DRAFT!  FEEDBACK WELCOME!
Please do not forward yet!

State lawmakers in Washington want the state to be the gold standard for regulating companies and governments that collect people’s digital data or use facial recognition programs.

— Joseph O’Sullivan, Washington [Senate] Passes Data Privacy Bill as Questions Remain, Feb 19 2020.

We are testifying today as other because while we support the passing of privacy legislation in Washington, we are unable to effectively enforce this bill as currently written.

– Andrea Alegrett of the Attorney General’s Office (AGO) Consumer Protection Division, at the House ITED Committee hearing on SB 6281, the Washington Privacy Act, Feb 21 2020

Privacy advocates killed a similarly-weak “privacy” bill in last year’s session, so tech companies like Microsoft and Amazon have spent a lot of time, energy, and money lobbying for SB 6281 — and proposing it to other states as a model.  After the Washington State Senate passed SB 6281 46-1 last week, with only Bob Hasegawa voting no, it seemed like their investment might be paying off.

But Friday’s hearing at the House Innovation, Technology & Economic Development (ITED) Committee may well change the momentum, and put us on a path to legislation that would truly protect Washingtonians privacy.

The AGO’s statement on un-enforceability was the biggest bombshell.  Their analysis is straightforward:

• SB 6821 does not include a “per se” clause, saying that any violation of the WPA is also a violation of the Consumer Protection Act.  As a result, “the AGO’s enforcement and investigative authority is severely limited.”
• The AGO is also concerned that the “broad exceptions that would permit industry to sidestep the very consumer rights and obligations created by this bill” limit their enforcement ability

There are a lot of other problems with the bill as well, including a very bad section on facial recognition and the absence of a “private right of action”.  SB 6281 says that only the AG is allowed to enforce the law; people who are harmed can’t launch lawsuits themselves.  The AGO has strong things to say about that as well.

Finally, as we have stated before, we believe that a Private Right of Action, along with AGO enforcement is the best policy for consumers.

Black Lives Matter Seattle-King County board member’s Livio De La Cruz also discussed why a private right of action is so important:

We know what it’s like to have our rights ignored. We want to have the power in our hands.  We want the people to have that power.

As Jennifer Lee of ACLU-WA highlighted in her testimony, organizations representing immigrant communities, people of color, and LGBTQ+ people are consistently opposing the bill.  A couple more examples from the hearing:

• Stan Shikuma of the Japanese American Citizen League’s Seattle Chapter reminded us of the role data abuse played in the the mass incarceration of Japanese Americans and observed “never again is now.”
• Derek Lum of Interim CDA (an organization focusing on social justice and equity for low income, Asian and Pacific Islanders, immigrant, and refugee communities) similarly said “history shows this will be abused”, citing over-policing of Black communities and post-9/11 targeting of Muslims as well as Japanese internment.
• Eli Goss of OneAmerica (the largest immigrant and refugee advocacy organization in Washington State) discussed the bills pre-emption of local laws and the extremely low limits on fines — a maximum of $7500 per violation.

I also testified, discussing Microsoft Researcher Luke Stark’s analogy that facial recognition is like plutonium: something so toxic to society’s health that it needs to be strictly regulated.  Following up on Eli’s comments about pre-emption, I also discussed the wave of cities and counties limiting and even banning facial recognition — including San Francisco, Somerville, and Oakland.  As written, SB 6821 would prohibit these local ordinances in Washington State, as well as rolling back current protections like Seattle’s Broadband Privacy Rule.

And my quick descriptions hear only scratches the surface of all the criticism of the bill as currently written.  The two-page fact sheet from  Consumer Federation of America, Privacy Rights Clearinghouse, EPIC Privacy, EFF, and ACLU-WA is a good summary if you’re interested; and it’s really worth watching the video of the hearing.   Still, even without those details, hopefully by now you’re convinced …

The bill in its current form isn’t anywhere close to a gold standard. In fact, as privacy advocate Deborah Pierce (former Executive Director of PrivacyActivism) said during the hearing, right now, it’s more like window dressing.   And a bad bill is worse than no bill; it will be hard to repair when legislators say it’s already a gold standard, but also because it gives more ammunition to the big tech companies who advocate using these unenforceable regulations as a model for other states.

Fortunately, bills can still get changed even after they pass the Senate.  I was really impressed by the ITED Committee.  This was one of the best hearings I’ve been to since I can’t remember when, with excellent questions from legislators.  The very solid “side-by-side” comparison  presented by staffer Yelena Baker, highlighted the much stronger regulations the committee had considered in their own earlier work.  With luck, we could still emerge from this with a strong privacy bill that passes the House.

And if you’re in Washington, you can help!  Please ask your legislators to oppose SB 6821 in its current form.  You can give feedback on the bill’s web page (make sure to click “Verify District” after you put in your address), by calling the Legislative Hotline at 1-800-562-6000 (TTY for Hearing Impaired 1-800-635-9993), by calling or emailing your legislators directly, or via Take Action Network (which is also a good place to track ongoing action alerts on privacy and other issues).

If you’re not sure what to say, you can keep it simple:

Please oppose SB 6821 in its current form. The State Attorney General’s office says the bill is unenforceable as written. We deserve strong privacy protections.

If you want to say more, here’s a handy chart from the ACLU-WA with four of the bill’s biggest problems.