The Washington Privacy Act (WPA) failed to make it through the house before April 17, the last day to consider non-budget policy bills in the Washington legislature. Despite passing through the senate with overwhelming support (as previously reported), the WPA stalled in the house due to differences between the senate and house bills. As a result, it is unlikely this year that Washington will follow California as the second state to pass comprehensive privacy legislation.
The differences between the senate and house bills are meaningful. For example, the house bill:
- broadens the jurisdictional scope by removing qualifying thresholds;
- removes publicly available information from the definition of personal data;
- allows for the processing of personal data if a risk assessment shows substantial risk in doing so only upon consumer consent;
- adds additional requirements for the use of facial recognition technology; and
- provides a private right of action.
Unresolved differences in the bills indicate that the WPA will die in Washington’s current session.
Bill sponsor Senator Reuven Carlyle tweeted that the bill “passed the #waleg Senate with [an] unprecedented 46-1 vote. We built alignment that well-crafted, strong #dataprivacy is imperative to consumers and society. Unfortunately, [the] House failed to pass privacy legislation this year. We’re committed to 2020.”
The last day of Washington’s current session is April 28. Legislators can still pass the bill if they come to an agreement before the end of regular session. However, passage appears to be very unlikely. Despite the WPA’s grim outlook, Washington is one of several states that have introduced comprehensive privacy bills this year. Other states include Hawaii, Massachusetts, Rhode Island, and Texas. As state legislative sessions are coming to a close, the likelihood that any particular bill will pass is slim. However, the mere presence of such bills may suggest the type of legislation that will be introduced in the future.
