- Washington State created its personal data disposal law in 2002
- disposal law applies to any person or entity in the state
- requires an entity to take reasonable steps to destroy records that contain health and financial data when its no longer needed
- Records are defined as any material—paper or electronic—that holds information
- must destroy information in records so that it is no longer readable or decipherable
- proper destruction includes shredding, erasing, or modifying records so that they are no longer readable
- allows a person harmed by a violation of the law to sue the entity that violated it
- provides the plaintiff with several remedies that vary depending on the type of violation
- if due to negligence
- penalty of $200 or actual damages, whichever is greater
- if intentional
- award a penalty of $600 or actual damages
- allows the court to award treble (triple) damages
- are three times the amount of the actual damages incurred
- may not be more than $10,000
- allows the state attorney general to prosecute an entity that violates the law
- court must award damages the same way that it awards damages to an individual plaintiff
- court may also grant injunctive relief
- means that it can order the entity to stop violating the law