A senior lawmaker in Washington believes the state can be the next hub for consumer privacy legislation in the U.S., following California’s lead. But he faces continued opposition from within his own party over how it should be enforced.
State Sen. Reuven Carlyle, a Democrat who chairs the Washington state Senate’s Environment, Energy & Technology Committee, said he is evaluating the recently approved California Privacy Rights Act with an eye toward updating the Washington Privacy Act in the coming weeks in preparation for the next legislative session beginning in January.
Two previous attempts to pass a privacy law failed in the state legislature after drawing criticism from state House Democrats, the state attorney general and advocacy groups such as the American Civil Liberties Union of Washington. Mr. Carlyle, however, believes California’s successful ballot measure adds pressure for Washington to follow its lead in 2021, while the defeat last week of one of his key opponents could shake up the debate in Olympia.
“We are the right state to do this,” he said.
Similar to data protections in the CPRA, Mr. Carlyle’s draft 2021 bill would give residents the right to request companies to delete or correct their personal data. The proposal would also allow consumers to opt out of data processing for certain purposes, such as targeted advertising, and require businesses to conduct data-protection assessments.
The key sticking point is enforcement, state officials say, namely whether to create a private right of action that would allow individuals to sue companies for alleged violations.
“I do not support that position in any way,” Mr. Carlyle said, warning of frivolous lawsuits and citing opposition from the business community. “I strongly believe state-level [attorney general] enforcement is the way you can most effectively enforce the bill.”
Some other state officials, including Attorney General Bob Ferguson, argue that such a private right of action is crucial.
“Last year’s data privacy bill was unenforceable,” Mr. Ferguson, a Democrat, said in a statement. “The bill prohibited individuals from going to court to protect their rights, and failed to give my office the tools we need to ensure compliance.”
State Rep. Zack Hudgins, a key foil to Mr. Carlyle as chair of the House Innovation, Technology & Economic Development Committee, said he and many other Democrats in the state House previously took a similar view. Mr. Hudgins lost his re-election campaign last week, leaving the future leadership of his committee—and its approach to privacy—unclear.
Data protections will contend next year with other issues such as coronavirus pandemic relief, said Rep. Shelley Kloba, vice chair of the committee. But she added that remote work and other shifts toward digital life make privacy even more crucial.
Ms. Kloba, who supports a private right of action, said she’d consider a longer timeline for compliance or intermediary steps such as arbitration before consumers could sue companies outright.
“If you’re extending rights to a person, they ought to have the opportunity to have some recourse when those rights are violated,” Ms. Kloba said.
The disagreements in Washington state mimic those in Washington, D.C. Federal lawmakers diverge on whether a privacy law should create a private right of action, with Democrats generally supporting the idea and Republicans broadly opposing it. Republicans, meanwhile, back a federal law’s ability to override state laws, which many Democrats oppose.
Those splits make a nationwide standard unlikely in the near term as the next administration grapples with a long to-do list, privacy experts say, giving Washington and other states more runway to write their own legislation. Many companies caution that a national patchwork of privacy laws will create confusing rules for the digital economy and ballooning compliance costs.
“We will have to have some chaos before we get to a point where there’s enough momentum for Congress to act,” said Mike Hintze, a partner at Seattle law firm Hintze Law PLLC and former chief privacy counsel at Microsoft Corp. “I don’t know if we’re close to that yet.”
Write to David Uberti at [email protected]