Third Time Could Be The Charm For Consumer Privacy Legislation In Washington – The Continued Saga Of The Washington Privacy Act

Businesses across Washington state – and those that do business there – might want to brace themselves for another round of debate that could lead to the passage of California-style privacy legislation in 2021. After failures the past two years, lawmakers seem intent on resurrecting the proposal in the new year. What do you need to know about this possible development, and what can you do to prepare your business?

Brief History Of Washington Privacy Act

Earlier this year, we updated you on the unfolding debate in Washington state over a proposed consumer privacy legislation – the Washington Privacy Act (WPA). The proposal modeled itself closely to the California Consumer Privacy Act (CCPA) in several aspects, and in other aspects looked to even surpass the CCPA’s stringent consumer privacy protections. However, after much debate in the Washington legislature, the 2020 WPA ultimately failed to pass. This came on the heels of a similar failure of a 2019 version of the WPA.

However, as we predicted, the 2020 WPA’s failure did not spell the end for Washington’s efforts to pass a consumer privacy protection bill. On September 9, 2020, Washington State Senator Reuven Carlyle — the champion of the 2020 WPA — announced on Twitter that an updated version of the WPA had been released for public review and feedback, signaling that the WPA will be back for another round of debate and vote in 2021.

What Would Proposal Mean For Businesses

As it currently stands, the 2021 version of the WPA tracks closely to the standards of the 2020 WPA. This includes the rights to correction, portability, and appeal, as discussed in greater depth in our earlier post discussing the 2020 WPA. 

Given the far-reaching effects of the COVID-19 pandemic on legislation across the country this year, it is unsurprising that the 2021 WPA proposal adds some additional protections for the handling of personal data collected from consumers in Washington during public health emergencies. This would include notice and affirmative consent requirements for activities such as contact tracing and symptom detection that may be used to help monitor and manage infectious diseases, such as COVID-19. 

The 2021 WPA also introduces a private right of action, albeit a limited one. The draft bill would allow for civil lawsuits only in the case of personal data use and collection for the new protections in the proposed bill for public health emergencies. A private right of action would not exist for other protections in the proposed bill. 

This limited right of action appears to be an attempt to strike a compromise over the major sticking point that doomed the 2020 WPA. Sen. Carlyle has opposed any private right of action, arguing that it would lead to a wave of “gotcha” lawsuits, and instead argues that the Attorney General’s office is in the best position to enforce the WPA. Other state officials (including the Washington Attorney General) have argued that a private right of action is necessary given that the WPA provides rights to consumers. These critics believe the WPA will be all but unenforceable if no private right of action exists. 

What’s Next?

Time will tell in the upcoming debates over the 2021 WPA whether the proposed limited private right of action is enough of a compromise position to please both sides, and if additional changes to the current version of the 2021 WPA will be made. The Washington legislature next meets on January 11, 2021, at which time the proposed 2021 WPA will be debated again. Stay tuned to this space for updates in the new year.