Shown verbatim: the complete text as captured from the official page posted by the Washington Legislature, fetched 2026-08-29. This is the chaptered version. The official bill page.
CERTIFICATION OF ENROLLMENT HOUSE BILL 2606 Chapter 9, Laws of 2026 69TH LEGISLATURE 2026 REGULAR SESSION OFFICE OF PRIVACY AND DATA PROTECTION—DUTIES AND REPORTS EFFECTIVE DATE: June 11, 2026 Passed by the House February 11, 2026 Yeas 89 Nays 6 LAURIE JINKINS Speaker of the House of Representatives Passed by the Senate February 28, 2026 Yeas 49 Nays 0 DENNY HECK President of the Senate CERTIFICATE I, Bernard Dean, Chief Clerk of the House of Representatives of the State of Washington, do hereby certify that the attached is HOUSE BILL 2606 as passed by the House of Representatives and the Senate on the dates hereon set forth. BERNARD DEAN Chief Clerk Chief Clerk Approved March 9, 2026 9:33 AM FILED March 10, 2026 BOB FERGUSON Governor of the State of Washington Secretary of State State of Washington HOUSE BILL 2606 Passed Legislature - 2026 Regular Session State of Washington 69th Legislature 2026 Regular Session By Representatives Barnard, Ryu, Nance, and Timmons Read first time 01/21/26. Referred to Committee on Technology, Economic Development, & Veterans. AN ACT Relating to performance measures, duties, and reporting requirements for the office of privacy and data protection; and amending RCW 43.105.369. BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON: Sec. 1. RCW 43.105.369 and 2024 c 54 s 16 are each amended to read as follows: (1) The office of privacy and data protection is created within the agency. The purpose of the office of privacy and data protection is to serve as a central point of contact for state agencies on policy matters involving data privacy and data protection. (2) The director shall appoint the chief privacy officer, who is the director of the office of privacy and data protection. (3) The primary duties of the office of privacy and data protection with respect to state agencies are: (a) To conduct an annual privacy review; (b) To conduct an annual privacy training for state agencies and employees; (c) To articulate privacy principles and best practices; (d) To coordinate data protection in cooperation with the agency; and (e) To participate with the agency in the review of major state agency projects involving personally identifiable information, including projects using artificial intelligence . (4) The office of privacy and data protection must serve as a resource to local governments and the public on data privacy and protection concerns by: (a) Developing and promoting the dissemination of best practices for the collection and storage of personally identifiable information, including establishing and conducting a training program or programs for local governments; and (b) Educating consumers about the use of personally identifiable information on mobile and digital networks and measures that can help protect this information. (5) By December 1, 2016, and every four years thereafter, the office of privacy and data protection must prepare and submit to the legislature a report evaluating its performance. The office of privacy and data protection must establish performance measures in its 2016 report to the legislature and, in each report thereafter, demonstrate the extent to which performance results have been achieved. These performance measures must include, but are not limited to, the following: (a) ((The number of state agencies and employees who have participated in the annual privacy training ))Improvement of privacy and data protection policies and practices by state agencies and, when available, local governments, following participation in the office of privacy and data protection's trainings, and for state agencies, annual review ; (b) ((A report on the ))The extent of the office of privacy and data protection's coordination with international and national experts in the fields of data privacy, data protection, and access equity; (c) ((A report on the implementation of data protection measures by state agencies attributable in whole or in part to the office of privacy and data protection's coordination of efforts; and (d) A report on consumer education efforts, including but not limited to the number of consumers educated through public outreach efforts, as indicated by how frequently educational documents were accessed, the office of privacy and data protection's participation in outreach events, and inquiries received back from consumers via telephone or other media ))Data on contacts with the public, including how many members of the public contact the office of privacy and data protection, the nature of the contact, and the office of privacy and data protection's response, including providing referrals and technical assistance; (d) Results of direct evaluation from participants of the office of privacy and data protection's trainings, including in-person or virtual formats. The report shall also include how many trainings were completed, topics, and how many participants attended; (e) The number and nature of technical assistance requests by state agencies and local governments; (f) The office of privacy and data protection's staff continuing education activities or certifications in emerging technologies, evolving best practices, and state or federal policies; and (g) The number of privacy threshold analyses completed, and the number of privacy impact assessments completed . (((6) Within one year of June 9, 2016, the office of privacy and data protection must submit to the joint legislative audit and review committee for review and comment the performance measures developed under subsection (5) of this section and a data collection plan. (7) The office of privacy and data protection shall submit a report to the legislature on the: (a) Extent to which telecommunications providers in the state are deploying advanced telecommunications capability; and (b) existence of any inequality in access to advanced telecommunications infrastructure experienced by residents of tribal lands, rural areas, and economically distressed communities. The report may be submitted at a time within the discretion of the office of privacy and data protection, at least once every four years, and only to the extent the office of privacy and data protection is able to gather and present the information within existing resources. )) Passed by the House February 11, 2026. Passed by the Senate February 28, 2026. Approved by the Governor March 9, 2026. Filed in Office of Secretary of State March 10, 2026.
Every fact on this page links to its source, starting with the official bill record.