The 21st century has been kind to the companies that collect and profit off people’s personal digital data.

From information on the use of web browsers, to people’s location, to personal details entered into websites, corporations have remained largely unregulated in the United States to collect and use that data how they see fit.

“This is an issue that the public good requires us to engage in,” said Sen. Reuven Carlyle, D-Seattle. “This is not an existential, down-the-hall, academic issue.”

For a third year in a row, Carlyle is attempting to counter that by crafting some of the strongest data-privacy laws in America.

But as in previous years, some legislators — along with groups like the ACLU of Washington — have called it “corporate-centric” and don’t think his proposals go far enough to secure privacy.

It’s a rare debate in Olympia that splits less by political party, and more by House and Senate lawmakers. Last year, Carlyle’s proposal passed out of the Senate 46-to-1, before stalling in the House during negotiations there.


Carlyle’s new proposal, Senate Bill 5062, would provide state residents with rights to determine what type of data is being collected by companies and to be able to review that data. People would be allowed the ability to correct or delete that data. Among other things, it would require companies to let people opt out of the processing of their information for a specific purpose.

Lawmakers on the Senate Environment, Energy and Technology Committee voted Thursday to advance SB 5062.

The legislation would apply to entities conducting business in Washington that control or process the data of at least 100,000 people, according to a legislative analysis of the bill. The regulations would also apply to businesses getting 25% or more of their gross revenue from the sale of personal data, and that process or control information on 25,000 or more customers.

Violations of the law would be enforced solely by the state Attorney General’s Office under Washington’s Consumer Protection Act.

The proposal has the support of some technology companies — including Microsoft and Amazon — as well as the Washington Technology Industry Association.

In a public committee hearing last week on the bill, Jennifer Lee of the ACLU of Washington called the proposal “corporate-centric.”


“This bill only provides an illusion of privacy protections, but not real privacy,” Lee told lawmakers in the hearing.

Lee pointed to the lack of a right for attorneys to bring legal action against potential violators. That has also been a sticking point with some House lawmakers — and with Attorney General Bob Ferguson, whose office would enforce Carlyle’s regulations.

Ferguson’s office had expressed concerns that the language in previous proposals made it difficult to enforce, but Carlyle said changes in his new version have eased some of those concerns. A representative for the Attorney General’s Office in Thursday’s hearing said Ferguson still preferred rights for attorneys to pursue actions, but the new changes were “encouraging.”

The ACLU of Washington has joined several other community groups and civil liberties organizations in the Tech Equity Coalition, which touts its efforts to stop Carlyle’s legislation. They will look instead to a House proposal being sponsored by Rep. Shelley Kloba, D-Kirkland.

In an interview, Kloba said her bill, which hasn’t yet been introduced, will allow attorneys to pursue legal actions against potential violators.

And instead of asking consumers to opt out if they don’t want their data used, Kloba said her legislation will have an opt-in provision.


“It’s privacy by design,” said Kloba, who also sponsored last year’s House version. “So a company cannot use your data unless they have a specific, freely given authorization … to use that data.”

But Carlyle has called his bill “a dramatic step forward” given that there are basically no regulations right now.

“I want it to have operational integrity for organizations that actually have to implement it,” said Carlyle. “And I want to create rights that simply don’t exist today.”