There are so many versions of privacy bills floating around that it can be challenging to know which is which. Here’s a short description of three key bills in Washington’s 2022 session. ACLU of Washington’s Bill Comparison Chart has a high-level comparison.
💜 HB 1433, the People’s Privacy Act 💜, sponsored by Rep. Shelley Kloba (D-Kirkland), protects people, not corporations, and was drafted working with Tech Equity Coalition organizations to ensure it prioritizes the needs of communities most harmed by surveillance and data abuse. Dozens of civil rights, immigrant rights, privacy, civil liberties, and progressive activism groups support the 💜 People’s Privacy Act 💜. Unfortunately, it didn’t get a hearing in 2021, and hasn’t gotten a hearing this session either — at least not yet.
For more on the People’s Privacy Act, see
- Seattle Times op-eds Washington needs a privacy law that protects people, not corporations (by Aneelah Afzali of MAPS-AMEN, Jennifer Lee of AC-WA, and Jon Pincus)
- The People’s Privacy Act, not the Washington Privacy Act, is the better bill to protect consumers’ civil rights and civil liberties (by Jennifer Lee) discuss the bill.
- The People’s Privacy Act: How you can help protect Washingtonians’ privacy, slides and a video from the Washington Indivisible Network, go into a lot more detail.
SB 5062, the Bad Washington Privacy Act 👎🏽, sponsored by Sen. Reuven Carlyle (D-Amazon), passed the Senate 47-1 last year with only Sen. Bob Hasegawa voting no, but was rejected by the House. Microsoft, Amazon, Google, Washington Technology Industry Association (WTIA), TechNet, and trade associations like Washington Retail Association. AG Ferguson blasted SB 5062 in a letter to the legislature in December, noting that it would not just weaken Washingtonians existing rights, but also negatively impact his office’s open data privacy investigations. To be fair, SB 5062 does contain some improvements over earlier versions of the Bad Washington Privacy Act. The 2020 version SB 6281 👎🏽, for example, was unenforceable, but nonetheless passed the Senate 47-1 with industry lobbyists talking about its “strong consumer protections” and only Sen. Bob Hasegawa voting no.
For more on the 👎🏽 SB 5062 👎🏽, see
- We Need Real Privacy Protection in the States, not the Washington Privacy Act’s Illusion of Privacy by Consumer Federation of America (which links to a more-detailed analysis), and her testimony discussing the loopholes that neuter protection
- The Washington Privacy Act: Not a model for state privacy law by former Microsoft compliance lead N. Gregg Brown discuss problems with the Bad Washington Privacy Act, along with his testimony discussing how the bill is unfair to Washingtonians.
- Ashley Del Villar of La Resistencia on how the Bad WPA leaves immigrants vulnerable to data exploitation
- Emilie St. Pierre of Future Ada and testimony on how the Bad WPAs opt-out approach fails to protect survivors of stalking, harassment, and domestic violence.
- Brianna Auffray on why CAIR-WA opposes the Bad WPA
- Jen Lee of ACLU WA on why we need the People’s Privacy Act and SB 5062’s “illusion of privacy”
- Cynthia Spiess on how the Bad Washington Privacy Act’s opt-out approach harms people with accessibility challenges or limited English skills.
- We need a data privacy law; but Senate bill isn’t it by former Republican state legislator Norma Smith and two Indivisible activists (which highlights the bipartisan aspects of the privacy discussion)
- The Washington Privacy Act: Insufficient for the immigrant, refugee communities we serve, Derek Lum of Interim CDA in the International Examiner
- Silence is Not Consent by Emilie St. Pierre of Future Ada
- Real Electronic Data Protection Is Opt In , Brandy Donaghy, Demcast. At the time Brandy was one of the leaders of Indivsible Plus Washington; during the 2022 legislative session, she was Rep. Brandy Donaghy (D-44).
- The Bad Washington Privacy Act: An Illusion of Rights And As Cher Would Say, “What a Monet” by Deborah Pierce
- AG Ferguson’s unpublished December 2021 letter to legislators.
HB 1850, the Foundational Data Privacy Act, sponsored by Rep. Vendana Slatter (D-Redmond) and Rep. April Berg (D-Snohomish), combined a proposal for a data privacy commission, funded by fees on data collectors, with language largely inherited from the Bad Washington Privacy Act 👎🏽 but some improvements and a weak private right of action. At HB 1850’s Civil Rights & Judiciary (CR&J) hearing in January, industry groups opposed the bill claiming it would cause the sky to fall. Tech Equity Coalition members and progressive activists were OTHER, noting the bill’s potential and highlighting areas that needed to be improved.
- Your digital privacy rights need a stronger shield, by Reps. Berg and Slatter in the Everett Herald, makes the case for HB 1850.
- ACLU of Washington’s Feedback on HB 1850 highlights many of the issues in the initial version of the bill.
- A Deep Dive into the Affiliates Loophole looks at the challenges of making even small improvements to the Bad Washington Privacy Act 👎🏽
- Washington Technology Industry Association CEO Michael Schutzler’s misleading Seattle Times op-ed has entertaining talking points starting with the false claim in the first paragraph that HB 1850 “would fundamentally impair the functioning of online apps and tools as we know them today” and ending with an impassioned call to legislators to “stop looking backward” and pass the version of SB 5062 👎🏽 they had rejected last year.
Substitute versions and amendemnts
SHB 1850 was an amended version advanced by the CR&J committee, which had valuable improvements in the definitions of “sharing” and “targeted advertising”, but further weakened the already-weak private right of action. At SHB 1850’s Appropriations 💰 hearing in early February, industry groups continued to oppose SHB 1850 claiming it would cause the sky to fall even more than the original bill. Tech Equity Coalition members and progressive activists remained OTHER, continuing to highlight areas that needed to be improved. Appropriations’ cutoff to advance SHB 1850 was February 8, and there was speculation they might move it as a title-only bill as they had in 2019 with an earlier version of the Bad Washington Privacy Act 👎🏽. Instead, they designated the the bill NTIB (Necessary To Implement Big tech’s agenda), meaning that the usual deadlines don’t apply.
2SHB 1850, introduced in late February. cut the bill back significantly, removing its regulatory aspects. Now, the new data privacy commission, with no transparency or public oversight, is supposed to enforce S-…/22⁉️. 2SHB 1850 clarifies that commission is funded by a new “annual fee” of 0.1% of intrastate revenues, that the bill’s critics describe as a tax. 2SHB 1850 further weakened the already-weakened private right of action. Despite questions from Rep. Pollet revealing that the bill as written commission to dismiss complaints in a secret hearing. The House Appropriations committee nevertheless voted 17-16 to advance 2SHB 1850 during their February 28 executive session. At the cancelled Senate Ways & Means 💰hearing, almost everybody opposed 2SHB 1850.
S-…/22⁉️ was an unpublished striker amendment to SB 5062 👎🏽 referred to in the text of 2SHB 1850. Washington state has a reputation for “good government” so it might seem surprising that the House was on the verge voting on a bill creating a new state agency to enforce an unpublished amendment, but experienced legislative observers aren’t surprised.
SB 5062/S-…/22/2SHB 1850 referred to a hypothetical version of 2SHB 1850 amended to include S-…/22⁉️ (which in turn includes SB 5062). Taking this approach could avoid the need to have any House hearings on S-…/22⁉️ or SB 5062. Whether or not this is a good thing depends on how badly you want the Bad Washington Privacy Act 👎🏽 to pass.
5062-S2 AMS CARL S4439.6 👎🏽 (aka SB 5062 amendment 1484 ) was the version of S-…/22 that was finally of published on March 6. As expected, it was a mashup of 2SHB 1850 and last year’s SB 5062 👎🏽.
💜 People’s Privacy Act 2.0 💜 and Foundational Data Privacy Act 2.0 are hypothetical future versions of the bills , revised working with the communities most harmed by surveillance and data abuse, incorporating improvements from other strong privacy legislation like the Massachusetts Information Privacy Act (MIPA) and the New York Privacy Act.