Washington is poised to become the second state in the nation to enact data privacy regulations, following the lead of California and the European Union. But the American Civil Liberties Union is fighting a privacy bill that has cleared the Washington State Senate and is currently in the House.
Shankar Narayan, director of the Washington ACLU’s Technology and Liberty Project, is aware of the irony: “Nobody wants data privacy for consumers more than we do,” he said during an event in Seattle Thursday.
Narayan was speaking on a panel of privacy and antitrust experts hosted by the Seattle media organization, Crosscut. Sitting next to him was Washington State Sen. Reuven Carlyle, the sponsor of the privacy bill the ACLU is resisting.
“There are those that believe that it simply doesn’t go far enough and that any bill that takes a step at regulating privacy should have expansive authority and the real question is, is it a meaningful step forward? I believe that it is,” Carlyle said.
The resulting clash between Narayan and Carlyle during the panel was a telling exchange that highlights the challenges of crafting legislation with input from the tech industry, while developing meaningful protections for consumers in the digital era.
The debate has potential implications far beyond Washington state. Brad Smith, Microsoft’s president, said recently that he believes the legal framework established in the state will become the de facto standard globally because Microsoft and Amazon will be subject to the state law.
On the Thursday night panel, Carlyle said the ACLU “has a luxury to make perfect be the enemy of the good.” He later added, “I live in the world of making meaningful steps forward.”
“I also live in the real world,” Narayan responded. “Perhaps as a brown person, I live in a realer world, in some ways, in terms of the impact of face surveillance. We would take a step forward on both data privacy and face surveillance but Microsoft and other tech companies have had, undoubtedly, an outsized influence on this conversation just because they have a lot more lobbyists.”
Julie Brill, Microsoft’s general counsel for privacy and regulatory affairs, said the bill is “a meaningful and important step in the right direction” in response to Narayan’s comments.
“Today, there is an urgent need for new, comprehensive privacy laws that provide strong protections for consumers within a framework that enables innovation to thrive,” she said.
The bill in question: Carlyle’s bill would require the following of companies that control personal data of 100,000 or more Washington residents and data brokers with information on 25,000 or more Washingtonians.
- Entities that collect personal data must be transparent about why and how they are using it.
- Companies must delete personal data at the request of consumers if a number conditions are met, like there is no longer a business reason for using that information.
- Companies must do risk assessments of their data processing activities to determine the potential harm to consumers.
- Any entity using facial recognition in a public space must notify visitors that the technology is in use.
- Companies that sell facial recognition software must make it available for third-party testing to monitor bias, an issue raised in several studies.
- Public agencies cannot track individuals using facial recognition without a warrant.
Where the tech industry fits in: Microsoft and other tech companies are throwing their weight behind the bill. Carlyle views their participation as an example of the legislature engaging key stakeholders, while Narayan’s thinks the tech industry has more nefarious intentions. He said tech companies are intentionally backing “watered down” state-level regulation so that they can eventually “go to the feds and say, ‘look this patchwork of laws isn’t working. Let’s enact something even weaker.'” Carylye said he takes “exception to the point that it’s designed and written in a corporate environment.”
A step forward or backward? Carlyle is adamant that the legislation is a “meaningful step forward” while Narayan and the ACLU see it as a “step backward” masquerading as progress. The disagreement hinges on whether consumers will really be able to delete their data under this law, which the ACLU says is toothless. “The company can continue to use my data because there’s so many exemptions and loopholes,” Naryan said. “They can just find one and override my consent.”
Earlier this session, the ACLU backed a separate privacy bill in Washington state that would enact stronger data regulations and ban facial recognition technology until it could be vetted for bias against people of color and other historically marginalized groups. “Unfortunately, Microsoft came and lobbied against that bill while supporting an enabling approach that will end us up with a face surveillance infrastructure in a lot of public places,” Narayan said.