Wash. House Chair Supports Private Right of Action in Privacy Bill
A Washington state House chair strongly supported letting individuals sue companies in comprehensive privacy legislation despite concerns that state and national industry groups raised about possibly making Washington the only state with that type of enforcement mechanism. At a livestreamed hearing Tuesday, the House Technology Committee heard support from consumer advocates and opposition from industry about HB-1671, a measure Rep. Shelley Kloba (D) introduced. Kloba hopes the bill can be scheduled for a committee vote next week, her office said after the hearing.
Sign up for a free preview to unlock the rest of this article
“I am for a private right of action, especially when we are trying to protect consumers,” said Committee Chair Cindy Ryu (D). She noted that arguing against allowing individual lawsuits is "a common way" of trying to weaken policies.
Privacy rules should apply to businesses of all sizes, said Kloba, who introduced HB-1671 last week (see 2501290055). Kloba’s legislation would broadly apply to persons who "conduct business in Washington state or produce products or services that are targeted to residents of Washington state, and that collect or process the personal data of consumers.” It would exempt governments and data covered by various laws, including the federal Health Insurance Portability and Accountability Act, Gramm-Leach-Bliley Act and Fair Credit Reporting Act.
“Why should a person's data be unprotected just because they're working with a small company?" Kloba asked at the hearing. At the same time, large companies can’t complain about compliance since they’re subject to similar requirements in Europe and California, she said. Later, Kloba pushed back on business groups seeking a right to cure potential violations of the law. The rep is "not willing to talk about a right to cure," but she is open to providing some time between the effective date and when enforcement could begin, she said.
Business groups opposed including a private right of action. "The true beneficiaries of this enforcement mechanism are trial attorneys,” argued Rose Feliciano, TechNet executive director-Northwest. Also, Feliciano raised concerns that HB-1671 “lacks interoperability with other existing state privacy laws,” including by differing on the definition of targeted advertising and by adding the terms contextual advertising and first-party advertising. That will make compliance difficult, said Feliciano.
The bill "deviates so much" from other state laws, said Morgan Irwin, Association of Washington Business government affairs director. "We don't think we can make it work.” He added that the proposed private right of action would mean that “if we make even a mistake, we're subject to millions and billions of dollars as an industry in liability.”
However, the bill’s private right of action and strict data minimization rules won kudos from consumer privacy advocates, including from Consumer Reports (CR), Consumer Federation of America (CFA), American Civil Liberties Union and the Electronic Privacy Information Center (EPIC). Kloba based her bill on a model that CR and EPIC developed.
“This is an issue that affects people directly, and people need an ability to sue,” said Ben Winters, CFA director-AI and data privacy. CR Policy Analyst Matt Schwartz said there have been fewer than 10 public enforcement actions to date under privacy laws in about 20 other states that allow enforcement only by their attorney general.
Washington has tried and failed to approve a privacy bill for half a decade, with the House and Senate disagreeing on whether to include a PRA. Virginia’s 2021 law was based on the proposed Washington Privacy Act, a failed bill by former Sen. Reuven Carlyle (D). The next 18 states that passed comprehensive bills followed a framework similar to Virginia’s law.
Andrew Kingman, counsel for the State Privacy and Security Coalition, mentioned to the committee that he worked on the original Washington Privacy Act. “Unfortunately, [HB-1671] departs from that framework in significant ways that would render it inoperable" with other state laws, he said.