Tech industry backs latest Washington state privacy bill; debate over enforcement continues

The tech industry expressed strong support for Washington state's latest consumer privacy bill during a public hearing today before members of the state House, where previous iterations of the proposal have died.

Opponents conceded that the latest version of the Washington Privacy Act has added protections for consumers. But it is still too business-friendly and riddled with loopholes, so the tech industry’s strong support isn't surprising, privacy groups such as the American Civil Liberties Union testified.

The Washington House Committee on Civil Rights and Judiciary is scheduled to vote Friday on whether to send the proposal to the full House for consideration.

This is Washington state lawmakers’ third attempt at passing a privacy law giving consumers the right to access, transfer, correct and delete the online data companies collect about them. Consumers can also opt out of targeted advertising and the sale of their personal data under the legislation.

The latest proposal is modeled after both the European Union’s General Data Protection Regulation and the California Consumer Privacy Act of 2018, but it goes even further, said the bill’s sponsor, Reuven Carlyle, a Democrat from Seattle.

“These rights are substantial, and they are real, and none of them exist today,” Carlyle said.

For example, the latest proposal would require opt-in consent for the use of any sensitive data, such as gender, age and immigration status, an “unprecedented” right that “doesn’t exist elsewhere,” he said.

Unlike the CCPA, the latest WPA would also require companies to delete all the data they possess about a consumer, no matter where they got it, he said. “That’s the strongest in the nation,” Carlyle said.

Previous versions of the bill have been waylaid by debates over enforcement.

Last March, House members tried to amend Carlyle’s second version of the WPA to give residents the right to sue alleged violators under the law. But Carlyle refused to accept the change, and lawmakers couldn’t reach a compromise.

The first proposed WPA died in April 2019 after failing to receive a vote in the House before a legislative deadline.

It's already clear that debates over adding a private right of action will continue this year. The latest version of the WPA is “the most well-worked and well-negotiated privacy bill in the country,” and there’s no need for a private right of action, said Samantha Kersul, an executive director with TechNet, a trade group that represents tech companies.

Virginia lawmakers just passed a similar consumer privacy bill that doesn’t have a private right of action, she said.

The latest WPA would be even stronger than Virginia’s privacy law and would be the “leading privacy law in the country,” said Molly Jones, vice president of government affairs with the Washington Technology Industry Association.

Ryan Harkins, Microsoft’s senior director of public policy, agreed the latest WPA would be stronger than Virginia’s privacy law and the CCPA, “and to be clear, we support California’s privacy law” he said.

Passing the WPA would be the beginning, not the end, of the privacy conversation in Washington state, Harkins said.

But privacy groups such as the ACLU of Washington argued there are too many exemptions that weaken the proposal and would limit how effectively people could exercise their rights. Consent should be opt in, they argued, not opt out.

Asking for consent before any data is collected “is a bare minimum,” said Jennifer Lee, who manages the ACLU’s Technology and Liberty Project.

The ACLU and the Washington attorney general also continued to press for the inclusion of a private right of action. The bill’s enforcement tools need to be strengthened, and that means giving consumers the right to sue under the law, said Yasmine Trudeau, legislative director with the Washington attorney general’s office.

“We believe everyone should have access to the courts to enforce their rights, including privacy rights,” she said.