Ask Reggi Your Question Now
Can I skip obtaining consent to sell personal information in Washington? What are the requirements?
To sell personal information in Washington, you generally need to obtain consent from the consumer. However, there are exceptions to this requirement.
Under WAAC 284-04-410, a licensee may disclose nonpublic personal financial information without obtaining consent if the disclosure is made with the consent or at the direction of the consumer, provided that the consumer has not revoked the consent or direction. Additionally, disclosure without consent is allowed to protect the confidentiality or security of a licensee’s records pertaining to the consumer, to protect against or prevent actual or potential fraud or unauthorized transactions, for required institutional risk control or for resolving consumer disputes or inquiries, to persons holding a legal or beneficial interest relating to the consumer, or to persons acting in a fiduciary or representative capacity on behalf of the consumer. Disclosure is also allowed to provide information to insurance rate advisory organizations, guaranty funds or agencies, agencies that are rating a licensee, persons that are assessing the licensee’s compliance with industry standards, and the licensee’s attorneys, accountants and auditors. Disclosure may also be made to comply with federal, state or local laws, rules and other applicable legal requirements, to comply with a properly authorized civil, criminal or regulatory investigation, or subpoena or summons by federal, state or local authorities, or to respond to judicial process or government regulatory authorities having jurisdiction over a licensee for examination, compliance or other purposes as authorized by law.
Under WAAC 284-04-400, a licensee may provide nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf without obtaining consent, if the licensee provides the initial notice in accordance with WAC 284-04-200 and enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information.
However, it is important to note that these exceptions are not exhaustive and there may be other requirements or exceptions that apply in specific situations.
For biometric identifiers, an agency may not collect, capture, purchase, or otherwise obtain a biometric identifier without first providing notice and obtaining the individual’s consent, as specified in WARC 40.26.020.
Therefore, in general, obtaining consent is required to sell personal information in Washington, but there are exceptions to this requirement. It is important to review the specific requirements and exceptions that apply in each situation.
Source(s):
- [2.1] Other exceptions to notice and opt out requirements for disclosure of nonpublic personal financial information.
- [2.4] Exception to opt out requirements for disclosure of nonpublic personal financial information for service providers and joint marketing.
- [4.1] Biometric identifiers—Notice and consent—Agencies—Use, storage, retention—Review—Definitions—Exceptions.
Jurisdiction
Washington