For the third straight year, the Washington State Legislature missed an opportunity to pass a multi-rights general data privacy bill before it adjourned Sunday. The failure illustrates the difficulty of passing broad privacy legislation in an environment where both business and privacy and trial lawyer groups are well organized and influential and disagree about key issues.
Sponsor State Sen. Reuven Carlyle, D-Wash., introduced Senate Bill 5062, the Washington Privacy Act, early in the session, incorporating several changes advocated for by privacy groups and business groups. The net result was more demanding in several ways (for example, on loyalty programs and service provider obligations) than in a variant of the WPA enacted in Virginia this year. The bill also boosted funding for the attorney general's office to enforce the bill but did not add a private right of action. The WPA passed the Senate by a bipartisan vote of 48 to 1 margin.
However, beginning in the winter of 2020–21, Rep. Shelley Kloba, D-Wash., began to circulate and eventually introduced The People's Privacy Act, a wide-ranging opt-in privacy bill, which was strongly supported by the American Civil Liberties Union of Washington and the plaintiff’s bar. The influence this effort had on many progressive members of the House Democratic Caucus cannot be overstated, as those votes were critically absent when the WPA moved to the House of Representatives.
As in the previous two years, the most difficult issue remained private right of action enforcement. House Speaker Laurie Jinkins made it clear the bill would not be heard on the House floor unless it included a private right of action. For this reason, House Civil Rights and Judiciary Committee Chair Drew Hansen sought to craft a compromise by introducing a comprehensive striking amendment that included an injunctive relief PRA and enforcement under the state's unfair and deceptive acts and practices statute. His striking amendment also included elements from The People's Privacy Act in an effort to garner support from progressive members of his caucus. These additions included:
- Private rights of action under the state's unfair and deceptive acts and practices law and the bill for injunctive relief and prevailing plaintiffs’ attorney fee shifting.
- Right to cure to last only until July 1, 2023, then cure would become a mitigating damages factor after liability is established, allowing lawsuits to go forward.
- Targeted advertising opt-out that to apply to affiliate websites that do not share common branding.
- Requirement to follow a do-not-sell/-track signal, starting July 2023 (after the CPRA rulemaking on the subject).
- Authorized agents could submit rights requests.
- Pseudonymous data to count as “personal data” in all circumstances and deidentified data to require reasonable measures so the data may not be linked or reasonably linkable to a household or device.
- Requirement for simply stated privacy notices.
This effort failed to find sufficient common ground. The majority of business groups raised concerns over private rights of action for injunctive relief and several of the substantive changes above. The bill lacked Republican support. The ACLU and consumer advocate groups stuck to their guns insisting on a stronger private right of action, and progressive Democratic support did not materialize.
Even after the state bill cut-off deadline came and went, Hansen and Carlyle continued to negotiate and work to whip votes among members of the House. Carlyle, who had previously rejected the 2019 and 2020 House versions of the bill because they contained a private right of action, urged business groups to consider injunctive relief as a viable option to pass a bill before adjournment.
The Senate version of the WPA may well have obtained enough bipartisan support to pass the House had it been given an opportunity to receive a vote. However, the House speaker foreclosed that option, illustrating one of the major challenges in finding common ground to passing privacy legislation at the state level.
There is a reason for much greater optimism in striking this balance in federal privacy legislation, but privacy advocates and plaintiffs’ lawyers have yet to prevail on this issue at the state level.
Photo by Charles Lenhart on Unsplash
