Legislature should strengthen digital consumer data protections

Washington state, home of the world’s most valuable tech companies, should be a leader in consumer privacy protection.

A good start is the Washington Privacy Act, the most ambitious of several privacy proposals in the Legislature. It would give residents more control over their personal information gathered and monetized by companies. If passed, the state would join California in adopting stronger consumer-data protections, benefiting residents and increasing pressure on the federal government to adopt more consumer-friendly regulations along the lines of those in the European Union.

Facebook in particular has demonstrated that government must give people more tools and authority to control how marketers use their personal information.

Congress is also considering such proposals, but it remains to be seen whether it will build on state efforts or weaken them, via pre-emption. This should really be just the start of a larger federal effort to rein in digital giants with overly concentrated power over our digital lives and too little oversight.

The privacy act — Senate Bill 5376, introduced by state Sen. Reuven Carlyle, D-Seattle — would empower consumers by giving them rights to view what’s being collected, correct inaccuracies and request that it not be used for direct marketing. It would also require companies handling significant amounts of consumer data to be more transparent, with privacy notices disclosing what consumer data is gathered and how it is used.

This is similar to policies providing access to electronic health records and credit information. Although not perfect, they enable people to view their files, correct errors and limit sharing.

Also included are new rules for companies and governments using facial-recognition technology to profile people. It would prevent government from surveillance of individuals in public spaces unless there’s a court order or an emergency. Companies would have to obtain consent for using facial-recognition services, although the bill’s mechanism for obtaining consent is weak — companies would only have to post a sign on their building or website.

Alex Alben, the state’s chief privacy officer, acknowledged it’s a first try at curbing the effects of facial-recognition technology. The bill also directs his office to study public-sector use and report back in 2023.

“This is really an initial effort to put a speed bump on the use of the technology,” he said.

Consumer-data protection measures also need periodic review to see if they work as intended. One area to watch is how companies take advantage of an exemption in SB 5376 allowing them to continue using personal data, over a consumer’s objection, if the company “can demonstrate a compelling legitimate ground to process such personal data.”

Digital marketing is an inescapable part of modern life, and personal information is currency. It is past time for government to ensure that companies are more transparent about this activity and that people have more control over how their information is used.