Washington state has an opportunity to create a groundbreaking privacy law, placing guardrails around facial-recognition technology and giving consumers control over personal information collected online.
As passed by the Senate, Bill 6281 could be a standout accomplishment of this year’s Legislature. It would increase consumer protection and enable the Attorney General to enforce violations, while providing clear guidelines and responsibilities for companies handling large amounts of personal data.
Unfortunately, key sections of the bill were altered in the House Committee on Innovation, Technology and Economic Development, making the bill unacceptable and less likely to become law.
Washingtonians should have more control over personal data collected by online companies. The bill would ensure they have access to this data and enable them to correct inaccurate information, request deletion and opt out of targeted advertising and other monetization of their data.
Providers of facial-recognition technology would be required to open their services up for third parties to evaluate accuracy and identify whether they unfairly treat different populations. If unfairness is established, the bill requires providers to mitigate the problem.
The bill also requires public notice when facial-recognition technology is being used. It prohibits sharing of such data with law enforcement unless consumer consent is provided or disclosure is required by a court warrant, needed for an emergency response or to the National Center for Missing and Exploited Children.
The House changes to the bill severely undermined a compromise, reached over two years of negotiations with the business community, to balance the need for privacy safeguards and consumer rights with a predictable regulatory and business climate for innovation.
Under the original Senate version, the state AG was given authority to enforce the law on behalf of Washington residents. The House version allows private parties to enforce the law, potentially creating a flood of litigation.
This is a particular concern for smaller companies that don’t have resources to litigate hundreds or thousands of challenges by individuals. Newspapers such as this one are also concerned that the new law could be weaponized. It could enable organizations to retaliate for stories they don’t like by mustering hundreds of individual lawsuits against a newspaper.
None of these details diminish the importance of protecting consumers with a strong law, and creating high standards for providers of facial-recognition technology. But the version of 6281 passed by the House is worse than no bill at all.
The substitute version of 6281 advanced to the Rules committee. Its cornerstone feature — placing enforcement with the Attorney General — should be restored and affirmed before the bill is finalized.