Interview guests: Senator Reuven Carlyle (D-Seattle) and Rep. Shelley Kloba (D-Kirkland)
This week on “The Impact”:
Senator Reuven Carlyle (D-Seattle), sponsor of the “Washington Privacy Act”, joins us to talk about Senate Bill 5062, the third version of his high profile data privacy bill meant to give state residents more control over the personal information companies collect, store, and sell.
“If you’ve requested to opt out, if you want your data corrected, they cannot use your individual, personalized, identifiable data,” said Carlyle. “If you’re tired of your phone listening, if you’re tired of ads showing up, this bill gives you new rights that do not exist today. It’s a dramatic and substantial move forward.”
“We’ve never lived in a time when privacy mattered more,” said Carlyle.
The previous versions of the bill passed the Senate in 2019 and 2020, but either stalled in the House or were so heavily amended that the Senate would not agree to the changes.
Carlyle says modifications to the bill have helped overcome some of the earlier opposition. Those changes include making the law more enforceable for the state attorney general and creating new safeguards for data collected during contact tracing efforts. The bill has support from Microsoft, the Washington Technology Industry Association and some of the critics of earlier versions have warmed to the latest version at least enough to be neutral, according to Carlyle. Consumer Reports, which opposed previous drafts, has recommended some changes to the 2021 Washington Privacy Act, but in a statement CR also praised parts of the bill for creating data rights that currently don’t exist for state residents.
“Every aspect of life is touched by our personal data,” said Carlyle. “…it really matters and in effect we have almost no meaningful regulatory structure. We have virtually nothing at the state level.”
Second Substitute Senate Bill 5062 sailed through the Senate Ways and Means Committee with overwhelming bipartisan support this year.
2SSB 5062 (Carlyle) – “Washington Privacy Act”
- Would give WA residents rights of access, correction, deletion, transfer and opt-out of personal data processing for specified purposes
- Applies to businesses that collect or process the personal data of 100,000 WA residents per year or derives at least 25% of gross revenue from data of 25,000 or more WA residents (Does not apply to state or local governments, the judicial branch, air carriers or data held for employment purposes)
- Sets transparency, and data minimization responsibilities for companies
- Requires controllers to conduct data protection assessments under certain
conditions - Establishes up to $7,500 penalty for each violation
- Gives sole enforcement power to Washington Attorney General
- Regulates the processing of certain contact tracing data.
A couple of points of friction that may remain are the opt-out approach that requires consumers to take an active role avoiding unwanted data collection by companies and the lack of a private right of action. The latter means individuals would not be allowed to file lawsuits for violations of the privacy law. The bill reserves all enforcement power for the state attorney general to sue on behalf of state residents.
The ACLU of Washington has been one of the most vocal critics of the 2021 “Washington Privacy Act” bill as well as earlier versions.
Our other interview guest is Rep. Shelley Kloba (D-Kirkland), sponsor of House Bill 1433, the ACLU backed bill titled the “People’s Privacy Act” which would take a more restrictive approach to data collection by requiring clear opt-in consent from state residents.
“The asymmetry of power and who controls that data is something that is really important to me,” said Kloba.
“Instead of saying that all of your data is out there and companies can use it in the specified ways that they might say in their privacy policy, unless you tell them not to- so that’s an opt-out right, that is one of the proposals- I take the view that says none of those things should be available to companies unless they have your express, specific, unambiguous, freely given permission.”
Her bill would also allow individuals to sue companies over data privacy violations as opposed to reserving that power for the state attorney general. Unlike Carlyle’s bill , however, HB 1433, did not pass out of a its committee of origin or even get a public hearing before the policy bill cutoff deadline.
“I think that offering the policy ideas in my bill, that gives voice to some of what the other House members are thinking,” said Kloba.
HB 1433 (Kloba) “People’s Privacy Act”
- Would give WA residents the right to access, correct or delete personal data held by companies
- Requires specific, unambiguous opt-in consent
- Requires companies to make privacy policies readily accessible
- Creates up to $10,000 penalty for each violation
- Allows private right of action (individual lawsuits)
- Allows Washington Attorney General to file suit as well
- For biometric data collection it applies to both companies and government entities
Watch the episode here: https://www.tvw.org/watch/?eventID=2021021411