Legislative Alert: Washington Expands Definition of Personal Information for Public Agencies
On March 18, 2020, Washington State Governor Jay Inslee signed into law Senate Bill 6187, which amends the state’s security breach notification statute as applicable to state and local agencies by expanding the definition of “personal information” to include the last four digits of an individual’s Social Security number.
The amended definition will impose notification requirements on public entities at the state and local level within the Evergreen State in the event of a security breach, even when a resident’s full Social Security number is not exposed in the breach. Pursuant to the statute as amended, agencies are now required to notify Washington residents, and, in some cases, the attorney general, in the event that the agency experiences a “breach in the security of the system” that compromises an individual’s name, in combination with, inter alia, a Social Security number or the last four digits of the Social Security number.
Importantly, SB 6187 does not similarly amend the breach notification statute applicable to businesses and other non-agencies that do business within Washington.
The amendment becomes effective on June 11, 2020.