Washington Privacy Act – Initial Look at the Current House Version

The Washington Privacy Act took another step closer to adoption last night as striker amendment H2692.1 was approved by the House Innovation, Technology & Economic Development Committee and referred to the House Appropriations Committee. The Appropriations Committee passed the prior House version of the bill, so this will in all likelihood setup a reconciliation between the House and Senate versions of the Washington Privacy Act in the next three weeks or so after the full House votes on it.

How did we get here? The Washington state House and Senate were both considering separate versions of the Washington Privacy Act – HB 1854 and SB 5376. The Senate passed 2SSB 5376 first by a vote of 46-1, and the House decided to execute amendments to the Senate version rather than proceed with its own vote on the House floor of HB 1854.

After a prior public hearing, the House Innovation, Technology & Economic Development Committee on Tuesday went through a thirty minute briefing on the comparisons of the proposed striker amendment versus the version that passed the Senate. A striker is an amendment that strikes everything after the enacting clause and substitutes new language. However, the reality of the proposed new privacy bill is that the striker contains many of the same requirements as the Senate version.

The House committee followed it up on Wednesday with a one hour executive session where they proceeded to vote on amendments to striker H2692.1 and then a vote on the striker amendment itself. Three of the proposed amendments to the striker failed, including the one to remove the facial recognition sections from the bill, and the rest passed. The amended bill was then approved by the committee on a vote of 5-4 and referred to the House Appropriations Committee.

The consensus among the yes votes in the committee was that this is an important issue for the voters, it is an important time for the government to act, and they should not let the perfect be the enemy of the good. The no votes in the committee generally appreciated the importance of a privacy law but were very concerned about the amount of work that needs to still be done on the bill.

The deadline for the House to pass the bill is two weeks away – Wednesday, April 17, 2019. In the interim, the Appropriations Committee needs to act and then the full House needs to take a vote.

If the House passes a different version then the Senate did, which seems likely at the moment, the Senate will need to decide whether they accept the amendments. If they will not, the House is then asked if they will pass the original Senate bill. If the House will not accept the original Senate bill, it goes to a conference committee and both houses must approve the resulting conference committee report.

We have worked through the side-by-side comparisons of the 2SSB 5376 (passed by the Senate) and Amendment H-2692.1 available on the legislature’s website, as well as the text of the striker amendment before the latest amendments approved in the committee (in other words, we have not yet reviewed the full text version that the House Appropriations Committee will review). There are a number of key changes that will need to be reconciled before the Washington Privacy Act is adopted.

(scroll down for the key differences between the two bills)

Here is a summary of some of the key House changes:

– Moves the effective date up a year to July 30, 2020 from July 31, 2021.

– Removes both of the threshold requirements, such as that the business must have data on 100,000 consumers. It would then apply to any organization doing business in Washington, subject to the bill’s general exemptions.

– Applies the enforcement of the state’s consumer protection act, including the private right of action from the consumer protection act.

– Removes the requirement of monetary consideration from the definition of sale and requires any sale to be consistent with consumer consent.

– Adds a disclosure in the privacy notice that the controller processes personal data only pursuant to the consumer’s consent and the disclosed purposes.

– Gives consumers the right to object to processing of personal data and requires them to stop processing after such objection. It allows businesses to continue if it is not inconsistent with the original consent or disclosures, or if it is covered by one of the general exemptions in the bill.

– Eliminates the specific exemptions on the right to delete and instead allows the general exemptions of the law to cover these situations.

– Adds a consent requirement to the definition of business purpose and removes auditing such as the counting of ad impressions.

– Requires consent to also be freely given, which is a term used in the General Data Protection Regulation

– Removes two out of the three exemptions to the definition of data broker.

– Adds to the definition of deidentified data references to a direct identifier and indirect identifier.

The Washington state legislature is pushing to become the second state in the United States to adopt a comprehensive privacy law. However, there remains a number of areas of disagreement between the current House and Senate versions of the bill. For example, the two versions do not agree on whether it will apply to only large businesses or whether it will apply to all businesses. So there are a lot of areas to be worked out in the next month if the legislature is going to pass a bill during its current session.

More Resources:

Ready for the new California privacy law coming on January 1, 2020? Learn more about CCPA compliance and contact us to see a demo of the Clarip privacy management platform used by Fortune 500 clients.