House Amendments Jeopardize New Protections for Washington Consumers
(What follows is a commentary by privacy lawyer Mike Hintze, Hintze Law who supports SB 6281 to extend new consumer privacy rights regarding data stored after online purchases)
If enacted, the Washington Privacy Act, currently being considered in the state legislature, would be the strongest, most comprehensive privacy law in the country. It would give Washington residents new rights and new protections they do not currently have under either state or federal law. It would require companies to take new steps to be transparent with consumers, to provide consumers with unprecedented levels of control over how personal information is used, shared, and retained, and to implement additional safeguards designed to protect the information they hold.
In particular, the scope of consumers’ rights afforded by the bill is unmatched and unprecedented. It would give consumers the right to access personal data that has been collected about them, and to correct such data when it is inaccurate or to have it deleted entirely. Consumers would have a right to opt-out from sales of personal data, the use of personal data for targeted advertising, and other types of individual profiling. Companies would have to obtain the consent of consumers for the collection or use of sensitive data and for any use of personal data unrelated to the purpose for which it was collected. And the bill creates a new set of stringent rules around the use of facial recognition that requires individual consent in most cases.
Again, these are all rights and protections that Washington consumers do not have today. The Washington Privacy Act represents a thoughtful and balanced approach that dramatically increases consumer protections and rights, while at the same time allowing responsible businesses to use data in ways that benefit consumers and the public. However, certain House amendments would disrupt the balance reflected in this bipartisan bill that passed the Senate 46 to 1.
In particular, the Senate bill vests enforcement authority in the state Attorney General, who can use existing investigatory powers to hold accountable those companies that violate these new rights and protections. This is a sensible approach that allows for the Attorney General to thoughtfully focus its enforcement activities on the truly bad actors who cause actual harm to Washington consumers, while at the same time providing guidance to companies trying to do the right thing.
By contrast, certain House amendments, being pushed by several advocacy organizations, would create a private right of action that allows plaintiffs’ lawyers to bring class-action lawsuits to enforce the law. While this may sound like an attractive addition to make this strong privacy bill even stronger, a private right of action would be a mistake for several reasons.
Unleashing plaintiffs’ lawyers to pursue private rights of action in the form of class-action lawsuits in this environment will have an entirely different effect than enforcement by the Attorney General. Private rights of actions incentivize plaintiffs’ lawyers to focus on technical violations of the law that are easy to prove, rather than those that actually cause harm. This, in turn, will lead to companies prioritizing the wrong thing and creating greater uncertainty.
For instance, dealing with multiple plaintiffs’ counsels filing “gotcha” lawsuits for technical violations, often hoping to score quick settlements from companies that cannot afford to risk drawn-out litigation, will divert company resources and attention from the compliance work the Act intends to encourage. And this will incentivize companies to focus on avoiding those visible, technical violations rather than more fundamental compliance work that actually benefits consumers and avoids actual harms.
The threat of private right of actions also creates disincentives for companies to be more forthcoming about privacy incidents. This will undermine the ability for consumers to be informed and for the industry as a whole to collectively learn from the experiences of others and is contrary to the intent of the Act to drive greater transparency.
And unlike enforcement and guidance coming exclusively from the Attorney General, large numbers of private lawsuits will inevitably result in a wide range of differing settlements and conflicting court cases which will bring even more uncertainty to the interpretation of the Act.
Further, for the worst privacy violations – those that would be considered unfair or deceptive business practices – consumers already have a private right of action under the existing Consumer Protection Act and nothing in this new legislation will take that away.
Finally, and perhaps most importantly, these House amendments threaten to unravel the broad coalition of interests that have come together to make this groundbreaking legislation possible.
The majority of businesses in Washington State have come to recognize that as the ability to collect and analyze data for beneficial and valuable purposes becomes more powerful, maintaining the trust of consumers is essential. These Washington businesses also understand that ensuring strong legal protections for consumers is a key part of maintaining that trust. That is why a growing coalition of business and other interests is urging the legislature to enact the bill as passed by the Senate. And it is that shift in favor of strong statutory protections for consumer privacy that has created a historic opportunity to adopt the country’s strongest comprehensive privacy bill.
Of course, it should be no surprise that there are bad actors out there – companies that do not value consumer trust and have little interest in protecting privacy. This law would make them more accountable for those irresponsible data practices. And as a result, these companies would rather see this legislative effort fail, leaving Washington consumers without the protections afforded by this bill. What is surprising is that these bad actors have found such willing allies with the advocacy groups that appear content to see their inflexibility lead to the same result.
Mike Hintze is a partner with Hintze Law PLLC and an affiliate instructor of law at the University of Washington Law School who specializes in privacy and data security law and represents a wide range of Washington employers.
