Will The Third Time Be The Charm For Washington State’s Data Privacy Law?

On September 9, 2020 Washington State Senator Reuven Carlyle announced on Twitter that an updated draft of the Washington Privacy Act (“WPA”) had been released for public review and feedback, suggesting that the WPA will be up for consideration in the state’s 2021 legislative session. This will be Washington’s third attempt to pass a comprehensive privacy law (the legislature twice failed to pass similar legislation in the prior two years).

Third time’s a charm?

This version of the Washington Privacy Act draft bill is similar in nature to the second attempt, which failed earlier in 2020. In addition to the draft bill, the Washington legislature has posted a summary of the bill’s provisions, and companies should take note of the following potential implications, should the bill be passed:

In light of COVID-19, the bill introduces specific protections for the handling of personal data collected from consumers in Washington during public health emergencies. These protections include notice and affirmative consent requirements for activities such as contact tracing
The draft bill introduces a private right of action that applies to Part 3 of the WPA, which is the section covering the rights and protections to be granted by the public sector during public health emergencies. Note that the second version of the WPA failed in large part due to squabbling over whether to include a private right of action, so this narrow provision may be an attempt to compromise
Consumers will be granted rights regarding their personal data that are similar to those enumerated in Europe’s General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (“CCPA”). Among these are rights to correction, deletion, and opt-out of certain personal data processing
The Washington Privacy Act defines the “sale” of personal data as the exchange of such data to a third party for valuable consideration, which is generally consistent with how “sales” are defined under the CCPA. However, the WPA and CCPA include different exceptions to the general definition of “sales,” which may result different outcomes on how “sales” would be handled under each of the two laws