WaTech/PRA exemption

AN ACT Relating to protecting individual privacy by Washington 1
technology solutions through an exemption from public inspection and 2
copying; amending RCW 43.105.020 and 43.105.365; reenacting and 3
amending RCW 42.56.230; and creating a new section.4
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:5
NEW SECTION. Sec. 1. (1) The legislature finds that Washington 6
technology solutions (WaTech) exists to serve as a strategic, 7
centralized information technology partner for state agencies, 8
enabling better service delivery to Washingtonians, achieving cost 9
savings through shared services, and ensuring uniform information 10
technology standards across government. It provides these services to 11
enhance transparency, efficiency, and the overall effectiveness of 12
government operations through the appropriate use of technology.13
(2)(a) Given that technological innovation and new uses of data 14
can help Washingtonians solve societal problems and improve quality 15
of life, the legislature intends to shape responsible public policies 16
where innovation and protection of individual privacy coexist and 17
provide for the confidentiality of identifying personal information.18
(b) The legislature further intends to strengthen and enhance the 19
protection of the information submitted to Washington technology 20
solutions to provide information technology services.21
Z-0401.5
HOUSE BILL 2491
State of Washington 69th Legislature 2026 Regular Session
By Representatives Doglio, Parshley, Reeves, and Reed; by request of
WaTech
Read first time 01/15/26. Referred to Committee on State Government
& Tribal Relations.
p. 1 HB 2491
Sec. 2. RCW 43.105.020 and 2024 c 54 s 3 are each amended to 1
read as follows: 2
The definitions in this section apply throughout this chapter 3
unless the context clearly requires otherwise. 4
(1) "Agency" means Washington technology solutions.5
(2) "Board" means the technology services board.6
(3) "Cloud computing" has the same meaning as provided by the 7
special publication 800-145 issued by the national institute of 8
standards and technology of the United States department of commerce 9
as of September 2011 or its successor publications.10
(4) "Customer agencies" means all entities that purchase or use 11
information technology resources, telecommunications, or services 12
from Washington technology solutions. 13
(5) "Digital experience platform" includes the agency's online 14
systems, applications, or websites through which people find, access, 15
interact with, or manage government services.16
(6) "Director" means the state chief information officer, who is 17
the director of Washington technology solutions. 18
(((6))) (7) "Enterprise architecture" means an ongoing activity 19
for translating business vision and strategy into effective 20
enterprise change. It is a continuous activity. Enterprise 21
architecture creates, communicates, and improves the key principles 22
and models that describe the enterprise's future state and enable its 23
evolution. 24
(((7))) (8) "Equipment" means the machines, devices, and 25
transmission facilities used in information processing, including but 26
not limited to computers, terminals, telephones, wireless 27
communications system facilities, cables, and any physical facility 28
necessary for the operation of such equipment. 29
(((8))) (9) "Information" includes, but is not limited to, data, 30
text, voice, and video. 31
(((9))) (10) "Information security" means the protection of 32
communication and information resources from unauthorized access, 33
use, disclosure, disruption, modification, or destruction in order 34
to: 35
(a) Prevent improper information modification or destruction;36
(b) Preserve authorized restrictions on information access and 37
disclosure; 38
(c) Ensure timely and reliable access to and use of information; 39
and 40
p. 2 HB 2491
(d) Maintain the confidentiality, integrity, and availability of 1
information. 2
(((10))) (11) "Information technology" includes, but is not 3
limited to, all electronic technology systems and services, automated 4
information handling, system design and analysis, conversion of data, 5
computer programming, information storage and retrieval, 6
telecommunications, requisite system controls, simulation, electronic 7
commerce, radio technologies, and all related interactions between 8
people and machines. 9
(((11))) (12) "Information technology portfolio" or "portfolio" 10
means a strategic management process documenting relationships 11
between agency missions and information technology and 12
telecommunications investments. 13
(((12))) (13) "K-20 network" means the network established in RCW 14
43.41.391. 15
(((13))) (14) "Local governments" includes all municipal and 16
quasi-municipal corporations and political subdivisions, and all 17
agencies of such corporations and subdivisions authorized to contract 18
separately. 19
(((14))) (15) "Oversight" means a process of comprehensive risk 20
analysis and management designed to ensure optimum use of information 21
technology resources and telecommunications. 22
(((15))) (16) "Proprietary software" means that software offered 23
for sale or license. 24
(((16))) (17) "Public agency" means any agency of this state or 25
another state; any political subdivision or unit of local government 26
of this state or another state including, but not limited to, 27
municipal corporations, quasi-municipal corporations, special purpose 28
districts, and local service districts; any public benefit nonprofit 29
corporation; any agency of the United States; and any Indian tribe 30
recognized as such by the federal government. 31
(((17))) (18) "Public benefit nonprofit corporation" means a 32
public benefit nonprofit corporation as defined in RCW 24.03A.245 33
that is receiving local, state, or federal funds either directly or 34
through a public agency other than an Indian tribe or political 35
subdivision of another state. 36
(((18))) (19) "Public record" has the definitions in RCW 37
42.56.010 and chapter 40.14 RCW and includes legislative records and 38
court records that are available for public inspection.39
p. 3 HB 2491
(((19))) (20) "Public safety" refers to any entity or services 1
that ensure the welfare and protection of the public.2
(((20))) (21) "Ransomware" means a type of malware that attempts 3
to deny a user or organization access to data or systems, usually 4
through encryption, until a sum of money or other currency is paid or 5
the user or organization is forced to take a specific action.6
(((21))) (22) "Security incident" means an accidental or 7
deliberative event that results in or constitutes an imminent threat 8
of the unauthorized access, loss, disclosure, modification, 9
disruption, or destruction of communication and information 10
resources. 11
(((22))) (23) "State agency" means every state office, 12
department, division, bureau, board, commission, or other state 13
agency, including offices headed by a statewide elected official.14
(((23))) (24) "Telecommunications" includes, but is not limited 15
to, wireless or wired systems for transport of voice, video, and data 16
communications, network systems, requisite facilities, equipment, 17
system controls, simulation, electronic commerce, and all related 18
interactions between people and machines. 19
(((24))) (25) "Utility-based infrastructure services" includes 20
personal computer and portable device support, servers and server 21
administration, security administration, network administration, 22
telephony, email, and other information technology services commonly 23
used by state agencies. 24
Sec. 3. RCW 43.105.365 and 2015 3rd sp.s. c 1 s 218 are each 25
amended to read as follows: 26
(1) State agencies and local governments that collect and enter 27
information concerning individuals into electronic records and 28
information systems that will be widely accessible by the public 29
under RCW 42.56.010 shall ensure the accuracy of this information to 30
the extent possible. To the extent possible, information must be 31
collected directly from, and with the consent of, the individual who 32
is the subject of the data. State agencies shall establish procedures 33
for correcting inaccurate information, including establishing 34
mechanisms for individuals to review information about themselves and 35
recommend changes in information they believe to be inaccurate. The 36
inclusion of personal information in electronic public records that 37
is widely available to the public should include information on the 38
date when the database was created or most recently updated. If 39
p. 4 HB 2491
personally identifiable information is included in electronic public 1
records that are made widely available to the public, state agencies 2
must follow retention and archival schedules in accordance with 3
chapter 40.14 RCW, retaining personally identifiable information only 4
as long as needed to carry out the purpose for which it was 5
collected. At least once every five years, each agency that collects 6
information must review the information collected and justify why it 7
is being collected and for what purpose. 8
(2) Information submitted to the agency for the purpose of 9
providing information technology related to digital experience 10
platform services is exempt from public disclosure and copying under 11
chapter 42.56 RCW.12
Sec. 4. RCW 42.56.230 and 2023 c 361 s 14, 2023 c 346 s 1, and 13
2023 c 182 s 2 are each reenacted and amended to read as follows:14
The following personal information is exempt from public 15
inspection and copying under this chapter: 16
(1) Personal information in any files maintained for students in 17
public schools, patients or clients of public institutions or public 18
health agencies, or welfare recipients; 19
(2)(a) Personal information: 20
(i) For a child enrolled in licensed child care in any files 21
maintained by the department of children, youth, and families;22
(ii) For a child enrolled in a public or nonprofit program 23
serving or pertaining to children, adolescents, or students, 24
including but not limited to early learning or child care services, 25
parks and recreation programs, youth development programs, and after-26
school programs; 27
(iii) For a student enrolled or previously enrolled in a local 28
education agency, in any records pertaining to the student, including 29
correspondence; 30
(iv) For the family members or guardians of a child who is 31
subject to the exemption under this subsection (2) if the family 32
member or guardian has the same last name as the child or if the 33
family member or guardian resides at the same address as the child 34
and disclosure of the family member's or guardian's information would 35
result in disclosure of the personal information exempted under 36
(a)(i) through (iii) of this subsection; or 37
p. 5 HB 2491
(v) For substitute caregivers who are licensed or approved to 1
provide overnight care of children by the department of children, 2
youth, and families. 3
(b) Emergency contact information under this subsection (2) may 4
be provided to appropriate authorities and medical personnel for the 5
purpose of treating the individual during an emergency situation;6
(3) Personal information in files maintained for employees, 7
appointees, or elected officials of any public agency to the extent 8
that disclosure would violate their right to privacy;9
(4) Information required of any taxpayer in connection with the 10
assessment or collection of any tax if the disclosure of the 11
information to other persons would: (a) Be prohibited to such persons 12
by RCW 84.08.210, 82.32.330, 84.40.020, 84.40.340, or any ordinance 13
authorized under RCW 35.102.145; or (b) violate the taxpayer's right 14
to privacy or result in unfair competitive disadvantage to the 15
taxpayer; 16
(5) Credit card numbers, debit card numbers, electronic check 17
numbers, card expiration dates, or bank or other financial 18
information as defined in RCW 9.35.005 including social security 19
numbers, except when disclosure is expressly required by or governed 20
by other law; 21
(6) Personal and financial information related to a small loan or 22
any system of authorizing a small loan in RCW 31.45.093;23
(7)(a) Any record used to prove identity, age, residential 24
address, social security number, or other personal information 25
required to apply for a driver's license or identicard.26
(b) Information provided under RCW 46.20.111 that indicates that 27
an applicant declined to register with the selective service system.28
(c) Any record pertaining to a vehicle license plate, driver's 29
license, or identicard issued under RCW 46.08.066 that, alone or in 30
combination with any other records, may reveal the identity of an 31
individual, or reveal that an individual is or was, performing an 32
undercover or covert law enforcement, confidential public health 33
work, public assistance fraud, or child support investigative 34
activity. This exemption does not prevent the release of the total 35
number of vehicle license plates, drivers' licenses, or identicards 36
that, under RCW 46.08.066, an agency or department has applied for, 37
been issued, denied, returned, destroyed, lost, and reported for 38
misuse. 39
p. 6 HB 2491
(d) Any record pertaining to a vessel registration issued under 1
RCW 88.02.330 that, alone or in combination with any other records, 2
may reveal the identity of an individual, or reveal that an 3
individual is or was, performing an undercover or covert law 4
enforcement activity. This exemption does not prevent the release of 5
the total number of vessel registrations that, under RCW 88.02.330, 6
an agency or department has applied for, been issued, denied, 7
returned, destroyed, lost, and reported for misuse.8
Upon request by the legislature, the department of licensing 9
shall provide a report to the legislature containing all of the 10
information in (c) of this subsection (7) and this subsection (7)(d) 11
that is subject to public disclosure; 12
(8) All information related to individual claim resolution 13
settlement agreements submitted to the board of industrial insurance 14
appeals under RCW 51.04.063, other than final orders from the board 15
of industrial insurance appeals. The board of industrial insurance 16
appeals shall provide to the department of labor and industries 17
copies of all final claim resolution settlement agreements;18
(9) Voluntarily submitted information contained in a database 19
that is part of or associated with 911 emergency communications 20
systems, or information contained or used in emergency notification 21
systems as provided under RCW 38.52.575 and 38.52.577;22
(10) Information relating to a future voter, as provided in RCW 23
29A.08.725; 24
(11) All information submitted by a person to the state, either 25
directly or through a state-licensed gambling establishment, or 26
Indian tribes, or tribal enterprises that own gambling operations or 27
facilities with class III gaming compacts, as part of the self-28
exclusion program established in RCW 9.46.071 or 67.70.040 for people 29
with a gambling problem or gambling disorder; 30
(12) Names, addresses, or other personal information of 31
individuals who participated in the bump-fire stock buy-back program 32
under former RCW 43.43.920; ((and))33
(13) All personal and financial information concerning a player 34
that is received or maintained by the state lottery or any contracted 35
lottery vendor except the player's name and city or town of 36
residence. Additional information may be released only in accordance 37
with prior written permission from the player; and38
p. 7 HB 2491
(14) Information submitted to Washington technology solutions, as 1
provided in RCW 43.105.365(2). 2
--- END ---
p. 8 HB 2491