Fourth Time’s the Charm? Washington State Legislature Contemplating Comprehensive Data Privacy Bills

Written by: Brock Wolf, Esq.

Washington is among the states expected to pass a comprehensive data privacy law this year. At least, that has been the headline since 2019, when the Washington Privacy Act was first introduced in the legislature. Now, for the fourth year in a row, the legislature will attempt to pass a comprehensive data protection bill.

During the 2022 legislative session, lawmakers in Washington will have three different comprehensive data privacy bills to contemplate. A brief overview of the proposals is below.

• The Washington Privacy Act (Senate Bill 5062) has been raised each session since 2019. The Washington Privacy Act has introduced various consumer rights along with transparency and accountability obligations that align with the EU’s General Data Protection Regulation and the California Consumer Privacy Act and California Privacy Rights Act. In 2021, the bill was passed by the Washington Senate, but failed to get a floor vote in the House. It does not include a private right of action for consumers.

If passed, the law would apply to legal entities that (1) control or process personal data of at least 100,000 consumers, or (2) derive more than twenty-five percent (25%) of their gross revenue from the sale of personal data and process or control personal data of at least 25,000 consumers.

• The People’s Privacy Act (House Bill 1433) was first introduced in 2021, and is back on the table for Washington’s legislators. This bill is modeled after Brazil’s General Data Protection law. This bill provides that consumer data should not be used without affirmative, opt-in consent. It also gives consumers the right to access their data and correct and delete their information. The People’s Privacy Act would prohibit companies from using, selling or sharing data without first obtaining meaningful consent from consumers. The bill contains a private right of action and would protect Washingtonians’ personally identifiable information generally, as well as biometric and location data.

The bill would apply to entities that have (1) received $10,000,000 or more of annual revenue through 300 or more transactions, or (2) processed and/or maintained the personal information of 1,000 or more individuals during a calendar year.

• The Washington Foundational Data Privacy Act (House Bill 1850) was introduced for the first time in January 2022. The bill is substantially similar to the Washington Privacy Act. However, the bill departs from the Washington Privacy Act by proposing the creation of a Washington State Consumer Data Privacy Commission. The bill also contains a private right of action for consumers. The Washington Foundational Data Privacy Act prohibits targeted advertising based on protected characteristics like race, ethnicity and sex.

The bill would have the same jurisdictional scope of the Washington Privacy Act, and would apply to legal entities that (1) control or process personal data of at least 100,000 consumers, or (2) derive more than twenty-five percent (25%) of their gross revenue from the sale of personal data and process or control personal data of at least 25,000 consumers.

Although Washington has yet to pass a comprehensive data privacy law, each of the introduced bills would be among the most robust laws in the country if passed. We will know soon whether the state will pass any of the bills – the Washington State Legislature is in session until March 10.