Washington state legislators introduced two draft bills on Monday intended to regulate personal consumer data privacy and the use of facial recognition technology. GeekWire previously reported on the bills this past November.
The data privacy bill, known as the Washington Privacy Act, follows similar legislation enacted such as the European Union’s GDPR, and CCPA in California. It aims to give consumers new rights to ownership over their data and establish new transparency requirements for companies that process consumer data. Consumers would have the right to access, delete, correct, and move their data, or opt-out of data collection.
Sen. Reuven Carlyle, the bill’s sponsor, said at a press conference Monday that data is transforming society and industries. He said there isn’t time to wait for federal lawmakers.
“It has never been more important for state governments to take bold and meaningful action in the arena of consumer data privacy,” Carlyle said. “That’s what this legislation does.”
The regulations outlined in Carlyle’s bill would apply to any business that controls or processes personal data of 100,000 consumers or more, which would include Seattle-area tech giants Amazon and Microsoft. The rules apply to companies located in Washington and companies that target services to Washington customers.
Businesses that derive more than 50 percent of their revenue from the sale of personal data and process or control personal data more than 25,000 consumers are also subject to the regulations. The law does not apply to state and local governments; municipal corporations; or information such as protected health data. It would go into effect July 31, 2021.
Carlyle said the bill takes best practices from CCPA and GDPR.
“We’ve really tried to be thoughtful and respectful of the needs for business and industry to operationalize this program, so that it’s not implementing a new layer of burden on top of them but it is also recognizing that those consumer rights are foundational,” he added.
The new legislation builds on a bill that passed the Senate before dying in the House last session. The bill’s sponsors say they are taking lessons from that experience, though several of the sticking points that contributed to the last bill’s demise remain.
Carlyle said there is “95 percent agreement in principle on the core elements of the bill.”
The new Washington state bill includes regulations for facial recognition, such as a rule that requires companies to allow third-party testing for accuracy and bias.
A separate bill, sponsored by Sen. Joe Nguyen, is focused on public use of facial recognition. Nguyen said Monday the legislation is positioned to “protect communities who often times have been disproportional impacted by a whole host of things, whether it’s technology or otherwise.”
Microsoft was a key player in the effort to enact privacy regulations in Washington state last session. The Redmond, Wash., software giant is a vocal advocate for data privacy laws and facial recognition in Washington and beyond. Microsoft said in November that it will make changes required by California’s new data privacy law available to all its U.S. customers.
Amazon CEO Jeff Bezos said in September that the company’s public policy team is working on a set of proposed regulations for facial recognition technology.
Other states including Hawaii, Illinois, New Hampshire, and Virginia have submitted similar consumer privacy bills.
“Tech giants will continue to have more resources, craftier lawyers and a more unified sense of purpose than the regulators and legislators looking to bring them to heel,” wrote Axios reporter Kyle Daly. “As long as there’s a policy that could upend how they do business, they’ll look for a way through or around it.”
You can read through the Washington state bill here, or below (first embed is the privacy bill; second is the facial recognition bill).