Public Hearing on Washington Privacy Act (SSB 5376) in Senate Ways & Means – More Work to Be Done?

The Washington State Senate Ways & Means Committee held a public hearing on the Washington Privacy Act (SSB 5376) yesterday and is scheduled to discuss the bill during the committee’s executive session today. The Substitute Senate Bill was approved by the Senate Committee on Environment, Energy & Technology on a 11-0 vote earlier this month and referred to Ways & Means. In the House, the Washington Privacy Act is HB 1854.

The changes to the bill made by the Environment, Energy & Technology Committee according to the Senate Bill Report:

– Provides and clarifies definitions.
– Adds exemptions for municipal corporations and for information regulated by state and federal laws.
– Clarifies that controllers shall facilitate requests to exercise consumer rights after the request is verified and that the personal data subject to a verified request is maintained in an identifiable form by the controller.
– Provides conditions under which the right to deletion does not apply.
– Clarifies the conditions under which a controller must restrict processing of a consumer’s personal data.
– Removes section regarding a consumer’s right to not be subject to a decision based solely on profiling.
– Provides that a controller must communicate any correction, deletion, or restriction of processing to each known third-party within one year preceding the verified request.
– Requires controllers to conduct risk assessments of their processing activities involving personal data and anytime there is a change in processing that materially increases the risk to consumers.
– Removes the requirement for risk assessments to be completed annually.
– Requires controllers to obtain consent from consumers prior to deploying facial recognition services in physical premises open to the public.
– Removes the requirement for notice of the use of facial recognition services to be available online.
– Requires the state privacy office, in consultation with the Attorney General, to establish by rule any exceptions to this chapter necessary to comply with state or federal laws, clarify definitions, and create eligibility requirements for small businesses and research institutions.
– Changes the effective date to July 31, 2021.
– Make technical changes throughout.

(More information about the public hearing below the image)

Summary of the Public Hearing on the Washington Privacy Act:

There were not a lot of questions or comments from the Ways & Means Committee of the witnesses. There was a significant executive session before the public hearing started and a number of bills on the agenda today, so speakers were encouraged to limit their remarks. It was interesting that both the Washington Retail Association and the ACLU spoke against the bill, though for very different reasons. Also, it appears that there are significant non-public discussions going on about the privacy bill, as several witnesses applauded these efforts to address concerns.

Senator Carlyle, the prime sponsor, was given an opportunity to introduce the bill.

Chief Privacy Officer of Washington State spoke in support of the bill.

Microsoft representative spoke in support of the bill as something that is not only good for privacy but good for business. According to him, it incorporates the best aspects of GDPR and CCPA.

Washington Retail representative spoke against it and in favor of a federal solution. He also handed out specific changes to the bill that he said would improve it.

ACLU Washington rep. also opposed it on both data privacy and facial recognition. Feels that there is more work to be done on it.

President of the student body at the University of Washington School of Law testified in opposition with respect to facial recognition. He asked for these sections to be removed and HB1655 to be supported.

Consumer Data Industry Association rep asked for technical corrections to the Fair Credit Reporting Act section.

RELX rep asked for an amendment to the fraud section to come in line with how certain government and business practices in this area work.

Toy Association rep asked for an exemption for businesses that are complying with the Children’s Online Privacy Protection Act (COPPA) due to its preemption clause.

Axon Enterprises rep provided a handout with clarifying amendments around section 14 and 15 including addition of protective language for trade secrets, intellectual property, etc. as well as the

Washington Association Sheriffs & Police Chiefs rep testified against the bill limited to section 15 on law enforcement use.

Motorola Solutions rep testified against with respect to law enforcement use and an extension of the exemption to allow use in schools (public and private) as well.

Other Relevant Posts:

Maine Considering LD 946 to Protect Privacy of ISP Customers
Illinois House Passes Data Transparency and Privacy Act; Senate Passes KIDS Act
Texas Considers Consumer Privacy Act and Privacy Protection Act
Update: Special Session of Appropriations Committee Saves Washington Privacy Act for Another Week
No Washington Privacy Act This Year?
Washington Privacy Act – Initial Look at the Current House Version
Summary of Connecticut SB 1108 on Data Privacy
Summary of Public Hearings on Maryland Online Consumer Protection Act
Summary of Washington Privacy Act After State Senate Passes
Florida Legislature Considers Biometric Information Privacy Act
Maryland Considering SB613 / HB0901 – Online Consumer Protection Act
With SD341, Massachusetts Joins States Considering CCPA-like Data Privacy Laws
State CCPA Privacy Bills in Rhode Island, Hawaii and New Jersey
North Dakota Considers Study on Privacy Practices of Data Brokers

More Resources:

Read the resources Clarip has posted on the California Consumer Privacy Act (CCPA) and contact us to see a demo of the Clarip privacy management platform used by Fortune 500 clients.