Washington Revised Code Title 19. Business Regulations--Miscellaneous § 19.215.020. Destruction of information--Liability--Exception--Civil action

(1) An entity must take all reasonable steps to destroy, or arrange for the destruction of, personal financial and health information and personal identification numbers issued by government entities in an individual's records within its custody or control when the entity is disposing of records that it will no longer retain.

(2) An entity is not liable under this section for records it has relinquished to the custody and control of the individual to whom the records pertain.

(3) This subsection [section] does not apply to the disposal of records by a transfer of the records, not otherwise prohibited by law, to another entity, including a transfer to archive or otherwise preserve public records as required by law.

(4) An individual injured by the failure of an entity to comply with subsection (1) of this section may bring a civil action in a court of competent jurisdiction. The court may:

(5) An individual having reason to believe that he or she may be injured by an act or failure to act that does not comply with subsection (1) of this section may apply to a court of competent jurisdiction to enjoin the act or failure to act. The court may grant an injunction with terms and conditions as the court may deem equitable.

(6) The attorney general may bring a civil action in the name of the state for damages, injunctive relief, or both, against an entity that fails to comply with subsection (1) of this section. The court may award damages that are the same as those awarded to individual plaintiffs under subsection (4) of this section.

(7) The rights and remedies provided under this section are in addition to any other rights or remedies provided by law.