Wash. House Adds Limited Right to Sue to Senate Privacy Bill

The Washington House broke with the Senate again on enforcement issues that stymied past state privacy legislation. Before voting 11-6 at a livestreamed meeting to clear SB-5062, the House Civil Rights & Judiciary Committee adopted by voice an amendment by Chair Drew Hansen (D) that included adding a private right of action and sunsetting a right-to-cure provision after one year. Municipal broadband and 988 bills advanced in later meetings Friday.

Hansen’s privacy amendment would limit a private suit’s remedies to injunctive relief and attorney fees of the winning plaintiff. After the right to cure expires, a court weighing a civil penalty would be required to consider a company’s good-faith efforts to cure as a mitigating factor. Other Hansen-proposed changes included adding a definition for minors, exempting nonprofits and letting consumers opt out through a designated agent or user-enabled global privacy controls, like a browser setting.

"This bill is reasonable and moves us forward,” said Hansen, noting Consumer Reports (CR) and Common Sense Media supported the amendment. Definitional changes align the bill with California’s privacy law, he told the committee. “Not keen” on California’s law, ranking member Jim Walsh (R) opposed the measure, saying it could “open the floodgates for legal actions but not effectively guarantee or improve any Washingtonian’s digital privacy.” All six committee Republicans voted no, while all Democrats said aye. SB-5062 next needs a full House vote.

“The striker improves the bill, but there is more work to do to correct the fundamental asymmetry of power between a consumer and those who collect and profit off of their data,” said Rep. Shelley Kloba (D) in a statement to us. Kloba’s opt-in-focused privacy bill failed to get a vote in the House despite American Civil Liberties Union support (see 2103090008). Kloba supports adding a private right of action. Limiting “the remedy to attorney fees and requiring the company to start obeying the law is cold comfort when the consumer’s data has already been disclosed or decisions have been made using incorrect data,” she said. Kloba supported addressing minors and sunsetting the right to cure.

The House panel strengthened the bill’s privacy protections, said Justin Brookman, CR director-consumer privacy and technology policy. “We urge legislators to advance the bill.” The group wrote Hansen a supportive letter.

The state attorney general's office requested the right-to-cure and private-right changes at a March 17 hearing. Phasing out right to cure after one year is a "vital change" needed in SB-5062, said Legislative Director Yasmin Trudeau. Giving companies time to respond to complaints to avoid penalties makes sense as part of a transition to compliance, and it would constrain the AG office's resources if allowed to go into perpetuity, she said.

AG enforcement is enough, SB-5062 sponsor Sen. Reuven Carlyle (D) told the committee. Despite "a lot of claims and statements," the legislation as passed by the Senate would give Washington state the nation's strongest privacy law, he said. It's stronger than California's because it requires opt-in for sensitive data and because, on request, companies would have to delete all data about a customer even if it wasn't directly obtained from the customer, he said. Carlyle didn’t answer our questions.

Before House changes, the bill had support from industry including Microsoft, TechNet and the Washington Technology Industry Association (WTIA). Carlyle's bill is stronger than Virginia and California laws, they said at the March 17 hearing. TechNet and WTIA didn’t comment now. Microsoft declined comment.

Other Votes

Other would-be laws also were taken up.

At the House Community Development Committee meeting, Chair Cindy Ryu (D) said she wasn’t “trying to hijack” the Senate’s muni broadband bill by amending it in her committee. Before the panel voted 7-6 to clear SB-5383, Ryu hoped lawmakers can harmonize the bill with the House-passed HB-1336. A Senate committee Thursday somewhat reluctantly cleared the House bill that gives local governments greater freedom to sell broadband (see 2103250068). The two bills will next be up for floor votes.

Unserved areas are defined as those with less than 100 Mbps download and 20 Mbps upload, under the committee-adopted amendment. That’s up from 25/3 Mbps in the underlying bill. The revised draft would allow a public utility district (PUD) to sell wholesale service in adjoining counties. It would remove from SB-5383 a proposed challenge process for existing providers to object to a PUD or port telecom project in unserved areas.

A bill on the coming national 988 suicide prevention hotline easily cleared the Senate Behavioral Health Subcommittee with an amendment revising several implementation details. Four members voted yes. Ranking member Keith Wagoner (R) voted “without recommendation” because, while supportive, he sought more time to digest the amendment. The House-passed bill (HB-1477) advanced to the Senate Ways and Means Committee.

Common Sense sees “significant improvement” in the amended privacy bill, said Director-State Advocacy Joseph Jerome, highlighting new language on minors and opt-out operationalization. The limited private right of action looks like a “decent compromise,” he told us. Jerome thinks the “odds are better than zero” the state can pass a bill this year.

“The bill remains fundamentally flawed, with an opt-out model, loopholes and exemptions, a preemption provision, and a weak enforcement mechanism that does not meaningfully empower people to hold companies accountable,” emailed Jennifer Lee, ACLU-Washington technology and liberty project manager. While individuals could sue, they “would not be compensated for any harms done, and would have to expend significant attorneys’ fees with a substantial risk of not getting all of those fees back even if they win,” she said. Lee praised some changes, such as “including pseudonymous data in the definition of personal information and modifying the right to access categories of information to all information.”