In our prior blog post, we discussed how the Washington Privacy Act (WPA) had passed the state’s senate and would be taken up by the state’s House of Representatives. On March 22, 2019, the House Innovation, Technology & Economic Development Committee held a public hearing on the legislation. A recording of the almost two-hour hearing is available here.
Although the WPA passed nearly unanimously through the state senate, the house version of the legislation includes significant deviations from the senate bill. A great side-by-side comparison of the two bills prepared by Committee Staff member Yelena Baker is available here. Some of the more notable differences are:
- Private Right of Action: The house version would allow private litigants to bring actions against controllers for violations of the WPA. The proposed language would require a consumer to first notify the controller of the alleged violation and provide it with 30 days to cure. In the absence of a cure, the consumer would have to notify the Attorney General’s office of the consumer’s intent to bring an action. If the AG’s office did not act in 30 days, the consumer could file suit. However, the consumer would not be able to recover its attorneys’ fees and costs in the lawsuit.
- Covered Entities: The senate version would apply to legal entities that are doing business in Washington or that produce products or services that are intentionally targeted to Washington residents and that either control or process data of 100,000 or more Washington residents or that derive 50% of their gross revenue from the sale of personal data and that process or control personal data of 25,000 or more Washington residents. The house version would only require that entities be doing business in Washington or produce products or services that are intentionally targeted to Washington residents.
- Definition of Personal Data: The house version would not exclude “publicly available information” from the definition of personal data.
Numerous witnesses testified at the committee hearing. The general takeaway was that business advocates felt that the senate version of the WPA was preferable with many witnesses citing the inclusion of the private right of action in the senate version as being problematic. Privacy advocates were of the opinion that both bills were deficient but that the house version was better. There also was significant disagreement over whether the WPA would provide stronger consumer protections than the CCPA.