Washington State Poised To Set The Bar For Data Encryption Standards And Breach Notification

On March 4, 2015, Washington State's House of Representatives passed HB 1078, which would significantly tighten Washington's current data breach notification requirements, currently codified at RCW 19.255.010. The bill has been sent to the Senate, where it is scheduled to be heard by the Law and Justice Committee on March 19. Among the proposals are two extremely important changes that are critical for all organizations—not just those based or domiciled in Washington State. First, the bills would narrow the existing law that exempts organizations from having to provide data breach notification to individuals if the compromised data were encrypted. The new requirement would instead require notification if encrypted data is stolen, unless the data is encrypted to standards at or above those set by the National Institute of Standards and Technology (NIST). Second, it explicitly codifies the Attorney General's power to pursue a violation of the notification statute as an