Significant progress, although still a ways to go: privacy and facial recognition legislation advances in Washington State

After a dramatic debate on the floor, the Washington House voted to send improved versions of two key bills back to the Senate.  Now, the lobbying will get even more intense, as the tech industry and law enfocement try to convince legislators to return to the really bad versions of the bills the Senate passed earlier.  But momentum’s on the side of the community, consumer, and privacy groups who have been pressing for improvements — so let’s continue to press for more.

There’s a more detailed update below on what happened in the House and what might happen in the Senate, but first: now’s the time to contact your legislators and let them know what you think.  As well as thanking the House for their hard work, please ask the Senate to PRESERVE the improvements in the House bill, and work to further STRENGTHEN the legislation.

Demand good privacy legislation here in Washington State has details about how to contact your legislators.

Kudos to the House!

There’s still a lot of work to do on the legislation, but it’s amazing how much it’s improved since the hearing I talked about in A bad day for a bad privacy bill, a good day for privacy.   For example:

• SB 6281, the “Washington Privacy Act” still has loopholes and exceptions, but thanks to an amendments from Reps. Hudgins now has a private right of action — and (unlike the Senate’s version) the Attorney General says this version is enforceable, which is a good thing!
• SB 6280, which regulates law enforcement use of facial recognition, still falls short of a moratorium that so many groups are calling for, but thanks to an amendment from Rep. Entenman now has a significantly stronger warrant requirement — and a new requirement for existing deployments to go on hold until an accountability report is fired.

This is a huge amount of progress in the last two weeks.  The private right of action is huge; as Livio De La Cruz of Black Lives Matter – Seattle King County said, it puts the power in our hands.   Tech companies were successful in keeping a private right of action out of California’s CCPA privacy legislation, and are currently fighting to keep it out of federal legislation as well.  Here’s a real chance for Washington to set a new bar for privacy protection.

There are lots of other improvements in the House versions of the bills as well.  A few more examples:

• Significant amendments from Rep. Smith on the floor incorporated language from Consumer Reports and the Electronic Frontier Foundation to give more protections to de-identified data and clarify that photographs are not pseudonymous information.
• The “pre-emption” clause was narrowed significantly in Rep. Hudgins amendment.  It would have been better to drop it completely, but at least existing regulations like Seattle’s Broadband Privacy Rule are grandfathered in — and local regulations against face surveillance are no longer prohibited.
• Rep. Santos’ amendment improved SB 6280’s task force on facial recognition (already one of the best features of the bill) by ensuring representation from the AAPI community.

The powerful testimony at the hearing from people like Livio, Stan Shikuma of Japanese Americans Citizens League – Seattle Chapter, Derek Lum of InterIm CDA, Eli Goss of OneAmerica, and Jennifer Lee of ACLU Washington clearly had an impact.  So did the consumer and privacy groups who weighed in, including Consumer Federation of America, WashPIRG, Common Sense Kids Action, EPIC, and Privacy Rights Clearinghouse as well as EFF and Consumer Reports.   And the Attorney General’s Office (AGO) Consumer Protection Division bombshell testimony on enforceability had a huge impact as well.

The House ITED Committee has taken a major role here.   Kudos to Chairman Zack Hudgins, Ranking Member Norma Smith, and all the members of the committee!  Reps. Hudgins, Smith, Debra Entenman, and Luanne Van Werven all introduced strong amendments.  And Reps. Shelley Kloba, Matt Boehnke, Sharon Wylie, Gael Tarleton, and Vandana Slatter all spoke passionately and knowledgeably during the floor debate.  Really impressive work all around!

And kudos as well to the House as a whole, which also did excellent work — in extremely difficult circumstances.   I am very sympathetic to the hard choice legislators faced, under incredible time pressure, voting on the 27 (!) amendments that had just been introduced, and then a version of a very complex bill that even its supporters agree is still very imperfect.

Watching the debate, I was very proud to be a Washingtonian.  Representatives from both sides of the aisle made good points in the debate, clearly understood the importance of this issue, and were genuinely looking for the best solution even in situations where they had different viewpoints.  So thanks to all of you, no matter how you voted.

As Rep. Boehnke said, you’ve earned your stripes.  I’m very glad the House advanced these bills, and hope that your colleagues in the Senate seize the opportunity and build on your hard work.

Back to the Senate

In their final remarks Reps. Kloba, Wylie, Boehnke and Smith all did a great job at teeing things up for the Senate — for example, Rep. Kloba’s framing “we improved it a lot and got the message from consumers that it still needs to be better”.   So now the Senate has a few options:

• accept the House bills as they are (which seems unlikely)
• kill the bills
• make some amendments, meaning that the bills go to concurrence

It’s hard to know just what will happen.  Of course there will be pushback.  At the same time, though, consumer, community, and privacy organizations will be pressing for further improvements.  There’s some easy low-hanging fruit, like Rep. Van Werven’s excellent amendment (which alas failed on the House floor) raising the age of children protected from 13 to 16.   Rep. Smith’s amendments also offer clear improvements.  Maybe Senators will see which way the wind is blowing and decide that they also want to have a hand in improving the legislation.

All that being said, groups wanting strong privacy legislation are justifiably very nervous right now — and so am I.  It was only a few weeks ago that the Senate voted for an unenforceable version.  Maybe they didn’t realize how bad it was; after all, Microsoft, Amazon, the WTIA,  industry-funded “impartial” non-profits and have been telling the Senators that the unenforceable version included “strong enforcement” that would “raise the bar” on other states.   Then again, maybe the Senate really does want unenforceable regulation.   Time will tell.

There’s certainly a chance the Senate will decide to kill the bills.  This seems to me like it would be political suicide — even those who oppose the current versions would be better off sending it to concurrence for future improvements.  But you never know.  If the Senate does kill one or both bills, expect this to be a big campaign issue in the August primary and November general election.  There’s also likely to be pressure on Jay Inslee to call a special session if lawmakers once again choose not to protect Washingtonians’ privacy and rights.

SB 6280: Is there the political will?

Even though there’s still a lot of room for improvement in the current legislation,  there’s also a path to getting something that really would raise the bar for privacy.

On SB 6280, the warrant requirements and strengthened accountability report are certainly much better in the House bill (although both sections need further improvements).   Even once that happens, though, the current contents of SB 6280 really need to be coupled with a moratorium on face surveillance– or at the very least provisions that permanently prohibit any government agency from engaging in face surveillance with a few very narrow exceptions (for example allowing law enforcement to do face matching against the Department of Licensing database with a warrant in very specific circumstances such as rape or kidnapping).

Perhaps there’s a path to getting similar results without using the m-word.  The accuracy and biases in all of today’s systems are so bad that a real review and approval process probably would halt all deployments.   Section 3 could be further strengthened, as could Sections 6 and 7 (including along the lines I discussed in my testimony and follow-on mail).   Still, there’s a risk is that the approval process lets corporations can throw lawyers and money at the problem and get dangerous systems approved.  In the short term, a moratorium seems like a cleaner solution to me.

There’s broad support for a moratorium.  ACLU Washington has joint letters and other comments from many community groups demanding a moratorium; 80% of Massachusetts voters support a facial recognition moratorium, and I expect the numbers are similar here. The EU is considering a five-year moratorium; Google’s CEO endorses a moratorium; so do many of the top AI researchers.  The proposed statewide moratorium in Massachusetts is a good starting point for how ours might look; Portland’s proposed legislation is also worth looking at. 

But is there the political will to do this? 

SB 6281: The House debate highlights the path forward

On SB 6281, the outstanding House debate offers a lot of directions for further improvements.  Some examples:

• Ranking Member Smith’s discussion of a “floor not ceiling” approach
• Rep. Wylie’s comments that regulations need to send a strong message to bad actors
• Rep. Walsh’s remarks that Rep. Van Werven’s amendment offered a chance for Washington to take a leadership role
• Protections in the dozen amendments from Ranking Member Smith that did not pass, for example restrictions on third-party sharing and data brokers.
• The shift in the discourse towards a real focus on rights, not just regulations.

For me, one of the many highlights of the debate was when Rep. Walsh pointed out that the supposed “tradeoff” between privacy and innovation that people kept talking about isn’t real.   Yeah, really!

It’s certainly true that some kinds of innovation are more complicated if you have to take potential harms to consumers and citizens into account.  Then again, there’s plenty of room for innovation in technologies that actually do protect privacy.  Companies large and small have spent billions of dollars over the years on tracking our behavior and figure out what ads to show us as a result, but very little on privacy technology.  While that’s starting to change in Europe as a result of the GDPR, Washington has a chance to be a world leader here.

During the debate, I heard a lot of concern about businesses having to deal with a “patchwork” of regulations.  This is already a very real challenge with federal regulations, the CCPA, and GDPR.  Still, companies know how to live with this, and even turn it to a competitive advantage by designing their offerings for the strongest regulations out there. The Washington Privacy Act can help improve the situation (and give Washington-based businesses an advantage) if its regulations are stronger than other jurisdictions — strong enough that they cities and counties  in the state don’t feel the need to do more.   By contrast, weak or no regulation will make the situation worse.

Similarly, in terms of the private right of action,  I certainly hear the concerns from companies large and small about frivolous lawsuits.  I just wish that instead of desperate efforts to block any private right of action, the same amount of energy went to drafting a good private right of action.  Joe Jerome’s Private right of action shouldn’t be a yes-no proposition in federal US privacy legislation on the International Association of Privacy Professionals (IAPP) site has a very solid framework for thinking about this that applies to state legislation as well.

Time for the next battle

Even though there are good paths forward, the tech industry and law enforcement will be lobbying fiercely to go back to the bad bills the Senate passed.  We may well be on track for a replay of last year, where the legislation collapsed in concurrence.

Then again, politics is the art of the possible, and I’m a lot more optimistic than I was two short weeks ago.  Thanks to everybody who’s helped get us here!

And now, on to the next battle.

If you’d like to help, please please please let your state legislators know that you want legislation that protects our rights.   As well as thanking the House for their hard work, ask the Senate to PRESERVE the improvements in the House bill, and work to further STRENGTHEN the legislation.  Demand good privacy legislation here in Washington State has details about different ways to contact your legislators.   And please help get the word out, by sharing this post!