Last month, Senator Reuven Carlyle (D-WA) presented an updated draft of the Washington Privacy Act (WPA) on Twitter, suggesting that the Act will be up for consideration in the state’s 2021 legislative session. After having failed to pass through the Washington State Legislature earlier this year and the year before, this will now be Washington’s third attempt to pass a comprehensive state-level privacy law. As Senator Carlyle notes, the draft bill covers both public and private sector management of consumer and key health data, and the bill is now available for public comment.
Third time’s a charm?
The draft of the bill that Senator Carlyle recently posted borrows much from the language that was under consideration earlier this year during the 2020 legislative session. Although the draft remains subject to further revision, there are certain noteworthy provisions:
- In light of COVID-19 and given “contact tracing technology is rapidly evolving,” the bill introduces specific protections for the handling of personal data collected from consumers in Washington during public health emergencies. To “instill public confidence on the processing use of their personal and public health data during any global pandemic,” the WPA draft now requires both the public and private sectors to provide notice and obtain clear affirmative consent from consumers when processing their geolocation data, proximity data, or personal health data for a covered purpose. As applied to public health emergencies, “covered purposes” specifically encompass activities (such as symptom detection and contact tracing) that may be used to help monitor and manage the rise of infectious diseases like COVID-19.
- The draft bill introduces a private right of action; however, as drafted, it appears to only apply to Part 3 of the WPA, which is the section covering the rights and protections to be granted by the public sector during public health emergencies. During the 2020 legislative session, a debate over the inclusion of a private right of action prevented the passage of the WPA. Therefore, Carlyle’s introduction of a narrow private right of action appears to be a compromise to ensure the WPA passes during the upcoming 2021 legislative session.
- As with the previous drafts of the WPA, the new draft of the bill includes exercisable rights for consumers regarding their personal data that are similar to those set forth in the European General Data Protection Regulation and the California Consumer Privacy Act (CCPA). Among these rights are a right to correction, deletion, and opt-out of certain personal data processing.
- The WPA defines the “sale” of personal data as the exchange of such data to a third party for valuable consideration, which is generally consistent with how “sales” are defined under the CCPA. However, the WPA and CCPA contain various distinct exceptions to the general definition of “sales,” thereby resulting in different outcomes on how “sales” would be handled under each of the two laws.
No action required (yet)
On January 11, 2021, the next legislative session for the Washington State Legislature will convene, at which point the fate of the WPA will again be in the hands of the Senate and the House. Companies that may ultimately be subject to the WPA should thus remain mindful of the WPA’s developments in the coming year, including any revisions that may be incorporated into Senator Carlyle’s draft of the bill.
Client Alert 2020-558