Why Washington state could finally pass data privacy laws with a bill backed by the tech industry

Washington state will once again try to pass data privacy regulations akin to Europe and California’s laws this year — and the third time could be the charm, according to Reuven Carlyle, the state senator who has sponsored the legislation for three years running.

The Washington Privacy Act grants consumers the right to access, transfer, correct, and delete the data that companies such as Facebook or Google hold on them. Consumers can also opt-out of targeted advertising and the sale of their personal data under the legislation.

The legislation draws on many of the principles in the European Union’s General Data Protection Regulation and the California Consumer Privacy Act that passed in 2018. Companies that are compliant with those regulations shouldn’t have to do much legwork to meet the standards in Washington’s bill, Carlyle said.

“I’ve tried to take the best practices of GDPR and the best practices of the California law and the uniqueness of Washington, and come up with an evidence-based best practices of a bill,” Carlyle noted.

The new rules would apply to companies that either do business in Washington or target services to state residents and meet one or more of these thresholds:

• The company controls or processes data from 100,000 or more consumers a year
• More than 25% of the company’s gross revenue comes from the sale of personal data and that company processes or controls data from 25,000 consumers or more

Government agencies, air carriers, and processors of protected healthcare data are exempt from the regulations.

Carlyle believes that his third-generation bill will succeed where previous attempts have failed due to support from the tech industry and stronger enforcement authority for the attorney general. Public policy representatives from Microsoft and the Washington Technology Industry Association (WTIA) testified in support of the bill during a virtual hearing this month.

“We think that it is a thoughtful approach that would address what has become an urgent need to modernize United States privacy law,” said Ryan Harkins, senior director of public policy at Microsoft.

“Washington is a global technology hub that is home to the world’s largest technology companies and most exciting startups alike,” Molly Jones, VP of government affairs for the WTIA, said during the hearing. “In addition to leading on technology development, we applaud the efforts of the legislature to ensure Washington state leads on privacy regulation as well.”

Amazon pledged its support for the bill in a letter to Carlyle shared with GeekWire.

“We know data privacy issues are complex and greatly impact every sector of the economy,” Amazon VP of Public Policy Brian Huseman wrote in the letter. “Although we have long supported a federal approach to privacy, we appreciate the critical work underway at the state level and are grateful for the opportunity to work with policymakers in our home state of Washington on these important issues.”

Washington state has come close to passing online privacy rules before, with legislation stalling out at the last minute. But the sticking point that derailed the legislation in the past hasn’t entirely been resolved in the latest bill.

In past years, critics accused the bill of lacking teeth because it does not allow individual consumers to sue tech companies for violating their data privacy rights. That ability to sue as an individual consumer, known as the private right of action, is not in the latest iteration of the bill. As in previous versions, the right to sue over violations of the law lies with the state attorney general.

The new bill does beef up the attorney general’s enforcement authority but that isn’t enough to sway the legislation’s staunchest opponents, including the ACLU.

“This bill only provides an illusion of privacy protections but not real privacy,” Jennifer Lee, technology and liberty manager at ACLU of Washington, during the hearing.

Lee said the bill lacks a strong enforcement mechanism.

“Because this bill prohibits people from holding companies accountable when they violate people’s privacy rights, this bill does not meaningfully empower people to control if and how our information is collected, used, and shared,” she said.

Despite those concerns, the newest bill could be an easier sell because it omits regulation of controversial facial recognition technology, a component of earlier iterations. Last spring, the Washington state legislature passed a bill establishing new guardrails on facial recognition software. Carlyle said he “did not feel a need to re-engage in that issue at this time.”

“The legislation that we passed last year created a framework for how the public sector and the private sector can utilize facial recognition technology in responsible ways,” he said. “I feel like we made a material and meaningful policy step forward.”

Several states across the country are considering data privacy bills in the absence of federal regulation. As home to Amazon, Microsoft, and a host of other influential tech companies, Washington following California’s footsteps could increase pressure on federal lawmakers to act on data privacy to supersede a patchwork of state laws.

We caught up with Carlyle, a wireless industry veteran who has served on several tech startup boards, to discuss the regulations up for debate in Washington in more detail. Continue reading for our edited Q&A.

GeekWire: What is the fundamental goal of this bill?

Carlyle: The fundamental goal is to create new rights for individuals to understand how their data is captured and to exercise the rights of the ability to correct that data, delete that data and to opt-out of the use of that data for targeted ads and the sale of that data. We have entered an era where data about an individual, whether a consumer or a citizen, is the paramount commodity of all of our lives and it has never been more important that we gain a sense of control and understanding about the use of that data and the individual’s right to control that data.

GW: Do you think that this bill has a higher likelihood of success this session than in previous ones?

Carlyle: Very much so. We’ve had compelling, unequivocal testimony, both from the attorney general and some other key stakeholders.

The attorney general office said directly that it is their interpretation of the language that they can enforce the bill as it is written currently. Previously, they had actively lobbied members of the legislature telling them that they did not feel that the language from last year was enforceable. In effect, the attorney general has made a policy distinction to say he prefers a right of private action, but that he does believe his office, under this bill, has the legal and the operational authority under the language in order to make it enforceable and that the policy decision is up to the legislature relative to right a private action. I believe that’s the game changer.

The second data point is, I included in this year’s bill a right to cure, which means that companies will have an opportunity to make right, in the event that there is a problem with individual consumer data being handled, and that just gives an opportunity to resolve issues before they escalate to the lawsuit level.

Thirdly, I think the premier consumer advocacy organization in the nation is, in many ways, Consumer Reports. They have in effect been neutral on this bill, believing that the enforcement capability and the language, as it has been refined over three years, is at a point where it is acceptable. I’m not speaking for them, but I’m just going on their public testimony, and so I think that those are developments that did not exist last year.

Finally, there’s a political dynamic where members of the House would be supportive of moving forward with legislation, given the growing acknowledgement of how critical privacy is to quality of life of individual people at this state.

GW: Does the tech industry support this bill?

Carlyle: Yes, there’s overwhelming support from the technology sector. We had public comments from Microsoft; Amazon has come out in favor of the bill. Facebook has been neutral. Twitter has been less enthusiastic behind the scenes. The WTIA has been supportive. So generally, yes. There are outlier companies that are not enthusiastic about any additional consumer rights regarding data but as a general statement, the tech industry has been primarily supportive, yes.

GW: In that case, who are the bill’s main opponents?

Carlyle: If you look at the public testimony, the ACLU has a strongly held conviction that all data and identifying information should be inherently opt-in as opposed to … opt-out. Now, there are key elements of my bill that do include opt-in, and that is for sensitive data. I’ve tried to take the best practices of GDPR and the best practices of the California law and the uniqueness of Washington, and come up with an evidence-based best practices of a bill. The ACLU remains fiercely opposed to any regulatory framework that, in effect, makes it easier for individuals to have a business and a financial relationship with a company that is not driven by a complete opt-in relationship. So they remain strongly opposed to the bill.

GW: If companies are compliant with the EU’s GDPR and California’s CCPA, will they also be compliant with Washington’s law?

Carlyle: The overlap is very, very substantial. The incremental time, energy, and effort to comply with Washington’s law will be very modest for companies that are compliant with those. Companies that are not compliant with GDPR or California, or don’t have a knowledge about it, it of course could take some effort, but that’s one of the reasons that I have a relatively high bar associated with size of companies in terms of users and in terms of a percentage of revenue that comes from the processing of data.

My goal is to start with a primary focus on the premier global platforms and larger companies that process extraordinary amounts of data relative to consumers. My goal here is an important, still historic step forward in creation of new rights, but to do so in a way that works with industry to ensure that those rights can be implemented effectively. I’m very sensitive to the operational integrity of making this program effective and it works well for individual consumers.

GW: How is this bill different from the one that you introduced last session?

Carlyle: First of all, a three-year evolution of any bill allows for a robust outreach effort. The bill differs in a number of ways. I have increased the authority of the attorney general to exclusively enforce the legislation. The primary concern of the attorney general in previous versions was that the attorney general’s office said it did not feel it had the technical and legal authority to adequately enforce these new consumer rights that are being granted without a right of private action. What has changed is that I granted the attorney general, under the bill, greater authority without a right of private action. So we’re ensuring that the attorney general has strong enforcement authorization and capability and we’re doing so in a way that ensures that we don’t just open the litigation floodgates for individual cases that simply don’t have merit.

The second major difference is that I’ve included a regulatory framework for how both companies and the government need to handle contact tracing data. Contact tracing has been an evidence-based best practice for public health officials worldwide for centuries, and yet with technology and massively powerful computers in everyone’s pocket, we’ve reached a point where the public confidence is not as high as it needs to be to ensure that contact tracing is well-managed and successful. My goal is to grant individuals a greater degree of confidence that their data is handled responsibly, both by companies and by the government.

GW: What makes that enforcement authority for the attorney general stronger, specifically?

Carlyle: It’s a legal term called “per se authority,” which grants the attorney general the presumptions. There are a handful of presumptions, or legal hurdles that the attorney general does not have to go over if they want to bring a case. They have the presumptions on their side and of course, the enforcement framework here at the attorney general level is to look for systemic patterns of abuse more than specific individual violations.

In looking for specific patterns of abuse, for example, do browsers capture data and inappropriately sell it to marketers? Do ISPs capture data in ways that may not be in the public interest and sell that data? Do various companies, aggregators of data, use data inappropriately? We’re looking for systemic patterns of abuse and we’re granting the attorney general the presumptions that allow the attorney general’s office to have broad based enforcement capability, but not individual losses relative to a private right of action.

GW: Is there anything else that you’d like to add?

Carlyle: It is imperative to remember that we have very strong, constitutional privacy protections in our state constitution — more than the federal government has. And we are of course, the home of technology innovation with Amazon and Microsoft, and so many other premium, leading global companies. We are the right state to lead on privacy.

Finally, there is a lot of conversation in Washington D.C. about national privacy legislation, but it is years away from actually happening and that’s why our state can be a thought leader in setting a strong framework that creates new rights for consumers. I think it’s imperative to remember that these rights to access your own data, understand who has it, to correct that data, to delete that data, to opt out of the sale of that data, targeted ads, should be a fundamental right for consumers in a data era. That’s why I want the consumers and the public to have these new rights officially and not be minimizing the historic nature of creating these new rights for the people Washington.