Washington may be the next state to enact its own data privacy law after a bill was introduced into the Washington State Senate earlier this month. Known as the Washington Privacy Act, the bill’s sponsor, Sen. Reuven Carlyle, stated at a press conference that lawmakers had reached “95 percent agreement in principle on the core elements of the bill.” If enacted, the act would add to the complex regulatory framework governing data privacy, including the California Consumer Privacy Act (CCPA), which took effect on January 1, 2020.
The act would apply to legal entities conducting business or producing products targeted to Washington State residents and that (1) control or process personal data of more than 100,000 consumers or (2) derive 50% of gross revenue from the sale of personal data and process or control the personal data of more than 25,000 consumers.
The act would give consumers certain rights with respect to their personal data that is controlled or processed by such legal entities, including the following:
- The right to confirm if a controller is processing the consumer’s data
- The right to correct inaccurate data
- The right to delete personal data
- The right to obtain personal data in a portable format to transmit it to another entity
- The right to opt out of the processing of personal data for the purposes of targeting advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal effects
The act authorizes the Washington attorney general to bring an action against a violator of the act and to impose a maximum penalty of $7,500 per violation. A violation under the act would not serve as the basis for a private right of action.
The act also introduces rules on the commercial use of facial recognition services, including these restrictions:
- Testing of the technology for accuracy and unfair performance, as well as testing such technology in operational conditions prior to its deployment
- Consumer consent prior to enrolling an image in a service used in a public space
- Conspicuous notice where the technology is deployed
If passed, the act provides an effective date of July 31, 2021. We will keep you updated on the act’s status.