Wash. Rep to Seek Tougher Measure as State Tries Again on Privacy
Enforcement looks again to be central to the privacy debate in Washington state this year. Rep. Shelley Kloba (D) said in an interview she will soon introduce a bill with a private right of action, unlike in Sen. Reuven Carlyle’s measure that failed the past two years amid House objections that it lacked teeth. Carlyle (D) told us he now sees more openness for passing SB-5062, though the American Civil Liberties Union remains opposed. Different political dynamics in the House could factor into the bill's fate.
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
The proposal is headed to the Senate Ways and Means Committee after it was cleared Thursday by the Carlyle-chaired Environment, Energy and Technology Committee 12-1 (see 2101210054). Similar bills in 2019 and 2020 ran into walls when the House sought tougher enforcement, such as letting individuals sue companies.
Kloba is finalizing a bill that picks up on House lawmakers’ ideas from past years. The legislation mightn't get its own House hearing but rather come up as an alternative when the Senate bill comes over, she said. Kloba’s bill contains a private right of action and takes more of an opt-in approach than Carlyle's opt-out except for highly sensitive data including COVID-19 health data. “The goal is that there is very meaningful opportunity for some to exercise their rights and have redress when they’re violated,” Kloba said. “Right now, a private right of action seems to be the best way to assure that. I am trying to remain open to hearing other ideas.”
“It takes a couple years to get historic, transformational legislation through in any state,” said Carlyle. Two developments make the senator upbeat about passing SB-5062: At a Jan. 14 hearing (see 2101140047), Consumer Reports (CR) sounded more supportive, and the attorney general's office said the bill now provides the tools it needs to legally enforce the measure. The latter was important, although AG Bob Ferguson (D) “has personal, political preferences for private right of action,” Carlyle said.
Reps who led the House’s privacy work the past two years are now gone. Lawmakers disbanded the House Innovation, Technology and Economic Development (ITED) committee, and Chair Zack Hudgins (D) and ranking member Norma Smith (R) left the legislature.
“We don’t have that same focused group of people working on the bill,” said Kloba. Only one former ITED member, Rep. Debra Entenman (D), is on the Civil Rights and Judiciary Committee, the panel that will probably review privacy-law proposals, Kloba said. “The knowledge and expertise and passion for the issue … is more diffuse,” which could make it harder for the House side to “maintain momentum.”
“While the legislative session looks different this year, the need for strong and enforceable privacy protections remain,” emailed ACLU-Washington Technology and Liberty Project Manager Jennifer Lee. ACLU supports Kloba’s “people-centric, community-driven approach to data privacy as an alternative to [SB-5062], which continues to have the same issues that we critiqued in 2019 and 2020,” she said.
Disagreement about enforcement remains a barrier, but SB-5062 sponsor Carlyle invited feedback early and “is doing everything he can to try to get ahead of some of the conflicts,” said Maureen Mahoney, CR policy analyst. She shares ACLU’s “concerns that if a weak measure is passed, it is difficult to strengthen it.” It's good to pass something because Washington consumers “currently have no meaningful privacy protections,” she said.
Lawmakers should remove companies’ right to cure and add “some form of private right of action,” Mahoney said. “Consumers should be able to hold companies accountable for violating their rights, and I don’t think the AG has enough resources.” CR is “open to different alternatives,” and a limited right to cure might make more sense in the context of a private right of action, she said.
“Much discussion ... so far has focused on the enforcement mechanism -- and that is what ultimately doomed last year’s bill,” said Davis Wright privacy attorney Kara Trowell. “The legislature will have to overcome that persistent sticking point.” This year’s Senate bill “is more aligned with last year’s House bill in certain ways,” including by lowering the applicability threshold based on data sale revenue to 25% from 50%, and it has a “limited private right of action for violations,” she said.
Minnesota, New York, Oklahoma and Virginia also have privacy bills. More are expected, Husch Blackwell attorney David Stauss blogged Wednesday.