Washington state House passes privacy act, but who will enforce it?

The Washington state House of Representatives on Friday night passed an amended version of the state’s ambitious consumer privacy act, but lawmakers must still agree on one major area of contention within the next few days before the bill can move to the desk of Gov. Jay Inslee.

Several amendments distance the House version of the bill from one approved by the Senate, but a particularly thorny change surrounds an issue known as “private right of action,” the right of individuals to bring lawsuits against companies under the law. The Senate version does not include this provision, instead assigning enforcement to the office of Washington State Attorney General Bob Ferguson. The House’s version, however, permits private lawsuits via the state’s existing Consumer Protection Act.

The Washington Privacy Act was introduced this year by Democratic State Sen. Reuven Carlyle, who is seeking greater privacy protections for consumers whose personal information is increasingly being collected and commoditized. The legislation would grant Washington state residents the right to see what information companies have collected about them and ask that it be deleted, and also includes new consumer protections related to targeted ads and facial recognition technology.

The Senate version of the bill was criticized by some lawmakers, including Republican Rep. Norma Smith, who said it was too “corporate-centric” for not allowing individuals the ability to sue companies for privacy violations. Other landmark privacy laws that the Washington Privacy Act was modeled after, such as the California Consumer Privacy Act and the European Union’s General Data Protection Regulation, include private rights of action. But Daniel Jaffe, who runs the Association of National Advertisers’ government relations office, said including a private right of action to the Washington law would be useless to consumers and potentially harmful to businesses.

“Unless they limited it, they would be able to sue for anything that was going on that somebody felt that was inappropriate,” Jaffe said. “You can start suing people even if they haven’t done anything, just say they violated, which means they have to go to court and hire lawyers and do things. That’s the worst possible situation, a just completely fraudulent effort to use the courts to shake people down.”

But short of that worst-case scenario, Jaffe said companies could also become subject to making small technical mistakes in their privacy policies, which smaller companies may not be able to afford to defend in court. In a statement issued by the group, it warns that opening up the possibility for such inadvertent violations “could have a chilling effect on Washington’s economy without providing any significant benefits for consumer privacy.”

But some worry that assigning enforcement entirely to the attorney general’s office would be inadequate, including Joseph Jerome, a policy director for the nonprofit Common Sense Media.

“I think it’s fair to say that private enforcement can lead to frivolous litigation, but oftentimes companies violate the law, and closing off the ability of folks to bring lawsuits and throwing all this on an overburdened attorney general office strikes me as not very good for consumers or privacy either,” Jerome said.

Under the House version, Ferguson’s office would have funding for 3.6 full-time employees, who would help manage enforcement of the act against technology giants like Amazon and Microsoft. Jerome said if the private right of action disappears, that staffing wouldn’t be enough.

“I think there’s been a lot of energy on all sides fighting and screaming about private rights of action that I think highlights a lack of creativity about what other creative ways we could have considered to boost enforcement,” he said. “The easiest one is to drive a Brink’s truck worth of money up to the attorney general’s office.”

Short of throwing money at the issue, Jerome suggested lawmakers consider mixing in some intermediate provisions, such as allowing private rights of action selectively, such as in cases relating to the use of facial-recognition data. Another option, he said, could be to allow private individuals to bring suits, but only if they’re first approved by the attorney general’s office, a safeguard designed to eliminate the riff-raff that advertisers and other pro-business groups worry about.

Ferguson’s evaluation is more definite.

“My office can enforce the version of the data privacy legislation passed by the House,” Ferguson wrote in an email to StateScoop. “We cannot enforce the version originally passed by the Senate. Beyond that, we have always maintained that a bill that purports to provide new consumer rights must provide individuals a path to enforce their rights. The Consumer Protection Act has, for decades, provided a strong, reasonable remedy for individual consumers. The Consumer Protection Act is the remedy we feel is best for consumers.”

State lawmakers have until Thursday to agree on a single version of the bill.