Washington Privacy Act stalls for the third year in a row

The bill, which was strengthened last month to include new opt-out controls and a private right to action, was not called to a vote in the House of Representatives. The bill had been passed by the state’s Upper House, the Senate, prior to the amendments in March.

The failure of the House to pass the Washington Privacy Act means this is the third consecutive year a version of the bill has failed, with the House seemingly in favour of a private right to action and the Senate comfortable without it.

Despite Sunday’s deadline for non-fiscal bills being passed, a representative of bill sponsor Senator Reuven Carlyle told the International Association of Privacy Professionals (IAPP) “the bill remains alive through the end of the legislative session” but did not provide reasons.

According to the Washington State Legislature website the “only initiatives, alternatives to initiatives, budgets and matters necessary to implement budgets, matters that affect state revenue, messages pertaining to amendments, differences between the houses, and matters incident to the interim and closing of the session” may be considered after the 11 April cut-off.

The draft bill would extend the rights of consumers to include access to data, power to delete and amend their data, or to opt-out of certain forms of data collection completely, which is consistent with California’s California Consumer Privacy Act (CCPA)

The draft Bill also includes the right to submit a request to a data controller via a designated authorized agent; or via user-enabled global privacy controls such as browser plug-ins or settings to signal the consumer’s choice to opt-out.

The stalling of the legislation is the latest development in the chequered progress of data protection laws across the US.

Only one state, California, has a privacy law in place. Its CCCPA  took effect last year and was supplemented by the California Privacy Rights Act (CPRA) in November. The CPRA notably establishes the California Privacy Protection Agency – an independent agency to handle regulation and enforcement.

It also allows consumers to prevent businesses from sharing personal data, amend their personal data, and limit the use of “sensitive personal information” such as precise geolocation, race, ethnicity and health information.

Virginia’s Consumer Data Protection Act signed into law by State Governor Ralph Northam in March takes effect on 1 January 2023.

The Virginia law allows consumers to confirm whether a company is holding their data and access it using an automated system. They can then amend inaccuracies or force the company to delete it altogether.

Consumers can also prevent companies from using the information for marketing or other purposes.

The latest update from the IAPP, published on 12 April, shows there are active bills at various stages of progress in Alabama, Alaska, Arizona, Colorado, Connecticut, Florida, Illinois, Maryland, Massachusetts, Minnesota, New Jersey, New York and Texas.

Privacy bills have failed in Kentucky, Mississippi, North Dakota, Oklahoma, Utah and West Virginia.

A federal privacy bill was also proposed to the US Senate in March by Democratic representative Suzan DelBene. This would create a national standard for privacy rights across the US. It would propose stricter guidelines for sensitive data such as social security numbers and health data than for less sensitive information like names and emails.

As envisaged under the bill, consumers must explicitly opt-in to allow a company to sell or share their sensitive personal information, but they can opt out of sharing of their non-sensitive personal information.