9A.44.010 and masturbation, or an individual's intimate body parts, whether nude or visible through less than opaque clothing, including the genitals, pubic area, anus, or postpubescent female nipple.
(h) Nothing in this subsection shall be construed to restrict access to body worn camera recordings as otherwise permitted by law for official or recognized civilian and accountability bodies or pursuant to any court order.
(i) Nothing in this section is intended to modify the obligations of prosecuting attorneys and law enforcement under Brady v. Maryland, 373 U.S. 83, 83 S. Ct. 1194, 10 L. Ed. 2d 215 (1963), Kyles v. Whitley, 541 U.S. 419, 115 S. Ct. 1555, 131 L. Ed.2d 490 (1995), and the relevant Washington court criminal rules and statutes.
(j) A law enforcement or corrections agency must retain body worn camera recordings for at least sixty days and thereafter may destroy the records in accordance with the applicable records retention schedule;
(15) Any records and information contained within the statewide sexual assault kit tracking system established in RCW
43.43.545;
(16)(a) Survivor communications with, and survivor records maintained by, campus-affiliated advocates.
(b) Nothing in this subsection shall be construed to restrict access to records maintained by a campus-affiliated advocate in the event that:
(i) The survivor consents to inspection or copying;
(ii) There is a clear, imminent risk of serious physical injury or death of the survivor or another person;
(iii) Inspection or copying is required by federal law; or
(iv) A court of competent jurisdiction mandates that the record be available for inspection or copying.
(c) "Campus-affiliated advocate" and "survivor" have the definitions in RCW
28B.112.030;
(17) Information and records prepared, owned, used, or retained by the Washington association of sheriffs and police chiefs and information and records prepared, owned, used, or retained by the Washington state patrol pursuant to chapter 261, Laws of 2017;
(18) Any and all audio or video recordings of child forensic interviews as defined in chapter
26.44 RCW. Such recordings are confidential and may only be disclosed pursuant to a court order entered upon a showing of good cause and with advance notice to the child's parent, guardian, or legal custodian. However, if the child is an emancipated minor or has attained the age of majority as defined in RCW
26.28.010, advance notice must be to the child. Failure to disclose an audio or video recording of a child forensic interview as defined in chapter
26.44 RCW is not grounds for penalties or other sanctions available under this chapter; and
(19) Information exempt from public disclosure and copying under RCW
43.10.305(2)(f).
NOTES:
Effective date—Private right of action—2024 c 299: See notes following RCW
43.10.305.
Effective dates—2022 c 268: See note following RCW
7.105.010.
Retroactive application—2018 c 171 s 7: "Section 7 of this act applies retroactively to all outstanding public records requests submitted prior to March 22, 2018." [
2018 c 171 s 8.]
Effective date—2018 c 171: See note following RCW
26.44.188.
Finding—Intent—2017 c 72: See note following RCW
28B.112.030.
Finding—Intent—2016 c 173: See note following RCW
43.43.545.
Finding—Intent—2016 c 163: "The legislature finds that technological developments present opportunities for additional truth-finding, transparency, and accountability in interactions between law enforcement or corrections officers and the public. The legislature intends to promote transparency and accountability by permitting access to video and/or sound recordings of interactions with law enforcement or corrections officers, while preserving the public's reasonable expectation that the recordings of these interactions will not be publicly disclosed to enable voyeurism or exploitation." [
2016 c 163 s 1.]
Finding—2013 c 190: See note following RCW
42.52.410.
Severability—Part headings, subheadings not law—2008 c 276: See notes following RCW
36.28A.200.
Restrictions on dissemination of child forensic interview recordings: RCW
26.44.187 and
26.44.188.
Investigative, law enforcement, and crime victims. (Effective July 1, 2025.)
The following investigative, law enforcement, and crime victim information is exempt from public inspection and copying under this chapter:
(1) Specific intelligence information and specific investigative records compiled by investigative, law enforcement, and penology agencies, and state agencies vested with the responsibility to discipline members of any profession, the nondisclosure of which is essential to effective law enforcement or for the protection of any person's right to privacy;
(2) Information revealing the identity of persons who are witnesses to or victims of crime or who file complaints with investigative, law enforcement, or penology agencies, other than the commission, if disclosure would endanger any person's life, physical safety, or property. If at the time a complaint is filed the complainant, victim, or witness indicates a desire for disclosure or nondisclosure, such desire shall govern. However, all complaints filed with the commission about any elected official or candidate for public office must be made in writing and signed by the complainant under oath;
(3) Any records of investigative reports prepared by any state, county, municipal, or other law enforcement agency pertaining to sex offenses contained in chapter
9A.44 RCW or sexually violent offenses as defined in RCW
71.09.020, which have been transferred to the Washington association of sheriffs and police chiefs for permanent electronic retention and retrieval pursuant to RCW
40.14.070(2)(b);
(4) License applications under RCW
9.41.070, except that copies of license applications or information on the applications may be released to law enforcement or corrections agencies or to persons and entities as authorized under RCW
9.41.815;
(5)(a) Information revealing the specific details that describe an alleged or proven child victim of sexual assault or commercial sexual exploitation under age 18, or the identity or contact information of an alleged or proven child victim of sexual assault or commercial sexual exploitation who is under age 18. Identifying information includes the child victim's name, addresses, location, photograph, and in cases in which the child victim is a relative, stepchild, or stepsibling of the alleged perpetrator, identification of the relationship between the child and the alleged perpetrator. Contact information includes phone numbers, email addresses, social media profiles, and user names and passwords.
(b) For purposes of this subsection (5), "commercial sexual exploitation" has the same meaning as in RCW
7.105.010;
(6) Information contained in a local or regionally maintained gang database as well as the statewide gang database referenced in RCW
43.43.762;
(7) Data from the electronic sales tracking system established in RCW
69.43.165;
(8) Information submitted to the statewide unified sex offender notification and registration program under RCW
36.28A.040(6) by a person for the purpose of receiving notification regarding a registered sex offender, including the person's name, residential address, and email address;
(9) Personally identifying information collected by law enforcement agencies pursuant to local security alarm system programs and vacation crime watch programs. Nothing in this subsection shall be interpreted so as to prohibit the legal owner of a residence or business from accessing information regarding his or her residence or business;
(10) The felony firearm offense conviction database of felony firearm offenders established in RCW
43.43.822;
(11) The identity of a state employee or officer who has in good faith filed a complaint with an ethics board, as provided in RCW
42.52.410, or who has in good faith reported improper governmental action, as defined in RCW
42.40.020, to the auditor or other public official, as defined in RCW
42.40.020;
(12) The following security threat group information collected and maintained by the department of corrections pursuant to RCW
72.09.745: (a) Information that could lead to the identification of a person's security threat group status, affiliation, or activities; (b) information that reveals specific security threats associated with the operation and activities of security threat groups; and (c) information that identifies the number of security threat group members, affiliates, or associates;
(13) The global positioning system data that would indicate the location of the residence of an employee or worker of a criminal justice agency as defined in RCW
10.97.030;
(14) Body worn camera recordings to the extent nondisclosure is essential for the protection of any person's right to privacy as described in RCW
42.56.050, including, but not limited to, the circumstances enumerated in (a) of this subsection. A law enforcement or corrections agency shall not disclose a body worn camera recording to the extent the recording is exempt under this subsection.
(a) Disclosure of a body worn camera recording is presumed to be highly offensive to a reasonable person under RCW
42.56.050 to the extent it depicts:
(i)(A) Any areas of a medical facility, counseling, or therapeutic program office where:
(I) A patient is registered to receive treatment, receiving treatment, waiting for treatment, or being transported in the course of treatment; or
(II) Health care information is shared with patients, their families, or among the care team; or
(B) Information that meets the definition of protected health information for purposes of the health insurance portability and accountability act of 1996 or health care information for purposes of chapter
70.02 RCW;
(ii) The interior of a place of residence where a person has a reasonable expectation of privacy;
(iii) An intimate image;
(iv) A minor;
(v) The body of a deceased person;
(vi) The identity of or communications from a victim or witness of an incident involving domestic violence as defined in RCW
10.99.020 or sexual assault as defined in RCW
70.125.030, or disclosure of intimate images as defined in RCW
9A.86.010. If at the time of recording the victim or witness indicates a desire for disclosure or nondisclosure of the recorded identity or communications, such desire shall govern; or
(vii) The identifiable location information of a community-based domestic violence program as defined in RCW
70.123.020, or emergency shelter as defined in RCW
70.123.020.
(b) The presumptions set out in (a) of this subsection may be rebutted by specific evidence in individual cases.
(c) In a court action seeking the right to inspect or copy a body worn camera recording, a person who prevails against a law enforcement or corrections agency that withholds or discloses all or part of a body worn camera recording pursuant to (a) of this subsection is not entitled to fees, costs, or awards pursuant to RCW
42.56.550 unless it is shown that the law enforcement or corrections agency acted in bad faith or with gross negligence.
(d) A request for body worn camera recordings must:
(i) Specifically identify a name of a person or persons involved in the incident;
(ii) Provide the incident or case number;
(iii) Provide the date, time, and location of the incident or incidents; or
(iv) Identify a law enforcement or corrections officer involved in the incident or incidents.
(e)(i) A person directly involved in an incident recorded by the requested body worn camera recording, an attorney representing a person directly involved in an incident recorded by the requested body worn camera recording, a person or his or her attorney who requests a body worn camera recording relevant to a criminal case involving that person, or the executive director from either the Washington state commission on African American affairs, Asian Pacific American affairs, or Hispanic affairs, has the right to obtain the body worn camera recording, subject to any exemption under this chapter or any applicable law. In addition, an attorney who represents a person regarding a potential or existing civil cause of action involving the denial of civil rights under the federal or state Constitution, or a violation of a United States department of justice settlement agreement, has the right to obtain the body worn camera recording if relevant to the cause of action, subject to any exemption under this chapter or any applicable law. The attorney must explain the relevancy of the requested body worn camera recording to the cause of action and specify that he or she is seeking relief from redaction costs under this subsection (14)(e).
(ii) A law enforcement or corrections agency responding to requests under this subsection (14)(e) may not require the requesting individual to pay costs of any redacting, altering, distorting, pixelating, suppressing, or otherwise obscuring any portion of a body worn camera recording.
(iii) A law enforcement or corrections agency may require any person requesting a body worn camera recording pursuant to this subsection (14)(e) to identify himself or herself to ensure he or she is a person entitled to obtain the body worn camera recording under this subsection (14)(e).
(f)(i) A law enforcement or corrections agency responding to a request to disclose body worn camera recordings may require any requester not listed in (e) of this subsection to pay the reasonable costs of redacting, altering, distorting, pixelating, suppressing, or otherwise obscuring any portion of the body worn camera recording prior to disclosure only to the extent necessary to comply with the exemptions in this chapter or any applicable law.
(ii) An agency that charges redaction costs under this subsection (14)(f) must use redaction technology that provides the least costly commercially available method of redacting body worn camera recordings, to the extent possible and reasonable.
(iii) In any case where an agency charges a requestor for the costs of redacting a body worn camera recording under this subsection (14)(f), the time spent on redaction of the recording shall not count towards the agency's allocation of, or limitation on, time or costs spent responding to public records requests under this chapter, as established pursuant to local ordinance, policy, procedure, or state law.
(g) For purposes of this subsection (14):
(i) "Body worn camera recording" means a video and/or sound recording that is made by a body worn camera attached to the uniform or eyewear of a law enforcement or corrections officer while in the course of his or her official duties; and
(ii) "Intimate image" means an individual or individuals engaged in sexual activity, including sexual intercourse as defined in RCW
9A.44.010 and masturbation, or an individual's intimate body parts, whether nude or visible through less than opaque clothing, including the genitals, pubic area, anus, or postpubescent female nipple.
(h) Nothing in this subsection shall be construed to restrict access to body worn camera recordings as otherwise permitted by law for official or recognized civilian and accountability bodies or pursuant to any court order.
(i) Nothing in this section is intended to modify the obligations of prosecuting attorneys and law enforcement under Brady v. Maryland, 373 U.S. 83, 83 S. Ct. 1194, 10 L. Ed. 2d 215 (1963), Kyles v. Whitley, 541 U.S. 419, 115 S. Ct. 1555, 131 L. Ed.2d 490 (1995), and the relevant Washington court criminal rules and statutes.
(j) A law enforcement or corrections agency must retain body worn camera recordings for at least 60 days and thereafter may destroy the records in accordance with the applicable records retention schedule;
(15) Any records and information contained within the statewide sexual assault kit tracking system established in RCW
43.43.545;
(16)(a) Survivor communications with, and survivor records maintained by, campus-affiliated advocates.
(b) Nothing in this subsection shall be construed to restrict access to records maintained by a campus-affiliated advocate in the event that:
(i) The survivor consents to inspection or copying;
(ii) There is a clear, imminent risk of serious physical injury or death of the survivor or another person;
(iii) Inspection or copying is required by federal law; or
(iv) A court of competent jurisdiction mandates that the record be available for inspection or copying.
(c) "Campus-affiliated advocate" and "survivor" have the definitions in RCW
28B.112.030;
(17) Information and records prepared, owned, used, or retained by the Washington association of sheriffs and police chiefs and information and records prepared, owned, used, or retained by the Washington state patrol pursuant to chapter 261, Laws of 2017;
(18) Any and all audio or video recordings of child forensic interviews as defined in chapter
26.44 RCW. Such recordings are confidential and may only be disclosed pursuant to a court order entered upon a showing of good cause and with advance notice to the child's parent, guardian, or legal custodian. However, if the child is an emancipated minor or has attained the age of majority as defined in RCW
26.28.010, advance notice must be to the child. Failure to disclose an audio or video recording of a child forensic interview as defined in chapter
26.44 RCW is not grounds for penalties or other sanctions available under this chapter; and
(19) Information exempt from public disclosure and copying under RCW
43.10.305(2)(f).
NOTES:
Reviser's note: This section was amended by 2024 c 298 s 21 and by 2024 c 299 s 2, each without reference to the other. Both amendments are incorporated in the publication of this section under RCW 1.12.025(2). For rule of construction, see RCW 1.12.025(1). Effective date—Private right of action—2024 c 299: See notes following RCW
43.10.305.
Effective date—2024 c 298: See note following RCW
9A.40.100.
Effective dates—2022 c 268: See note following RCW
7.105.010.
Retroactive application—2018 c 171 s 7: "Section 7 of this act applies retroactively to all outstanding public records requests submitted prior to March 22, 2018." [
2018 c 171 s 8.]
Effective date—2018 c 171: See note following RCW
26.44.188.
Finding—Intent—2017 c 72: See note following RCW
28B.112.030.
Finding—Intent—2016 c 173: See note following RCW
43.43.545.
Finding—Intent—2016 c 163: "The legislature finds that technological developments present opportunities for additional truth-finding, transparency, and accountability in interactions between law enforcement or corrections officers and the public. The legislature intends to promote transparency and accountability by permitting access to video and/or sound recordings of interactions with law enforcement or corrections officers, while preserving the public's reasonable expectation that the recordings of these interactions will not be publicly disclosed to enable voyeurism or exploitation." [
2016 c 163 s 1.]
Finding—2013 c 190: See note following RCW
42.52.410.
Severability—Part headings, subheadings not law—2008 c 276: See notes following RCW
36.28A.200.
Restrictions on dissemination of child forensic interview recordings: RCW
26.44.187 and
26.44.188.
Fish and wildlife. (Effective until June 30, 2027.)
The following information relating to fish and wildlife is exempt from disclosure under this chapter:
(1) Commercial fishing catch data from logbooks required to be provided to the department of fish and wildlife under RCW
77.12.047, when the data identifies specific catch location, timing, or methodology and the release of which would result in unfair competitive disadvantage to the commercial fisher providing the catch data, however, this information may be released to government agencies concerned with the management of fish and wildlife resources;
(2) Sensitive fish and wildlife data. Sensitive fish and wildlife data may be released to the following entities and their agents for fish, wildlife, land management purposes, or scientific research needs: Government agencies, public utilities, and accredited colleges and universities. Sensitive fish and wildlife data may be released to tribal governments. Sensitive fish and wildlife data may also be released to the owner, lessee, or right-of-way or easement holder of the private land to which the data pertains. The release of sensitive fish and wildlife data must be subject to a confidentiality agreement, except upon release of sensitive fish and wildlife data to the owner, lessee, or right-of-way or easement holder of private land who initially provided the data. Sensitive fish and wildlife data does not include data related to reports of predatory wildlife as specified in RCW
77.12.885. Sensitive fish and wildlife data must meet at least one of the following criteria of this subsection as applied by the department of fish and wildlife:
(a) The nesting sites or specific locations of endangered species designated under RCW
77.12.020, or threatened or sensitive species classified by rule of the department of fish and wildlife;
(b) Radio frequencies used in, or locational data generated by, telemetry studies; or
(c) Other location data that could compromise the viability of a specific fish or wildlife population, and where at least one of the following criteria are met:
(i) The species has a known commercial or black market value;
(ii) There is a history of malicious take of that species and the species behavior or ecology renders it especially vulnerable;
(iii) There is a known demand to visit, take, or disturb the species; or
(iv) The species has an extremely limited distribution and concentration;
(3) The following information regarding any damage prevention cooperative agreement, or nonlethal preventative measures deployed to minimize wolf interactions with pets and livestock:
(a) The name, telephone number, residential address, and other personally identifying information of any person who has a current damage prevention cooperative agreement with the department, including a pet or livestock owner, and his or her employees or immediate family members, who agrees to deploy, or is responsible for the deployment of, nonlethal, preventative measures; and
(b) The legal description or name of any residential property, ranch, or farm, that is owned, leased, or used by any person included in (a) of this subsection;
(4) The following information regarding a reported depredation by wolves on pets or livestock:
(a) The name, telephone number, residential address, and other personally identifying information of:
(i) Any person who reported the depredation;
(ii) Any pet or livestock owner, and his or her employees or immediate family members, whose pet or livestock was the subject of a reported depredation; and
(iii) Any department of fish and wildlife employee, range rider contractor, or trapper contractor who directly:
(A) Responds to a depredation; or
(B) Assists in the lethal removal of a wolf; and
(b) The legal description, location coordinates, or name that identifies any residential property, or ranch or farm that contains a residence, that is owned, leased, or used by any person included in (a) of this subsection;
(5) The personally identifying information of persons who acquire recreational licenses under RCW
77.32.010 or commercial licenses under chapter
77.65 or
77.70 RCW, except name, address of contact used by the department, and type of license, endorsement, or tag; however, the department of fish and wildlife may disclose personally identifying information to:
(a) Government agencies concerned with the management of fish and wildlife resources;
(b) The department of social and health services, child support division, and to the department of licensing in order to implement RCW
77.32.014 and
46.20.291; and
(c) Law enforcement agencies for the purpose of firearm possession enforcement under RCW
9.41.040;
(6)(a) Information that the department of fish and wildlife has received or accessed but may not disclose due to confidentiality requirements in the Magnuson-Stevens fishery conservation and management reauthorization act of 2006 (16 U.S.C. Sec. 1861(h)(3) and (i), and Sec. 1881a(b)); and
(b) Fisheries-related information that was collected by another state and is confidential under the laws of that state;
(7) The following tribal fish and shellfish harvest information, shared with the department of fish and wildlife:
(a) Fisher name;
(b) Fisher signature;
(c) Total harvest value per species;
(d) Total harvest value;
(e) Price per pound; and
(f) Tribal tax information; and
(8) The following commercial shellfish harvest information, shared with the department of fish and wildlife:
(a) Individual farmer name;
(b) Individual farmer signature;
(c) Total harvest value per species;
(d) Total harvest value;
(e) Price per pound; and
(f) Tax information.
NOTES:
Expiration date—2024 c 48 s 2: "Section 2 of this act expires June 30, 2027." [
2024 c 48 s 4.]
Findings—Intent—2024 c 48: "Fishery data and recordkeeping occurs primarily at the state level on the west coast, but many fishers participate in multiple fisheries along the coast and deliver their catches into multiple states. Coastal states regularly share confidential data to ensure regulations are enforced, to understand fisheries performance, and to analyze the need for and likely effects of potential rule changes. The goal of this act is to expressly authorize the department of fish and wildlife to protect data received from other coastal states if that data is confidential under the originating state's laws." [
2024 c 48 s 1.]
Fish and wildlife. (Effective June 30, 2027.)
The following information relating to fish and wildlife is exempt from disclosure under this chapter:
(1) Commercial fishing catch data from logbooks required to be provided to the department of fish and wildlife under RCW
77.12.047, when the data identifies specific catch location, timing, or methodology and the release of which would result in unfair competitive disadvantage to the commercial fisher providing the catch data, however, this information may be released to government agencies concerned with the management of fish and wildlife resources;
(2) Sensitive fish and wildlife data. Sensitive fish and wildlife data may be released to the following entities and their agents for fish, wildlife, land management purposes, or scientific research needs: Government agencies, public utilities, and accredited colleges and universities. Sensitive fish and wildlife data may be released to tribal governments. Sensitive fish and wildlife data may also be released to the owner, lessee, or right-of-way or easement holder of the private land to which the data pertains. The release of sensitive fish and wildlife data must be subject to a confidentiality agreement, except upon release of sensitive fish and wildlife data to the owner, lessee, or right-of-way or easement holder of private land who initially provided the data. Sensitive fish and wildlife data does not include data related to reports of predatory wildlife as specified in RCW
77.12.885. Sensitive fish and wildlife data must meet at least one of the following criteria of this subsection as applied by the department of fish and wildlife:
(a) The nesting sites or specific locations of endangered species designated under RCW
77.12.020, or threatened or sensitive species classified by rule of the department of fish and wildlife;
(b) Radio frequencies used in, or locational data generated by, telemetry studies; or
(c) Other location data that could compromise the viability of a specific fish or wildlife population, and where at least one of the following criteria are met:
(i) The species has a known commercial or black market value;
(ii) There is a history of malicious take of that species and the species behavior or ecology renders it especially vulnerable;
(iii) There is a known demand to visit, take, or disturb the species; or
(iv) The species has an extremely limited distribution and concentration;
(3) The personally identifying information of persons who acquire recreational licenses under RCW
77.32.010 or commercial licenses under chapter
77.65 or
77.70 RCW, except name, address of contact used by the department, and type of license, endorsement, or tag; however, the department of fish and wildlife may disclose personally identifying information to:
(a) Government agencies concerned with the management of fish and wildlife resources;
(b) The department of social and health services, child support division, and to the department of licensing in order to implement RCW
77.32.014 and
46.20.291; and
(c) Law enforcement agencies for the purpose of firearm possession enforcement under RCW
9.41.040;
(4)(a) Information that the department of fish and wildlife has received or accessed but may not disclose due to confidentiality requirements in the Magnuson-Stevens fishery conservation and management reauthorization act of 2006 (16 U.S.C. Sec. 1861(h)(3) and (i), and Sec. 1881a(b)); and
(b) Fisheries-related information that was collected by another state and is confidential under the laws of that state;
(5) The following tribal fish and shellfish harvest information, shared with the department of fish and wildlife:
(a) Fisher name;
(b) Fisher signature;
(c) Total harvest value per species;
(d) Total harvest value;
(e) Price per pound; and
(f) Tribal tax information; and
(6) The following commercial shellfish harvest information, shared with the department of fish and wildlife:
(a) Individual farmer name;
(b) Individual farmer signature;
(c) Total harvest value per species;
(d) Total harvest value;
(e) Price per pound; and
(f) Tax information.
NOTES:
Effective date—2024 c 48 s 3: "Section 3 of this act takes effect June 30, 2027." [
2024 c 48 s 5.]
Personal information—Notice of security breaches.
(1) Any agency that owns or licenses data that includes personal information shall disclose any breach of the security of the system to any resident of this state whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the personal information was not secured. Notice is not required if the breach of the security of the system is not reasonably likely to subject consumers to a risk of harm. The breach of secured personal information must be disclosed if the information acquired and accessed is not secured during a security breach or if the confidential process, encryption key, or other means to decipher the secured information was acquired by an unauthorized person.
(2) Any agency that maintains or possesses data that may include personal information that the agency does not own or license shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(3) The notification required by this section may be delayed if the data owner or licensee contacts a law enforcement agency after discovery of a breach of the security of the system and a law enforcement agency determines that the notification will impede a criminal investigation. The notification required by this section shall be made after the law enforcement agency determines that it will not compromise the investigation.
(4) For purposes of this section and except under subsection (5) of this section and RCW
42.56.592, notice may be provided by one of the following methods:
(a) Written notice;
(b) Electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. Sec. 7001; or
(c) Substitute notice, if the agency demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars, or that the affected class of subject persons to be notified exceeds five hundred thousand, or the agency does not have sufficient contact information. Substitute notice shall consist of all of the following:
(i) Email notice when the agency has an email address for the subject persons;
(ii) Conspicuous posting of the notice on the agency's website page, if the agency maintains one; and
(iii) Notification to major statewide media.
(5) An agency that maintains its own notification procedures as part of an information security policy for the treatment of personal information and is otherwise consistent with the timing requirements of this section is in compliance with the notification requirements of this section if it notifies subject persons in accordance with its policies in the event of a breach of security of the system.
(6) Any agency that is required to issue notification pursuant to this section shall meet all of the following requirements:
(a) The notification must be written in plain language; and
(b) The notification must include, at a minimum, the following information:
(i) The name and contact information of the reporting agency subject to this section;
(ii) A list of the types of personal information that were or are reasonably believed to have been the subject of a breach;
(iii) A time frame of exposure, if known, including the date of the breach and the date of the discovery of the breach; and
(iv) The toll-free telephone numbers and addresses of the major credit reporting agencies if the breach exposed personal information.
(7) Any agency that is required to issue a notification pursuant to this section to more than five hundred Washington residents as a result of a single breach shall notify the attorney general of the breach no more than thirty days after the breach was discovered.
(a) The notice to the attorney general must include the following information:
(i) The number of Washington residents affected by the breach, or an estimate if the exact number is not known;
(ii) A list of the types of personal information that were or are reasonably believed to have been the subject of a breach;
(iii) A time frame of exposure, if known, including the date of the breach and the date of the discovery of the breach;
(iv) A summary of steps taken to contain the breach; and
(v) A single sample copy of the security breach notification, excluding any personally identifiable information.
(b) The notice to the attorney general must be updated if any of the information identified in (a) of this subsection is unknown at the time notice is due.
(8) Notification to affected individuals must be made in the most expedient time possible, without unreasonable delay, and no more than thirty calendar days after the breach was discovered, unless the delay is at the request of law enforcement as provided in subsection (3) of this section, or the delay is due to any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. An agency may delay notification to the consumer for up to an additional fourteen days to allow for notification to be translated into the primary language of the affected consumers.
(9) For purposes of this section, "breach of the security of the system" means unauthorized acquisition of data that compromises the security, confidentiality, or integrity of personal information maintained by the agency. Good faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system when the personal information is not used or subject to further unauthorized disclosure.
(10)(a) For purposes of this section, "personal information" means:
(i) An individual's first name or first initial and last name in combination with any one or more of the following data elements:
(A) Social security number or the last four digits of the social security number;
(B) Driver's license number or Washington identification card number;
(C) Account number, credit or debit card number, or any required security code, access code, or password that would permit access to an individual's financial account, or any other numbers or information that can be used to access a person's financial account;
(D) Full date of birth;
(E) Private key that is unique to an individual and that is used to authenticate or sign an electronic record;
(F) Student, military, or passport identification number;
(G) Health insurance policy number or health insurance identification number;
(H) Any information about a consumer's medical history or mental or physical condition or about a health care professional's medical diagnosis or treatment of the consumer; or
(I) Biometric data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that is used to identify a specific individual;
(ii) User name or email address in combination with a password or security questions and answers that would permit access to an online account; and
(iii) Any of the data elements or any combination of the data elements described in (a)(i) of this subsection without the consumer's first name or first initial and last name if:
(A) Encryption, redaction, or other methods have not rendered the data element or combination of data elements unusable; and
(B) The data element or combination of data elements would enable a person to commit identity theft against a consumer.
(b) Personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
(11) For purposes of this section, "secured" means encrypted in a manner that meets or exceeds the national institute of standards and technology standard or is otherwise modified so that the personal information is rendered unreadable, unusable, or undecipherable by an unauthorized person.
NOTES:
Effective date—2019 c 241: See note following RCW
19.255.010.
Intent—2015 c 64: See note following RCW
19.255.010.