Why This Privacy Law is Important:
If passed, the Washington Privacy Act would enact a comprehensive data protection framework for Washington residents that includes individual rights that mirror and go beyond the rights in the California Consumer Privacy Act (CCPA), as well as a range of other obligations on businesses that do not yet exist in any U.S. privacy law.”
Included in the law is a regulation of facial-recognition technology. The WPA would require affirmative, opt in consent as the default requirement for facial recognition.
Overview/Status of Bill:
It is an updated version of the bill that made significant progress in 2019. After a nearly unanimous vote in the Washington Senate, the 2019 bill failed to pass the House of Representatives.
Need to Know Information:
- Who it Applies To: Legal entities that conduct business in Washington OR produce products or services targeted to Washington residents. The Act would not apply to state and local governments or municipal corporations.
- What is Covered: “personal data” in the WPA is defined broadly as “any information that is linked or reasonably linkable to an identified or identifiable natural person” (not including de-identified data or publicly available information “information that is lawfully made available from federal, state, or local government records”), with specific provisions for pseudonymous data.
- Potential Penalties: The WPA caps civil penalties for controllers and processors in violation of the Act at $7,500 per violation.