Washington State Privacy Bill Weak on Enforcement, Says AG Office

The state Senate committee took testimony on a revised privacy bill (S-6281) by Chairman Reuven Carlyle (D) that failed last year, and S-6280 by Sen. Joe Nguyen (D) on government and law enforcement use of on facial ID. Carlyle’s bill addresses private sector use of facial recognition. The senators announced the bills Monday.

Carlyle’s bill tasks Washington’s AG with enforcement but doesn’t allow individuals to sue. A private right of action would complement state enforcement, testified Assistant Attorney General-Consumer Protection Andrea Alegrett. “When consumers are given additional affirmative rights, those consumers should be able to enforce those rights without having to rely on other entities to do so.” The AG looks for patterns of illegal company behavior but doesn’t act on a case-by-case basis, she said. Increased penalties and technical edits in S-6281 are improvements from last year’s bill, she said.

“Without the private right of action, it becomes even more imperative that we have clear statutory language that helps enforce against bad actors and bad practices in this area,” Alegrett said. The bill “leaves it completely up to industry to determine what measures and burdens are reasonable when processing consumer data. This creates an obstacle in our enforcement ... because there are no clear standards to present to a court as to whether or not conduct was appropriate based on the benefits to the private sector versus the risk to consumers.” The assistant AG warned not to make exemptions that weaken existing consumer protections under state law. Facial ID continues to raise concerns, including due to “known issues of racial bias,” she added.

Carlyle doesn’t want to “unleash the law firms on every single potential abuse of individual data,” he said at Monday’s streamed news conference. Enforcement allows the state to look for “patterns of abuse on a global scale,” said the senator. He’s open to reassessing the issue after the bill becomes law.

Microsoft sees S-6281 as a “thoughtful approach to what has become an urgent need" to update national privacy law, said Senior Director-Public Policy Ryan Harkins. Nguyen’s bill brings "much-needed regulation” to government use of facial scanning technology, Harkins said. Agreeing it may be less accurate for women, people of color and other marginalized communities, Harkins said Carlyle’s bill will force companies to consider and test for bias.

TechNet gets “the important role states can play in this discussion in lieu of federal action,” testified Executive Director-Washington Samantha Kersul. The group has some concerns but supports the big privacy bill’s “core principles” and enforcement approach, she said. Clarify the rules apply to the controller and don’t include usage by an individual to, for example, correct red eye on a photograph, she said: Don’t require companies have a formal appeals process for rejected data requests, and don’t direct the AG to post information about appeals that may reveal trade secrets.

The Internet Association supports bringing “meaningful protections” to Washingtonians but is still reviewing S-6281, said Rose Feliciano, director-state government affairs, Northwest. The Washington Technology Industry Association supported the measure.

Carlyle’s bill doesn’t “adequately protect consumers’ data privacy and community interests,” said ACLU-Washington Technology & Liberty Project Advocate Jennifer Lee. No private right of action weakens the bill’s enforcement, and ACLU disagrees with the bill pre-empting local governments from passing stronger privacy and facial recognition laws, she said. Facial recognition rules “widely legitimate the use of this racially biased and inaccurate technology without applying meaningful restrictions” and without first asking communities whether the technology is “compatible with our democracy and civil liberties.” Lee made similar objections to Nguyen’s facial recognition bill.

ACLU’s objections seemed to irritate the bills’ sponsors. That “you haven’t chosen to engage in the entire legislative process for a year a half has ... been a little bit frustrating,” said Carlyle. Nguyen said he’s “trying super hard” and met with ACLU dozens of time over the last year. “Does that count as input from communities?” On racial bias concerns, the senator noted he’s an immigrant and “person of color.” Lee replied, “I appreciate that you’re a person of color -- as am I -- but I think that people lie on different places of the power spectrum.”

This year’s privacy bill includes clearer consumer rights, but work remains to close possible loopholes, and the state shouldn’t pre-empt stronger local rules, said Consumer Reports Director-Consumer Privacy and Technology Policy Justin Brookman. Companies “go to a lot of extremes” to dodge rules, he said.

Law enforcement opposes Nguyen’s bill, but “we can get there,” said Washington Association of Sheriffs and Police Chiefs Policy Director James McMahan. Transparency is important, but policymakers should take care not to deter law enforcement from using what may be a beneficial technology. People don’t have a reasonable expectation of privacy in public spaces, he said. McMahan noted he has read studies that don’t show a statistically significant difference in facial recognition accuracy of white versus black men.