Skip to main content

Workplace privacy law · WA

Washington workplace electronic monitoring law and what it means for organizational health intelligence.

The governing statute is RCW § 9.73.030. Two-party consent for the recording of communications.

Washington combines a two-party consent posture with one of the strictest consumer-health-data laws in the country. Workplace analytics that could surface health-adjacent inferences require careful scoping.

Consent posture

Two-party consent

Primary citation

RCW § 9.73.030

Enforcement

Washington Attorney General; private right of action under RCW § 9.73.060 and My Health My Data Act.

Notification requirements in Washington

  • Personal social media accounts protected from compelled disclosure
  • Separate consent regime for biometric data

Other relevant Washington statutes

RCW § 49.44.135

Limits employer access to personal social media accounts.

RCW § 19.375 (Washington Biometric Privacy Act)

Requires notice and consent before enrollment of biometric identifiers in a database for commercial purposes. Limits to commercial purposes — narrower than BIPA.

My Health My Data Act (RCW § 19.373, effective Mar 31, 2024)

Strict regulation of consumer health data. Workplace monitoring should not collect categories that could be construed as health data.

Employer obligations

  • Two-party consent for recording.
  • Notice and consent before biometric enrollment in a database.
  • No demand for personal social media credentials.
  • Avoid collection of any data that could be characterized as consumer health data under the My Health My Data Act.

How ClarityLift’s privacy posture maps to Washington law

ClarityLift surfaces team-level patterns from the conversations a customer already has in Slack or Teams. The architecture is privacy-first by design. No DMs. Ever. Aggregate signals only. Minimum group threshold of 10. No individual scores. Customers retain full control of which channels are connected.

For employers operating in Washington, the relevant requirements typically resolve at the policy and channel-selection layer, not the technical layer. ClarityLift does not record voice or video, so two-party consent statutes for audio/video recording are structurally inapplicable.

Compliance with RCW § 9.73.030 is achieved by the customer through written notice to employees (where required), an acceptable-use policy, and clear channel-connection scope. ClarityLift’s consent architecture supports this directly: every connected workspace surfaces the channel list, retention posture, and group-floor minimum to admins.

This is not legal advice. Employers should review their specific monitoring practices with counsel before deploying any workplace analytics tool.

Frequently asked

Does ClarityLift read individual employee messages?

No. ClarityLift processes communication signals at the aggregate team level. No individual scores are produced. The minimum group threshold of 10 is structurally prevented in code — teams below that floor never surface signals.

What does Washington consider a "private" communication for monitoring purposes?

Under RCW § 9.73.030, the operative question is whether the communication was made with a reasonable expectation of privacy. Workplace channels under an acceptable-use policy that defines them as business communications generally fall within the business-purpose exception. DMs and personal channels are different — and ClarityLift excludes them by design.

Are DMs ever processed by ClarityLift?

No. DMs are rejected at the ingest gate before any classification, signal generation, or storage. This is structurally prevented, not a policy choice.

Does the biometric statute apply to ClarityLift?

Washington biometric privacy law applies to the capture of biometric identifiers — fingerprints, voiceprints, face geometry, and similar. ClarityLift does not capture biometric identifiers. Communication signals are derived from text only.

See ClarityLift’s privacy architecture before you deploy in Washington.

Aggregate signals only. No DMs. Minimum group threshold of 10. The compliance posture is built into the architecture, not bolted on after.