Washington State House Members Don't Yet Embrace Senate Privacy Bill

Senate sponsor Reuven Carlyle (D) estimated “about 95 percent agreement in principle on the core elements of the bill," at a Jan. 13 news conference. A news release followed with the headline, “Tentative agreement announced on consumer data privacy, facial recognition bills.”

“Calling it a ‘tentative agreement’ is a bit optimistic,” Hudgins emailed us Jan. 14. He stressed the second part of Carlyle’s quote -- that the agreement is “in principle" on "core elements.” His committee plans a Wednesday hearing on what a comprehensive privacy bill should look like. The House wants “a bill that works for consumers and businesses and is responsive and respective of all communities that are impacted by technology such as facial recognition,” said Hudgins. “We continue to be hopeful that our work will progress towards each other’s positions -- which while getting closer, are not yet in full agreement.”

Carlyle’s estimate of consensus isn’t “an accurate reflection of the House,” said Smith in an interview. “There’s more agreement on principle than there is on content.” The bill “is very corporate-centric” and lacks meaningful enforcement, she said. “It gives rights and then it has the longest list of exceptions I’ve ever seen in a data privacy bill.” While saying the plan improved from last year, Smith asked: “How is any average person supposed to sort out what the Senate bill means for him or her?”

Smith introduced privacy legislation “that people can understand,” she said, and her committee plans to hear testimony on it Tuesday. HB-2364 is five pages compared with 24 in the Senate bill, includes “strong accountability” and clear language about consumer rights and corporate responsibility, she said.

The House is holding hearings on other privacy bills that “address specific and discrete issues that we feel need a policy discussion,” Hudgins said. The bills by Smith and/or Hudgins address bots (HB-2396), biometrics (HB-2363), data collection by voice recognition devices (HB-2399), privacy stickers on devices (HB-2365), annual privacy reviews of state agencies (HB-2400), employer usage of artificial intelligence (HB-2401), and making the state chief privacy officer an elected position (HB-2366).

Bipartisan agreement on privacy is possible, said Smith, who was a GOP co-sponsor of the state’s net neutrality law. “We all want true privacy protections and rights that are clearly stated ... for the people that we represent.” Marginalized communities are most at risk, she said. Slicing, dicing and monetizing of personal data is “so unsettling, and that anxiety is growing and growing.”

The Senate Environment and Technology Committee plans an executive session Thursday on its privacy bill and related facial recognition bill (SB-6280). At a Wednesday hearing, Microsoft supported the proposal. The Washington state attorney general and American Civil Liberties Union raised concerns about facial recognition and no private right of action (see 2001150050). Carlyle didn’t comment Friday on House members' concerns.

House Concerns

House members described several areas that need work in the Senate bill. Hudgins remains concerned about enforcement and the definition of “sale,” he said. Smith objected to a provision exempting a company’s ability to do “internal research to improve, repair, or develop products, services, or technology.” The ranking Republican asked if that means a business can honor consumers’ requests in a “front-facing way” but hold their data “into perpetuity.”

The Senate bill “denies meaningful access to justice” without a private right of action, said Smith. The legislation instead leaves enforcement to the state AG. Washingtonians can sue now under the state’s Consumer Protection Act, so SB-6281 would effectively carve out privacy complaints about large global corporations, she warned. “We absolutely have to listen to the experts that are telling us repeatedly that” a private right of action “is what makes a data privacy bill meaningful, and if there’s some middle ground, let’s hear from them.”

One possible compromise is to include a more limited private right of action and give more resources to the AG for enforcement, said Future of Privacy Forum's Gray in a Thursday interview. To avoid many suits based on minor infractions, legislators could craft the private right in a way that limits who can sue and what remedies are available, she said. Another option would be to legally require the enforcer to resolve all complaints filed by consumers, she said.

Washington’s bill appears set to become the second model for an American privacy law, said Gray. Other states will likely base bills on the California Consumer Privacy Act or Washington’s law, she said: Keep an eye on New York state this year for a possible third model.

Carlyle's bill is stronger than the CCPA, while including similar protections, said Gray. Global companies may find it easier to comply with the Washington bill than CCPA because language more closely mirrors EU’s general data protection regulation, while U.S. companies will appreciate some definitions mirroring FTC policies, she said.

This year’s Senate bill is better drafted than the 2019 version, Gray said. Disagreement over facial recognition was a big reason the bill previously failed, said Gray. The Senate's decision to spin off government and law enforcement usage of facial recognition to a separate bill may help ease passage of the main privacy bill, she said. ACLU makes a fair point about wanting fuller discussion with communities before allowing facial recognition, but such concern may be a bigger obstacle for allowing government usage, said Gray.