House lawmakers in Washington state on Friday advanced an amended version of the Washington Privacy Act that adds a limited private right of action and incorporates changes in alignment with California privacy law.

In a partisan 11–6 vote, the House Civil Rights & Judiciary Committee approved a striking amendment that adds a private right of action for consumers alleging a violation of the bill’s consumer data rights, including the right to access, correct or delete data. Remedies would be limited to injunctive relief, with “reasonable attorneys’ fees and costs” awarded to plaintiffs.

Other amendments include defining a minor as someone at least 13 and under age 16, expiring a right to cure provision one year after the bill’s effective date, and adding a 45-day timeline within which controllers must respond to data requests. Also, under the amended bill, as of July 31, 2023, a consumer can exercise their right to opt out of the sale of their data and targeted advertising by “designating an authorized agent or via user-enabled global privacy controls.”

“I think this bill is reasonable and moves us forward,” said Committee Chair State Rep. Drew Hansen, D-Wash., who proposed the striking amendment. “California has enacted provisions in this area by initiative. The striking amendment incorporates some of what California has done, aligning some of the definitions closer to what California has done already and is already law.”

Ranking minority member State Rep. Jim Walsh, R-Wash., did not support the amendments, saying they “fall short” in effectively protecting consumer privacy.

“We are concerned that the structure of the bill currently will open the floodgates of legal actions, but not effectively guarantee or improve any Washingtonians digital privacy,” he said. “We just don’t feel comfortable that this bill does what it purports to do. We all want to protect data privacy for Washington citizens and residents; we just don’t feel this gets there.”  

A third iteration of the WPA passed the Senate in early March.

The lack of a private right of action within the proposal has long been a point of contention, including for the Washington State Office of the Attorney General, tasked with sole enforcement authority under previous iterations. Speaking before the Civil Rights & Judiciary Committee during a hearing earlier this month, Legislative Director Yasmin Trudeau addressed the lack of a private right of action as one of the office’s two ongoing concerns, along with a call for a sunset date for the right to cure provision.

“The attorney general has always strongly believed there should be a private right of action,” she said. “In short, this is because we believe that everyone should have access to the courts to enforce their rights, including privacy rights.”

Following the House Committee’s passage of the amended WPA, Future of Privacy Forum Policy Counsel Pollyanna Sanderson called it “the strongest version of the (WPA) that we’ve seen at this point.”

“It’s more sophisticated. (There have) been three years of conversations with stakeholders on this,” she said, adding the changes are “an interesting and positive development.”

She noted the enforcement debate blocked the bill’s passage last year, and while it’s important for the law to have a strong enforcement mechanism, opinions differ on what that looks like.

“Even though the enforcement is limited to certain provisions and only injunctive relief, I’m still going to be interested to see how it does on the floor with these changes,” she said.

The amended bill gained support from some privacy advocates.

Consumer Reports said the latest changes “are a significant improvement over the previous version passed by the Washington state Senate.” The organization has been neutral on earlier versions, Senior Policy Analyst Maureen Mahoney said, but the recent changes strengthen the bill for consumers and businesses.

“In our view, the (WPA) would provide strong privacy protections for consumers, stronger than the (California Consumer Privacy Act),” she said. “We urge legislators in Washington to pass this version of the bill, and we’re pleased that the House has particularly strengthened enforcement.”

Common Sense Media Multistate Policy Director Joseph Jerome, CIPP/US, said he has been calling for stronger enforcement and protections for teens, as well as better addressing the targeted advertising opt-out.

“The amendment that passed out of committee today does all three of those things, so I think that’s a big deal,” he said.

Photo by Charles Lenhart on Unsplash