Who is taking and selling your personal data? Washington state lawmakers work to give people more of a say

Washington lawmakers are making another push to pass privacy regulations that govern companies' collection and sale of people's private digital information.

A proposal to implement European-style data-privacy regulations—with more consumer rights about the personal information gathered—fell apart last year, in part because of questions about whether it offered enough protections and how it addressed facial-recognition programs.

Sen. Reuven Carlyle, D-Seattle, is sponsoring a new version of his Washington privacy act, known this year as Senate Bill 6281. It will get a public hearing Wednesday in the Senate Committee on Environment, Energy & Technology.

"It has never been more important for state governments to take bold and meaningful action in the arena of consumer-data privacy," said Carlyle during a news conference Monday.

SB 6281 would apply to entities conducting business in Washington that control or process data for at least 100,000 consumers. Businesses that get 50% or more of their gross revenue from the sale of personal data, and control or process information on 25,000 or more consumers, would also be subject to the regulations.

Those companies could range from behemoths like Facebook and Microsoft, to largely little-known data brokers and also retail stores.

If asked, those companies would have to say whether a requester's data is being used, and provide that data. They also would have to correct inaccurate data if requested, and delete personal information under some circumstances, for example, if it were no longer necessary.

Individuals would not be able to bring lawsuits against companies for breaking the legislation, but the state Attorney General's Office would be able to pursue violations under the state's Consumer Privacy Act.

Rep. Zack Hudgins, D-Tukwila, chair of the House Innovation, Technology & Economic Development Committee, said Carlyle's new proposal satisfies some of the concerns he had about last year's bill, but more work is necessary.

Meanwhile, Sen. Joe Nguyen, D-White Center, is sponsoring Senate Bill 6280 to provide some regulations for state and local governments using facial-recognition programs.

Among other things, it requires those governments to publish accountability reports and conduct independent testing of facial-recognition programs to make sure they are accurate, as well as provide public notification when they are in use, according to a legislative analysis of the bill.

SB 6280 would prohibit using such programs for ongoing surveillance, unless in support of law enforcement under certain conditions.

The proposals remain a nonstarter for the ACLU of Washington. On facial recognition, the ACLU of WA is championing bills introduced last year that would put a moratorium on the technology, such as Senate Bill 5528.

Jen Lee of ACLU of WA said communities haven't had a chance to discuss all the impacts and, "We're just asking for a moratorium instead what's being presented."

The organization opposes SB 6281 because among other things it does not let individuals bring lawsuits, Lee said.

Meanwhile, Rep. Norma Smith, R-Clinton, is sponsoring several bills that focus on data collection and privacy.

They include House Bill 1503, which stalled last year. It would require data brokers to register with the state and disclose what type of information they're collecting.

Another of Smith's proposals is House Bill 2363, which would enshrine in law that each person owns and has exclusive rights over their own biometric identifying information, like their fingerprints and face. It will get a public hearing Tuesday in the House Committee on Innovation, Technology & Economic Development.

©2020 The Seattle Times
Distributed by Tribune Content Agency, LLC.