Revamped Wash. Privacy Bill Slammed at Senate Hearing

A new-look Washington state Senate privacy bill took fire from all sides at its first hearing Thursday. Business groups at a Senate Technology Committee virtual hearing said they prefer the 2021 Washington Privacy Act (SB-5062) by Chairman Reuven Carlyle (D) to his pared-down SB-5813 this year. The American Civil Liberties Union, a SB-5062 opponent, said SB-5813 is better but still wouldn’t meaningfully protect privacy. Two state government offices also raised concerns.

SB-5813’s purpose is to “make the point that getting to yes is extremely complex, and the fact that this chamber has passed legislation three years in a row … is a reflection of the value of a comprehensive approach that did have a degree of consensus,” said Carlyle after about 20 witnesses testified. SB-5062, which last year hit a roadblock in the House, was reintroduced this year, but no hearing has been scheduled. Carlyle said he remains committed to that bill.

Carlyle's 2022 bill would be limited to making rules for children, data brokers and a do-not-track mechanism. It would allow civil actions for violations of the right to access, delete or correct personal data, with limits on remedies. Other than such violations, the state attorney general would enforce the bill under the Washington Consumer Protection Act. The bill would give businesses a 30-day cure period.

Google, Microsoft, TechNet and other business stakeholders raised concerns with SB-5813, including a limited private right of action. The bill has important protections for children and teenagers but should be harmonized with other state laws, said Microsoft Government Affairs Director Irene Plenefisch. Washington Technology Industry Association Vice President-Public Policy Molly Jones said “even in this limited form … businesses could be subject to significant numbers of nuisance lawsuits that do not result in meaningful protections for consumers.”

“SB-5813 does not meet the minimum standards to be considered a strong data privacy bill,” said Jennifer Lee, ACLU-Washington technology and liberty project manager. Consumer Reports likes that the bill includes a private right of action and the group largely supports the do-not-track section but recommends edits including to expand the definition of sale, said Senior Policy Analyst Maureen Mahoney.

Not aligning with other states makes SB-5813 especially tough to implement, said David Edmonson, TechNet vice president-state policy. The definitions depart from Carlyle’s previous proposal and Virginia and Colorado laws, said State Privacy and Security Coalition counsel Anton van Seventer of DLA Piper: They’re more like “out of date and confusing” California definitions. “The opt-in framework for data brokers is simply unworkable." The Software and Information Industry Association has concerns with the definition of personal data including publicly available information and inferences drawn from such data, said SIIA General Counsel Chris Mohr.

The right to cure "turns our office into outside counsel for industry,” said Andrea Alegrett, Washington assistant attorney general-Consumer Protection Division. The AG office would support a cure right that sunsets after one year, she said. Washington State Secretary Steve Hobbs (D) “fear[s] the fiscal impacts of proper implementation may be much higher than the sponsors envision,” said Legislative Director Brian Hatfield.

Prior years’ Washington Senate privacy bills met resistance in the House, where lawmakers favored including a private right of action. The House Judiciary Committee scheduled a public hearing Tuesday and markup Friday of HB-1850 by Rep. Vandana Slatter (R). No hearing is scheduled on the ACLU-supported HB-1433 by Rep. Shelley Kloba (D). Another House committee cleared a minors’ privacy bill Wednesday (see 2201190049).

Other states' lawmakers will soon mull comprehensive privacy bills. The Indiana Senate Commerce Committee postponed until Jan. 27 a hearing on SB-358 originally scheduled Thursday. Alaska’s House Commerce Committee plans a Friday hearing on HB-159. In Maryland, SB-11 is up for hearing Wednesday in the Senate Finance Committee. More than 15 states have privacy bills this year (see 2201120021).