If enacted, the Washington Privacy Act, currently being considered in the state Legislature, would be the strongest, most comprehensive privacy law in the country. It would give Washington residents new rights and new protections they do not currently have under either state or federal law.
Washington residents have said they want these protections. In a Crosscut/Elway poll completed before the legislative session, 84% of Washington respondents supported “strengthening consumer protections for personal data online.” Data privacy ranked higher than carbon emissions and rent control as issues for the Legislature to address.
The Washington Privacy Act represents a thoughtful and balanced approach that dramatically increases consumer protections and rights, while allowing responsible businesses to use data in ways that benefit consumers and the public.
It would give consumers the right to access, correct or delete personal data that has been collected about them. Companies would have to obtain the consent of consumers for the collection or use of sensitive data and for any use of personal data unrelated to the purpose for which it was collected. And consumers would have new opt-out rights for other uses of personal data. It would require companies to be more transparent with consumers and to meet a rigorous set of duties to protect and safeguard the personal data they hold. And it would create a new set of stringent rules around the use of facial recognition that requires individual consent in most cases.
That is why a wide range of experts and advocates, from both civil society and industry, have praised its provisions. That includes the Future of Privacy Forum, the Business Software Alliance, the Washington Retail Association, the Center for Democracy and Technology, Washington state’s chief privacy officer, Katy Ruckle, and others.
And that is why the bill has enjoyed broad, bipartisan support and passed the Senate 46 to 1. However, certain amendments added in the House threaten to disrupt the balance reflected in this bipartisan bill and threaten to kill the entire effort.
The Senate bill appropriately vests enforcement authority in the state Attorney General, empowering it to hold accountable those companies that violate these new rights and protections. It gives the Attorney General new resources for enforcement and provides for large civil penalties against companies that violate the law. This approach would sensibly allow the Attorney General to provide clear guidance to companies that are trying to comply with a new and complex regulatory regime, while thoughtfully focusing its enforcement activities on the truly bad actors who cause actual harm to Washington consumers.
In contrast, the House amendments would create a new private right of action, exposing companies to class-action lawsuits and defend against gotcha lawsuits for technical violations that will only benefit trial lawyers, not consumers. That in turn will force companies to divert resources and attention from the compliance work that the act intends to encourage, and instead prioritize only those visible, technical compliance measures that are easy for trial lawyers to prove. Plus, for the worst privacy violations — those that would be considered unfair or deceptive business practices — consumers already have a private right of action under the existing Consumer Protection Act, and nothing in this new legislation will take that away.
The majority of businesses in Washington state have come to recognize that as the ability to collect and analyze data for beneficial and valuable purposes becomes more powerful, maintaining the trust of consumers is essential. These Washington businesses also understand that ensuring strong legal protections for consumers is a key part of maintaining that trust. That is why a growing coalition of businesses and other interests is urging the Legislature to enact the bill as passed by the Senate.
The Washington Legislature has the opportunity to pass a landmark data privacy bill. Let’s hope it seizes the opportunity.