The Washington state legislature is about to vote on the Bad Washington Privacy Act (SB 5062). Defenders of this bill would like us believe that this bill is a "gold standard" with “strong protections” and “unambiguous rights”. In reality, the current version of the bill codifies the status quo. It protects tech industry’s rights, but leaves the privacy rights of the people almost completely unprotected.
The bill is a "full-on Monet." As Cher says in the 1995 movie Clueless, "It's like a painting, see? From far away, it's okay, but up close, it's a big old mess."
SB 5062 “right” to opt-out of having your data collected and sold to a data broker, or used for targeted advertising, is just one example of “a big old mess” found in the bill. Opt-out means that companies can generally do what they want with your data (subject to their privacy policy) unless you tell them not to. It’s the opposite of “opt-in,” where companies can’t collect or sell your data without getting your informed, affirmative consent.
With opt-out, the onus is on the individual to discover that personal information is being collected about them, and then figure out how to "opt-out" of that data collection. The process is so convoluted that the risk is that people will give up trying to navigate the privacy policy and opt-out process and let corporations collect our data anyway. This is exactly what Google, Microsoft, and Amazon want - which is why they’re big supporters of the Bad Washington Privacy Act.
The types of data collected by tech companies, advertising companies and others isn’t limited to browser, device, and usage data, such as the type of computer you’re using, the software, or even your IP address. As Norma Smith, a former Republican Washington state legislator notes in her op ed in the Everett Herald, data collected might include health information and your political views – in other words, very personal information.
Opting out can be a challenging process requiring technical skills and time not readily available to many people. For people who are not technically inclined, or who have low English proficiency, opt-out can present a significant barrier to meaningfully control one’s data.
Even after you’ve discovered how to opt out, the Bad Washington Privacy Act makes it difficult to actually make this happen. According to provisions in the bill, individuals are required to send a request to the "data controller". The data controller has 15 days to respond to you. They can extend that to 45 days if they feel they need to. Then they can refuse to honor your request. You can appeal, but that's going to take another 30 days. That can lead to a full 90 days before, maybe, just maybe, you might be able to opt-out. No guarantees, of course.
Suppose that after full 90 days, you haven't heard back or your appeal has been denied? You're angry, so you decide to sue them. If you eventually win your lawsuit, then they finally have to let you opt-out, and maybe pay your attorney’s fees - but again, no guarantees. They don’t have to pay any penalties or damages for the harm they’ve caused.
The Attorney General is allowed to sue for damages and penalties. But the money allocated for enforcement is only is enough to hire 3.6 full-time employees. For the entire state. The budget is less than a quarter of what the tiny Grand Duchy of Luxembourg, a tenth the size of Washington, spends to enforce its privacy laws.
The legislature still has a chance to fix the Bad Washington Privacy Act and pass a strong privacy bill that really protects us. Rep. Shelley Kloba has introduced an amendment that makes the bill fully-opt in. It also give us all the right to sue for money damages — just like we can sue companies that harm us in other ways — and has penalties for companies that break the law. So hopefully the legislature will pass the Kloba amendment, and take an important step to giving us strong privacy protections based on meaningful rights.
But the one thing they shouldn't do is pass the current version of the Bad Washington Privacy Act and settle for the illusion of rights, continuing to leave us all at risk. Once a bad bill is passed it is very hard to change. I know there's a temptation to feel like we must pass something, but waiting another year and truly protecting our privacy is much better than passing this bad, “full-on Monet” of a bill.
Image via Best Quotes From Clueless Movie, Refinery 29