Washington Data Breach Notification Law

Notification deadline: 30 days from discovery

Enforcement: Washington Attorney General

Overview

Washington requires businesses to notify affected residents within 30 days of discovering a breach. The state also maintains one of the most comprehensive public breach databases in the country.

Who Must Be Notified

• • Affected Washington residents (within 30 days)
• • Washington Attorney General (if 500+ residents affected)

Covered Data Types

Social Security number, Driver's license or state ID number, Financial account number with access code, Full date of birth, Private key for electronic signatures, Health insurance ID and information, Medical history or treatment information, Biometric data, Username with password or security questions

Notification Requirements

• • Written, electronic, or telephonic notice within 30 days
• • Include name and contact info of business
• • List of types of personal information subject to breach
• • Toll-free numbers for credit bureaus and FTC
• • Notification to AG must include detailed incident information

Exemptions

• • Encrypted data (if key not compromised)
• • Good faith acquisition by employee (if not misused)
• • Publicly available information

Penalties

AG can bring action under Consumer Protection Act. Civil penalties up to $100,000 per breach. Private right of action for actual damages.