Washington Rep. Kloba Files Privacy Bill Based on CR/EPIC Model

“Our personal data is the new Western frontier -- a resource so valuable that corporations track our every move to extract and exploit it,” Kloba said Monday. “The People’s Privacy Act is about reclaiming our digital autonomy, protecting our safety, and putting control back where it belongs: in the hands of the people.”

Kloba told us earlier this month (see 2412300043) that her 2025 bill would be based on a model by Consumer Reports (CR) and the Electronic Privacy Information Center (EPIC). HB-1671 is an opt-out bill that includes data minimization rules requiring companies to collect and process only the personal data necessary to provide their product or service, Kloba’s office said. Also, it would included stricter protections for kids, prohibit sale of sensitive data without an opt-in and prohibit discrimination.

The bill would broadly apply to “persons that conduct business in Washington state or produce products or services that are targeted to residents of Washington state, and that collect or process the personal data of consumers.” It would exempt governments and data covered by various laws including the federal Health Insurance Portability and Accountability Act, Gramm-Leach-Bliley Act and Fair Credit Reporting Act.

EPIC Law Fellow Kara Williams urged lawmakers to pass the bill. “The bill sets meaningful limits on how much data companies can collect, prohibits the sale of sensitive data, and bans targeted advertising to kids and teens.” CR Policy Analyst Matt Schwartz also praised the bill. “This bill provides strong, default protections that appropriately shifts the onus of privacy protection from consumers to businesses themselves.”

The American Civil Liberties Union looks forward to working with Kloba, said Tee Sannon, ACLU's Washington state technology policy program director, in an emailed statement. “Strong privacy protections are necessary to protect our civil rights and civil liberties ... That we are increasingly required to share personal information or allow surveillance as a consequence of simply participating in public life and accessing basic social goods, services, and opportunities threatens our rights." Privacy violations disproportionately affect people of color and those with low income, added Tannon.

Washington has tried and failed to pass a privacy bill for half a decade, with the House and Senate disagreeing on whether to include a PRA. Virginia’s 2021 law was based on a failed Washington Senate bill by former Sen. Reuven Carlyle (D).