Lawmakers in Washington state are pushing for a new privacy law that would attempt to give consumers more control over the information that big tech companies and data brokers collect about them.
The bill, proposed by state Sen. Reuven Carlyle, would give consumers the right to see what data is collected about them and find out whether that information is being sold to a third party. It would require companies to allow consumers to correct inaccurate information, delete their personal data, and object to their personal data being used in direct marketing. The bill would also put new regulations on companies developing facial recognition software, such as the state’s homegrown tech giants Amazon and Microsoft.
The proposal comes after a year in which scandals and breaches have shed light on how tech companies use consumer data, sparking regulatory scrutiny from state and federal legislators.
“We really tried to have a thoughtful, measured bill that gave consumers protection while also understanding the way e-commerce and online advertising works,” said Washington Chief Privacy Officer Alex Alben.
The bill applies to companies that control or process data on more than 100,000 Washington residents and data brokers with information on more than 25,000 Washingtonians. Alben said companies that already comply with Europe’s General Data Protection Regulation, enacted last May, shouldn’t have a hard time complying with the proposed law in Washington.
If enacted, the bill would require companies that collect personal data to be transparent with users about the type of information they’re recording, how they use it, and whether it is shared with third parties. If those companies create profiles about their users for ad targeting, they will have to disclose that before personal data is collected “including meaningful information about the logic involved and the significance and envisaged consequences of the profiling.”
Companies that fail to comply with the new rules could face penalties of up to $2,500-$7,500 per violation, enforced by the state attorney general.
“The technology industry has been a tremendous driver of economic growth in Washington state,” the bill says. “We need to ensure that any new privacy laws not only provide Washington residents with strong privacy protections but also enable industry and others to use data to create innovative technologies, products, and solutions.”
In addition to consumer data protections, the bill sets new regulations for facial recognition technology, requiring companies that make the software to get consent from consumers before using it on them. Consumers would need to be conspicuously notified when entering websites and physical spaces where facial recognition is in use. Companies that allow developers to use their facial recognition technology would need to make their APIs public so that third parties could test for accuracy and bias.
The bill also extends facial recognition regulations to the public sector. Government agencies would be prohibited from using the technology in ongoing surveillance of individuals in public spaces without a court order or emergency “involving imminent danger or risk of death or serious physical injury to a person,” according to the bill.
Washington state is home to two tech giants that have been making headlines over facial recognition technology, albeit for different reasons. Amazon has come under fire from activists, employees, and shareholders for selling its Rekognition technology to law enforcement agencies. Microsoft President Brad Smith, meanwhile, has called for government regulation of the nascent technology.
The first public hearing on Carlyle’s bill is scheduled for Tuesday morning. If enacted, the law would take effect Dec. 31, 2020.
This post has been updated to correct the date the law would take effect.