Automated Decision Systems regulation advances, but no hearing yet on the People's Privacy Act: Washington state legislation update

It's been a busy few weeks in the Washington state legislature! But before we get to the update, here are three actions you can take right now if you're a if you're a Washingtonian who wants to protect our privacy.

The People’s Privacy Act, not the Washington Privacy Act, is the better bill to protect consumers’ civil rights and civil liberties, a Seattle Times op-ed by Jennifer Lee of ACLU of Washington, is a great short summary of the differences between the two privay bills.

The People’s Privacy Act: How you can help protect Washingtonians’ privacy , on the Indivisible Plus Washington blog, has a lot more information for activists, including the video and slides from a webinar Jennifer and ACLU of Washington organizer Savannah Sly did with Indi+ and Washington Indivisible Network.

And now, on to the update!

Automated Decision Systems regulation advances!

Let's start with some very good news is that the Senate State Government and Elections committee gave a "do pass" recommendation to SB 5116 (Accountability and Transparency Standards for Automated Decision Systems).

As I discussed in A good hearing on Automated Decision Systems, there's a lot of support for this groundbreaking legislation. Since the hearing, state and local government agencies have been working with the bill's sponsor to resolve some very valid concerns. During the executive session, Sen. Hasegawa suggested that another amendment was on its way that would get it into final form. So far, it's all very encouraging!

Next step for SB 5116: the Senate Ways & Means Committee, which looks at the bill's fiscal impact.

Hot Ways & Means Action on SB 5062

And speaking of Ways & Means, SB 5062 (the Bad Washington Privacy Act) had a hearing there on Monday. Tech Equity Coalition members and others had some sharp criticisms of the weak, industry-backed bill's paltry enforcement budget – $1.4 million over the next two years, only enough for 3.6 full-time equivalent (FTE) employees. The Attorney General's Office (AGO) projects that they'll be bringing 3 investigations per year. Good luck to the 1.2 FTEs taking on Facebook or Google!

As I pointed out in my testimony, Ireland has a population smaller than Washington, and it's Data Protection Commission's budget is $23 million per year. Jennifer Lee noted that even with their much larger budgets, European data protection enforcement has been held back by lack of resources. Joseph Jerome noted that Facebook has 150 privacy lawyers, and that large companies average 15.

Given the budget pressures here due to the pandemic, there's no way they'll budget anywhere near that much ... so we didn't even ask for that. Instead, we focused on adding a private right of action, as the AGO has repeatedly requested.

I thought we made a strong case, but then again Ryan Harkins of Microsoft praised the bill's "robust" enforcement. So we'll see what happens.

Here's the video. (My testimony's at 23:15. The Chair said she appreciated that I focused on fiscal issues ... I feel like I got an A on a presentation!) I also live-tweeted it, and Joseph Jerome has some reflections on the hearing here.

And whenever I hear "Ways & Means" I think of the Concrete Blonde song Bloodletting. So here's the video. We got a lot to think about ... oh yeah.

No hearing for SB 5104 (the Facial Recognition Moratorium)

The news is not so good with the Facial Recognition Moratorium. Senate Energy, Environment, and Technology (ENET) Committee Chair Sen. Carlyle decided not to give a hearing to the bill.

Last year, there was a lot of support for a moratorium, but the legislature wound up passing a compromise bill written by Sen. Joseph Nguyen of Microsoft. Since then, Microsoft and Amazon have both announced voluntary partial moratoriums on facial recognition, the Seattle Police Department has been caught secretly using Clearview AI, cities including Portland, Boston, and New Orleans have passed moratoriums and bans, and there have been several more reports of facial recognition systems leading to Black people getting arrested for crimes they didn't commit.

But as I predicted in my testimony last year, once a weak bill is passed, it becomes a lot harder to pass a strong bill. My guess is that Sen. Carlyle and Sen. Nguyen convinced their colleagues on the committee that since the legislature had just acted last year, passing legislation that Microsoft described as "robust", they didn't need to do anything.

Facial recognition is an automated decision system, so SB 5116 will provide some regulation – although not a complete moratorium.

The People's Privacy Act must be heard!

The People's Privacy Act, HB 1433, also has some limitations on facial recognition. It's got a lot of other good stuff too. Here's Jennifer Lee's quick summary:

The People’s Privacy Act is founded on the assumption that everyone’s privacy should be protected by default and that people’s data should not be used without their affirmative, opt-in consent. It gives people the right to know what data companies have about them and the right to correct and delete their information. It prohibits companies from using, selling or sharing data without people meaningfully given consent, which is the true gold standard for privacy.

HB 1433 also makes it unlawful for companies and government agencies to use people’s personal information to discriminate and bans use or installation of facial recognition technology or equipment incorporating artificial intelligence-enabled profiling in any place of public accommodation (like restaurants, hotels, theaters, pharmacies, parks, schools and stores). The People’s Privacy Act ensures local jurisdictions can advance stronger privacy laws if they wish, protecting community voices. Finally, it provides meaningful enforcement through a private right of action that empowers people to take companies to court for privacy violations.

Rep. Shelley Kloba is sponsoring the Peoples Privacy Act, which was created by ACLU of Washington with input and support from the Tech Equity Coalition, a group of civil liberties and civil rights-focused organizations and individuals working to lift up the voices of historically marginalized and disproportionately surveilled communities in decisions about technology.

Alas, the People's Privacy Act hasn't been scheduled for a hearing yet either. Dozens of groups around the state signed on to the Tech Equity Coalition's letter asking for the bill to get heard. Indivisible Plus Washington sent a letter to House Civil Rights & Judiciary (CR&J) Chair Rep. Drew Hansen and the rest of the committee requesting a hearing.

But with the "policy cutoff" deadline on February 15, it looks like CR&J is going to punt for now and instead wait for the Senate to send over the Bad Washington Privacy Act as a starting point. It's disappointing, although not particularly surprising, because this is the same strategy that didn't work the last couple of years.

Activism is hard.

No worries, though. As we discussed at The People’s Privacy Act: How you can help protect Washingtonians’ privacy, we've got an activism plan B and plan C as well!

Take action!

If you've made it all the way to the bottom of this post, you probably care a lot about privacy! So if you're a Washingtonian who wants to support the People's Privacy Act and oppose the Bad Washington Privacy Act, here's three things you can do today!