Following a 46-1 vote in the Senate, the proposed Washington Privacy Act has moved over to the House of Representatives, where a previous version stalled last spring.

The proposed legislation’s lack of private right of action for consumers, preemption of local laws and ordinances, regulations on commercial uses of facial recognition, and the Washington attorney general’s exclusive enforcement authority raised concerns from those who spoke before the Innovation, Technology and Economic Development Committee during its first public hearing on Senate Bill 6281 Friday. Many of the same concerns were expressed before the Senate Environment, Energy & Technology Committee in January.

The proposed legislation would give Washington residents the right to access, correct or delete data collected on them by commercial entities, as well as the right to opt out of certain forms of data processing. Supporters praised the privacy protections within the proposed legislation, like Washington Retail Association President and CEO Renée Sunde, who called the bill “a strong model that other states will use as they establish privacy standards.”

However, Consumer Protection Division Assistant Attorney General Andrea Alegrett said her office recognizes it would be entrusted to “safeguard consumers’ most personal information and data from misuse” under the proposal, but said it must also acknowledge that, as currently written, the bill would limit “our ability to fully enforce the law.” To address the limitation, she requested including language that any violation of SB 6281 would also be considered a violation of Washington’s Consumer Protection Act, under which the office can investigate conduct that is “unfair and deceptive.” This would allow the attorney general’s office “to use all the tools in its toolbox in order to protect consumers,” she said.

Alegrett said the office also supports a private right of action. “We firmly believe that when consumers are given affirmative rights, they are entitled to exercise those rights without having to rely on another entity to do so,” Alegrett said. “Absent a private right of action there will be violation of consumers’ privacy that go unaddressed.”  

Washington Technology Industry Association CEO Michael Schutzler said the attorney general is the “appropriate mechanism for ensuring consumer rights are honored. ... This bill demands new strict performance and reporting compliance by Washington companies and our state (attorney general’s) office is an excellent enforcer on those factors."

However, Indivisible Whidbey's Larry Behrendt argued a data privacy law “is useless” if it sets standards but limits private citizens and citizens groups “from the ability to enforce their rights.” Seattle University law student and Black Lives Matter Seattle board member Livio De La Cruz agreed, arguing for a private right of action that would give consumers “power.”

In addition to a private right of action, some stakeholders expressed concern about preemption, particularly in terms of regulating law enforcement's use of facial recognition.

Jon Pincus, a technologist and entrepreneur representing Indivisible Plus: Washington State, said states and communities across the country are regulating law enforcement’s use of facial recognition. As written, he said SB 6281 would restrict such regulation from happening in Washington.

“That’s only one of the problems of this bad bill,” he said, adding citizens of Washington and beyond want strong privacy legislation with meaningful protections. “This bill in its current form, or as amended with half-hearted compromises that don’t really protect us, it’s worse than no bill at all,” Pincus said.

Representatives of the retail, advertising, technology and medical fields, however, expressed support for the proposal. Advanced Medical Technology Association Senior Director of State & Regional Government Affairs Fielding Greaves called the proposal “the best model we’ve seen anywhere in the United States.”

Sunde, of the Washington Retail Association, said consumer data privacy is a top priority among members, and the proposal “offers a balanced approach to protecting the rights of consumers while supporting innovation for businesses of Washington state.”

“We are home to technology and innovation, and retailers are equally fiercely committed to protecting the consumers’ ability to use technology, and they have come to rely on that and expect it. This bill protects the rights of citizens to utilize that technology and establishes a framework using best practices as we navigate the evolution,” she said.

The bill’s sponsor, Washington Sen. Reuven Carlyle, D-Seattle, said “meaningful improvements” have made the proposal stronger, clearer and more direct. He expressed hope the House Committee would “find it a good balance” that pairs the best practices of the EU General Data Protection Regulation and California Consumer Privacy Act with Washington’s “strong constitutional protections” and leadership in technology innovation.

“Ultimately, we’re at an important time. I think we all know that you can look at the front page of every newspaper in the world and see a dramatic desire for meaningful improvements in consumer data protection,” he said.

If passed, the legislation would go into effect July 31, 2021.

The Innovation, Technology & Economic Development Committee is expected to discuss the proposal in executive session Feb. 25, 26 and 28.

Photo by Zhifei Zhou on Unsplash