RCW 19.375

Washington's biometric identifiers law (RCW 19.375) limits how businesses enroll biometric identifiers in a database for a commercial purpose. Before enrolling, a business must give notice and either obtain consent or provide a way to prevent the identifier being used later for a commercial purpose.

It is narrower than Illinois' BIPA, and it has no private right of action. Much biometric data in Washington is now also covered by the My Health My Data Act, which is stricter and does allow individuals to sue.

• Any person who enrolls a biometric identifier in a database for a commercial purpose.
• Biometric identifiers are data generated by automatic measurements of biological characteristics, such as a fingerprint, voiceprint, eye retinas, irises or other unique biological patterns used to identify a specific individual. Physical or digital photographs, video and audio recordings, and data generated from them are excluded.
• Enrollment for a security purpose, meaning to prevent shoplifting, fraud or other misappropriation or theft, is outside the enrollment notice and consent requirement.

Individuals must receive notice and consent, or a mechanism to prevent later commercial use, before their biometric identifiers are enrolled.

Enforced by the Attorney General under Washington's Consumer Protection Act. There is no private right of action under this law, although the My Health My Data Act provides one for biometric data it covers.

1. List every system that enrolls biometric identifiers, including vendors' systems.
2. Give notice before enrollment, in a way reasonably available to the people affected.
3. Obtain consent or offer a mechanism to prevent later commercial use.
4. Do not sell or disclose without consent, outside the statutory exceptions.
5. Keep identifiers only as long as needed, and protect them.
6. Check the My Health My Data Act as well; it may cover the same data with stricter rules.