Washington biometric law and the My Health My Data Act

1. 2017

   HB 1493 enacted

   RCW 19.375 becomes the third state biometric law, after Illinois (2008) and Texas (2009).

2. 2020

   Facial recognition law for state agencies

   SB 6280 regulates government use of facial recognition; it does not cover private companies.

3. 2023

   My Health My Data Act signed

   HB 1155, signed 27 April 2023, defines biometric data as consumer health data.

4. 2024

   MHMDA in force

   Most duties apply from 31 March 2024; small businesses from 30 June 2024.

What does RCW 19.375 cover?

The 2017 statute says a person may not enroll a biometric identifier in a database for a commercial purpose without first providing notice, obtaining consent, or providing a mechanism to prevent later commercial use. A biometric identifier is data generated by automatic measurements of biological characteristics, including a fingerprint, voiceprint, eye retinas, irises or other unique biological patterns used to identify a specific individual. The definition expressly excludes a physical or digital photograph, a video or audio recording, or data generated from them. Whether a face template computed from a photograph is excluded is the open question in Washington; the statute's drafters appear to have intended a narrower reach than Illinois.

Enrolled identifiers may not be sold, leased or disclosed except with consent or in listed situations, must be guarded with reasonable care, and may be retained only as long as reasonably necessary. Security and fraud-prevention uses are carved out.

What does the My Health My Data Act add?

MHMDA was written for reproductive health data after Dobbs, but its definition of consumer health data includes biometric data and data that identifies a consumer seeking health care. Biometric data here means data generated from technological processing of a person's physiological or biological characteristics that can be used to identify them, including imagery of the face from which an identifier template can be extracted. That language reaches face templates that RCW 19.375 may not.

Who enforces them?

Both are enforced by the Washington Attorney General as violations of the Consumer Protection Act. MHMDA also lets a consumer sue for a violation that injures their business or property, which is how class actions have begun to be filed. RCW 19.375 has produced almost no reported litigation in nine years.

What does it mean for face search?

An engine that builds face templates from public photos of Washington residents and offers them for a fee is collecting biometric data within MHMDA's definition without the opt-in consent the Act requires, and the person affected can sue. Under RCW 19.375 the photograph exclusion gives engines an argument that no covered identifier was enrolled. Engines such as PimEyes, FaceCheck.ID and FaceSearch do not publish Washington-specific terms; the practical exposure is the same as in Illinois with a lower damages ceiling.

What is pending or unsettled?

• No appellate decision on whether a face template falls inside RCW 19.375's photograph exclusion.
• Early MHMDA suits (2024 onward) test whether website tracking and biometric collection count as consumer health data; the first decisions are at the trial-court level.
• A comprehensive consumer privacy act has failed in Olympia several sessions in a row.