A pharmacy, shopkeeper, or itinerant vendor participating in the electronic sales tracking system under RCW 69.43.110(4):

(1) Is not liable for civil damages resulting from any act or omission in carrying out the requirements of RCW 69.43.110(4), other than an act or omission constituting gross negligence or willful or wanton misconduct; and

(2) Is not liable for civil damages resulting from a data breach that was proximately caused by a failure on the part of the electronic sales tracking system to take reasonable care through the use of industry standard levels of encryption to guard against unauthorized access to account information that is in the possession or control of the system.