In the event of misuse or unauthorized disclosure of personal or identity information by either the recipient or its subrecipient the recipient must:

1. (1) Notify the department as outlined in its data sharing agreement with the department;
2. (2) Cooperate with all department requirements in responding to the event;

3. (3) Notify the department before notifying individuals or the public.

   The subrecipient must notify the recipient of a misuse or unauthorized disclosure of personal or identity information.

[Statutory Authority: RCW 46.01.110. WSR 23-19-010, § 308-10A-804, filed 9/7/23, effective 10/8/23.]