By a vote of 46-1, the state Senate passed the Washington Privacy Act (WPA), which would provide consumers in the state with the right to learn what data is collected about them and whether the information is sold to outside companies.
Under Senate Bill 5376—which has been compared to both the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA)—consumers could prevent their personal data from being used for ad targeting based on data collected across nonaffiliated sites and services.
Companies would be required to provide a “clear and meaningful” privacy notice and undergo risk assessments to determine whether consumer privacy rights are placed at risk by their data collection procedures. Consumers would also have the ability to correct inaccurate data and, in some instances, delete it, along with the right to withdraw previous consent for the use of personal data.
“We have an expectation and a right to privacy in the public square, as well as our homes,” legislation sponsor Reuven Carlyle (D-Seattle) told fellow lawmakers in a Senate floor speech before the vote, analogizing the measure to a credit report. “Think about your credit report, where you can check in and understand who’s been accessing it, and why, and to make corrections.”
Companies would also be required to obtain consent before deploying facial recognition technology in public (such as in retail stores) pursuant to the bill.
Unlike the current proposed amendment to the CCPA, the WPA does not create a private right of action. Instead, the state’s attorney general would have the right to bring an action in the name of affected residents and levy a $2,500 civil penalty per violation, increased to $7,500 for intentional violations. The bill contains a 30-day period permitting companies to cure any violations.
If approved, the law would take effect July 31, 2021.
To read SB 5376, click here.
Why it matters: If the legislature moves the bill forward, Washington could join California in the regulation of consumer privacy, with other states not far behind. Similar legislation is pending in Hawaii, Maryland, Massachusetts, New Mexico and Rhode Island. Unless federal lawmakers step in, companies may be looking at a patchwork of state privacy regulation. As the bill works its way through the state’s House of Representatives, the ad industry is pushing back. “The Association of National Advertisers (ANA) is working very diligently to try to create a uniform approach,” ANA Executive Vice President Dan Jaffe told MediaPost. “When you’re dealing with an international, digital communication system, regulating it state by state—so that your privacy rights vary as you cross the border—just doesn’t make any sense.”