The start of a new year saw the introduction of a pair of new bills aimed at consumer data privacy by Washington state lawmakers. On January 11, 2021, a new version of the Washington Privacy Act (WPA), SB 5062, was introduced in the Washington Senate. This bill follows up on two previous iterations of the WPA, SB 5376 and SB 6281, which failed to pass in 2019 and 2020, respectively. The previous versions of this bill passed the Washington Senate without issue but failed to make it out of the House of Representatives due to the failure of both chambers to compromise on the bill’s enforcement provisions.
The Washington Privacy Act draws its inspiration from the European Union’s General Data Regulation and the California Consumer Privacy Act. Among other things, it provides consumers with the right to access, transfer, correct, and delete data that certain covered entities have collected on them. The law would apply to “legal entities that conduct business in Washington or produce products or services that are targeted to residents of Washington, and that satisfy one or more of the following thresholds:
These thresholds would capture many entities in Washington, which is home to some of the world’s largest technology companies. The WPA does not apply to certain legal entities, including state agencies. Critics have disapproved of the WPA’s enforcement provisions in the past because they did not provide consumers with a private right of action to enforce violation of their data privacy rights. The current version of the bill also lacks a private right of action and, instead, places enforcement rights with the state attorney general. As compared to previous versions of the bill, the WPA does increase the enforcement power of the attorney general, but not enough to satisfy Washington’s House of Representatives.
On January 28, 2021, only a few weeks after the WPA was introduced in the Senate, the Washington state House of Representatives introduced House Bill 1433–the People’s Privacy Act. Like the WPA, the People’s Privacy Act provides data privacy rights and covers entities that meet certain threshold requirements for the amount of personal information processed or the amount of annual revenue collected. The People’s Privacy Act differs from the WPA by including a private right of action, meaning individuals can enforce their rights by suing covered entities for violation of its provisions. Whether Washington’s legislature will be able to compromise on the method of enforcement for data privacy rights will be worth monitoring in 2021.