Washington Plans to Unveil a New Privacy Bill in Early 2020

Earlier this year, the expectations were high for the Washington state to pass a Privacy Act which would have granted consumers, inter alia, the right to access their data, correct inaccurate information, delete personal information, and object to its use in direct marketing.  Considering that Washington-based Microsoft and Amazon would have been subject to the Washington Privacy Act, it had the potential to compete with the California Consumer Privacy Act to set a standard for a U.S. privacy legislation.  However, efforts to enact the new regulations failed in April when legislators failed to reach a compromise with the tech companies before a legislative deadline.

Early in 2020, Washington legislators plan to introduce a new privacy bill that will, like the original proposal, also regulate the use of facial recognition technology.  Microsoft and Amazon have both been leaders in the development of facial recognition.  The proposed regulation will apply to any business that controls or processes personal data of 100,000 or more consumers.

Key provisions in the draft legislation will include the following:

• Consumers will have the right to access, delete, correct, and move their data, and to opt-out of data collection.
• Companies that control consumer data will have to be transparent about the information’s use, minimize its collection, and specify the purpose for collection.
• Companies that control consumer data will be required to conduct regular risk assessments.
• Law enforcement agencies will be prohibited from using facial recognition for ongoing surveillance without a warrant or threat of imminent danger.
• Companies that make facial recognition software will be required to allow third-party testing for accuracy and bias.
• Institutions using facial recognition in public spaces will be required to obtain consent.
• Government agencies that use facial recognition will be required to publish accountability reports and establish data management policies.
• Governor will have the authority to set up a task force to report on potential abuses and threats of facial recognition technology.
• The attorney general will have the authority to enforce the provisions of the Act but there will be no private right of action.

In addition to Washington, a number of other states are expected to consider privacy bills next years.  We’ll continue to follow these legislative developments and report them in our blog.