Washington state’s privacy act faces moment of truth

A hearing this week in the Washington state House of Representatives will determine if the state legislature will go forward with a bill that would give the state sweeping new data-privacy rules. Members on Friday will take up the Washington Privacy Act, which passed out of the state Senate last week and, if enacted, would give the state’s 7.5 million residents digital privacy protections on par with those recently imposed in California.

The Senate bill’s sponsor, Democrat Reuven Carlyle, said the legislation borrows concepts from the California Consumer Protection Act, which went into effect last month — as well as similar laws in other states — but goes further in the protections it provides. Carlyle’s bill would give Washington residents the ability to uncover and then request deletion or transfer of the data held about them by private institutions. It would also allow them to opt out of targeted ads and data sales and place new regulations on companies implementing public-facing facial recognition systems.

Carlyle’s previous attempt to pass a statewide privacy bill last year failed, but he told reporters last month that after a series of meetings with large Washington-based companies, including Amazon and Microsoft, he’d found “overwhelming consensus” on the new legislation.

Washington State Chief Privacy Officer Katy Ruckle told StateScoop her office supports the bill.

“I think it takes an important step forward for making meaningful privacy legislation in the state of Washington and it provides several rights to consumers that are not currently available to Washington residents concerning their information held by private companies,” Ruckle said.

But passage will again depend on the House lawmakers, who have already begun raising concerns. The Seattle Times reported that Republican Rep. Norma Smith criticized the bill for being too “corporate-centric,” noting that Carlyle’s bill would only allow the state attorney general’s office, but not individual residents, to sue companies for violations.

The Senate version of the bill would apply to companies doing business in Washington that process the data of at least 100,000 people, or that receive at least half their revenue from the sale of personal data and process information of at least 25,000 people. A collection of smaller companies staying under these limits might avoid enforcement.

Ruckle said it’s not yet clear whether these and other issues will be enough to stop the legislation, but that she thinks it’s time for the state to pass it and set a new standard.

“I feel like it provides clear guidance to businesses in terms of expectations for how we expect them to handle consumer data so my hope is that it will start to become standard practice in terms of data handling by businesses instead of new concepts,” Ruckle said.