RCW 59.18.760: Smart access systems—User data collection. (Effective January 1, 2027.)

(1) A landlord of a smart access building or third party may collect only the minimum amount of authentication data and reference data necessary to enable the use of a smart access system for the purpose of granting a user access to a building, its elevators, its common areas, or to a user's dwelling.

(2) A smart access system may only collect, generate, or utilize the following information:

(a) A user's name;

(b) The dwelling unit number and other doors or common areas to which the user has access using a smart access system in a building;

(c) A user's preferred method of contact;

(d) A user's biometric identifier information if a smart access system utilizes biometric identifier information;

(e) The identification card number or any identifier associated with the physical hardware used to facilitate building entry, including radio frequency identification card, bluetooth, or other similar technical protocols;

(f) Passwords, passcodes, user names, and contact information used singly or in conjunction with other reference data to grant a user entry to a smart access building, dwelling unit of a building, or common area of a building through the building's smart access system, or to access any online tools used to manage user accounts related to a building;

(g) Lease information, including move-in and, if available, move-out dates; and

(h) The time and method of access, solely for security and operational purposes.