(1) No person may publish an individual's personal identifying information when:

(a) The publication is made without the express consent of the individual whose information is published;

(b) The publication is made with: (i) Intent or knowledge that the personal identifying information will be used to harm the individual whose information is published; or (ii) reckless disregard for the risk the personal identifying information will be used to harm the individual whose information is published; and

(c) The publication causes the individual whose information is published to suffer: (i) Physical injury; (ii) significant economic injury; (iii) mental anguish; (iv) fear of serious bodily injury or death for themself or a close relation to themself; or (v) a substantial life disruption.

(2) A person does not violate this section by:

(a) Providing personal identifying information with the reporting of criminal activity, which the person making the report reasonably believes occurred, to an employee of a law enforcement agency, intelligence agency, or other government agency in the United States; or in connection with any existing investigative, protective, or intelligence activity of any law enforcement agency, intelligence agency, or other government agency in the United States. This subsection (2)(a) only applies if the person providing the personal identifying information reasonably believes it to be accurate and provides the information in good faith and not for a malicious, fraudulent, or unlawful purpose;

(b) Providing personal identifying information in connection with an exercise of the right of freedom of speech or of the press, the right to assemble or petition, or the right of association, guaranteed by the United States Constitution or Washington state Constitution;

(c) Providing personal identifying information to, or in the course of acting as or on behalf of, "news media" as defined in RCW 5.68.010(5);

(d) Providing personal identifying information to a requestor in response to a request under the public records act, chapter 42.56 RCW;

(e) Providing personal identifying information when required to do so by any federal, state, or local law or regulation, or court rule or court order. This subsection (2)(e) only applies if the person providing the personal identifying information reasonably believes it to be accurate and provides the information in good faith and not for a malicious, fraudulent, or unlawful purpose;

(f) Providing personal identifying information in connection with a lawful requirement for a court filing or recording, including but not limited to recording judgments or filing claims of liens;

(g) Providing personal identifying information as permitted under the federal Gramm-Leach-Bliley act and consumer financial protection bureau Regulation P, 12 C.F.R. Part 1016, consistent with privacy policy disclosures provided pursuant to such regulation;

(h) Providing personal identifying information in compliance with the fair credit reporting act (84 Stat. 1127; 15 U.S.C. Sec. 1681 et seq.) or fair debt collection practices act (91 Stat. 874; 15 U.S.C. Sec. 1692 et seq.);

(i) Providing personal identifying information in a consumer alert or public notice arising from a regulatory, civil, or criminal investigation, complaint, or enforcement action. This subsection (2)(i) only applies to publications made by government agencies;

(j) Providing personal identifying information within or to a government agency, corporation, company, partnership, labor union, or another legal entity, or to any employees or agents thereof, but only if the following requirements are satisfied:

(i) The personal identifying information is provided for a legitimate and lawful purpose, including without limitation the reporting of criminal or fraudulent activity, facilitating a lawful commercial transaction, or furthering an existing business relationship;

(ii) The personal identifying information is provided through a private channel of communication, and is not provided to the public;

(iii) The person providing the personal identifying information:

(A) Reasonably believes it to be accurate; or

(B) Has reasonable suspicion to believe it is being used fraudulently; and

(iv) The person providing the personal identifying information provides it in good faith, and not for a malicious or fraudulent purpose; or

(k) Providing personal identifying information on behalf of a state agency, the health benefit exchange, a tribal nation, a contracted service provider of a state agency or the health benefit exchange, or the lead organization or a data vendor of the all-payer health care claims database under chapter 43.371 RCW, if the information was provided in a manner legally permitted under federal or state law or regulation.

(3) It is not a defense to a violation of this section that the personal identifying information at issue was voluntarily given to the publisher, has been previously publicly disclosed, or is readily discoverable through research or investigation.

(4) Nothing in this section shall be construed in any manner to:

(a) Conflict with 47 U.S.C. Sec. 230;

(b) Conflict with 42 U.S.C. Sec. 1983; or

(c) Prohibit any activity protected under the Constitution of the United States or the Washington state Constitution.

(5)(a) An individual whose personal identifying information is published in violation of this section may bring a civil action against: (i) The person or persons who published the personal identifying information; and (ii) any person who knowingly benefits, financially or by receiving anything of value, from participation in a venture that the person knew or should have known has engaged in an act in violation of this section.

(b) A prevailing claimant who brings a civil action pursuant to this section is entitled to recover any or all of the following remedies upon request: (i) Compensatory damages; (ii) punitive damages; (iii) statutory damages of $5,000 per violation; (iv) costs and reasonable attorneys' fees; (v) injunctive relief; and (vi) any other relief deemed appropriate by the court.

(c) When an action is brought under this section, a court may, on its own motion or upon the motion of any party, issue a temporary restraining order, or a temporary or permanent injunction, to restrain and prevent the disclosure or continued disclosure of a party's personal identifying information.

(d) A civil action may be brought in any county in which an element of any violation of this section occurred, or in which an individual resides who is the subject of the personal identifying information published in violation of this section.

(6) The definitions in this subsection apply throughout this section and section 2, chapter 381, Laws of 2023 unless the context clearly requires otherwise.

(a) "Close relation" means a current or former spouse or domestic partner, parent, child, sibling, stepchild, stepparent, grandparent, any person who regularly resides in the household or who within the prior six months regularly resided in the household, or any person with a significant personal or professional relationship.

(b) "Course of conduct" means a pattern of conduct composed of two or more acts, evidencing a continuity of purpose.

(c) "Doxing" means unauthorized publication of personal identifying information with intent or knowledge that the information will be used to harm the individual whose information is published, or with reckless disregard for the risk the information will be used to harm the individual whose information is published.

(d) "Electronic communication" means the transmission of information by wire, radio, optical cable, electromagnetic, or other similar means. "Electronic communication" includes, but is not limited to, email, internet-based communications, pager service, and electronic text messaging.

(e) "Harassment" has the same meaning as in RCW 9A.46.020, 9A.90.120, and 9.61.230.

(f) "Harm" means bodily injury, death, harassment, or stalking.

(g) "Mental anguish" means emotional distress or emotional suffering as evidenced by anxiety, fear, torment, or apprehension that may or may not result in a physical manifestation of mental anguish or a mental health diagnosis. The mental anguish must be protracted and not merely trivial or transitory.

(h) "Personal identifying information" means any information that can be used to distinguish or trace an individual's identity, including without limitation name, prior legal name, alias, mother's maiden name, or date or place of birth, in combination with any other information that is linked or linkable to an individual such as:

(i) Social security number, home address, mailing address, phone number, email address, social media accounts, or biometric data;

(ii) Medical, financial, education, consumer, or employment information, data, or records;

(iii) Any other sensitive private information that is linked or linkable to a specific identifiable individual, such as gender identity, sexual orientation, or any sexually intimate visual depiction; or

(iv) Any information, including without limitation usernames and passwords, that enables access to a person's email accounts, social media accounts, electronic forum accounts, chat or instant message accounts, cloud storage accounts, banking or financial accounts, computer networks, computers or phones, teleconferencing services, video-teleconferencing services, or other digital meeting rooms.

(i) "Publish" means to circulate, deliver, distribute, disseminate, post, transmit, or otherwise make available to another person, through any oral, written, visual, or electronic communication.

(j) "Regularly resides" means residing in the household with some permanency or regular frequency in the resident's living arrangement.

(k) "Stalking" has the same meaning as in RCW 9A.46.110.

(l) "Substantial life disruption" means that a person significantly modifies their actions, routines, employment, residence, appearance, name, or contact information to avoid or protect against an actor who has obtained or is using the person's personal identifying information, or because of the course of conduct of an actor who has obtained or is using the person's personal identifying information. Examples include, without limitation, changing a phone number, changing an electronic mail address, deleting personal electronic accounts, significantly decreasing use of the internet, moving from an established residence, changing daily routines, changing routes to and from work, changing employment or work schedule, or losing time from work or a job.

(7) The legislature does not intend this section to allow, and this section shall not allow, actions to be brought for constitutionally protected activity.

Construction—2023 c 381: "This act shall be liberally construed and applied to promote its underlying purpose to deter doxing, protect persons from doxing, and provide adequate remedies to victims of doxing." [ 2023 c 381 s 2.]