The stakes are high: Washington state privacy, facial recognition, and automated decision systems legislation 2021

Most recent update: January 30.

Washington is justifiably looked to as a tech-savvy state, and legislation that gets passed here will influence other states and the national debate.   It's a challenging time to be doing state legislative work, but the mostly-remote session kicked off as scheduled on January 11 and things are off to a fast start.

Some really exciting tech bills, with a strong focus on equity and justice, really do give Washington a chance for leadership.  On the other hand, the last two legislative sessions have started off with high hopes for passing a privacy bill ... and it didn't happen.  So the stakes are high!

Here are three important bills that can establish Washington as a leader.

• HB 1433, The People's Privacy Act protects people, not corporations.  This groundbreaking bill was collaboratively developed by the Tech Equity Coalition a group of civil liberties and civil rights-focused organizations and individuals working to hold technology accountable), ACLU of Washington, and Rep. Shelley Kloba.  It applies to government agencies as well as corporations, requires opt-in (affirmative consent) for sharing data, prohibits using people’s personal information to discriminate, and bans facial recognition and artificial intelligence-enabled profiling in schools, stores, parks and any other place of public accommodation.  It also includes a private right of action, so that people can hold corporations accountable.  Find out more at Introducing the People’s Privacy Act: Real Privacy Protections for Everyone on ACLU of Washington's site.  
• SB 5104, Concerning a moratorium on facial recognition technology, sponsored by Sen. Bob Hasegawa, would stop state and local government agencies from adopting a technology that causes false arrests, denial of benefits, and other harms – harms that fall disproportionately on communities of color and LGBTQIA+ people.   Sentiment against facial recognition technology has continued to grow over the last year, with coverage of false arrests and other abuses; Microsoft and Amazon (as well as Google, IBM, and other tech companies) have voluntarily started partial moratoriums.   So far, though, SB 5104 hasn't been scheduled for a hearing.
• SB 5116, Accountability and Transparency Standards for Automated Decision Systems, also sponsored by Sen. Hasegawa, establishes minimum standards for fairness and accountability in automated decision systems, and ensures public transparency and approval before these systems are acquired.  It also prohibits state agencies from developing or using automated systems to discriminate against people.   A good hearing on Automated Decision Systems has more on SB 5116's very positive hearing.

On the privacy side, there's also Sen. Reuven Carlyle's weak, pro-corproate SB 5062, the Bad Washington Privacy Act.   SB 5062 is headed to the Senate floor after a hearing where Tech Equity Coalition members and others fiercely criticized it, but Microsoft and various industry associations supported it.  

In 2019 and 2020 the Senate passed even weaker pro-corporate bills from Sen. Carlyle overwhelmingly so it may well once again sail through.  Will we see a repeat of 2019 and 2020, when the House strengthened and improved bad Senate bills, but the Senate said "no we want the bad version", and negotiaions collapsed? Hopefully the People's Privacy Act will change the legislative dynamics enough to get a better outcome this time!  Joseph O'Sullivan's European-style data privacy bill returns, in the Seattle Times, is a good overview of the situation as of late January.

There were also legislative battles over facial recognition in 2019 and 2020 as well.  Last year, Rep. Debra Entenman fought for a moratorium, but there wasn't enough support; the legislature eventually passed a bill she described as a sensible compromise.  Since then, Microsoft and Amazon, as well as Google, IBM, and other tech companies, have voluntarily started partial moratoriums.   Portland, New Orleans and other cities have enacted local bans (and Portland's is the strongest yet).  Will the legislature have the political will for a moratorium this year?   One again, we shall see.

The Tech Equity Coalition supports SB 5104 and SB 5116 as well as  the People's Privacy Act.   One thing I want to highlight is the connections between the issues the three bills cover.   As AI accountability expert Deborah Raji says

A reminder that all of machine learning, not just facial recognition, encourages the proliferation of surveillance infrastructure of all sorts. Our hunger to hoard & capture data of all forms, whether through web cookies or a camera, is tied to an increasing data requirement.

A couple of specific examples:

• Data brokers acquire data from Muslim prayer apps and share it with a contractor who's part of the ICE "supply chain", who then plug it to algorithmic decision making systems sold by companies like Palantir.   The People's Privacy Act requires consent for this kind of data sharing, covers government agencies like ICE and the military (who SB 5062 exempts).   SB 5116's transparency requirements force these kinds of abuses to be disclosed.
• Nijeer Parks was arrested for a crime he did not commit based on a bad facial recognition match, and then denied bail because New Jersey’s no-bail algorithmic decision system decided he was a risk.  The People's Privacy Act prohibits facial recognition systems in places of public accomodations.  SB 5104's facial recognition moratorium stops additional deployment of these biased and inaccurate systems.  SB 5116's transparency requirements force disclosure of the algorithms used in the risk assessment system, and prohibit ongoing use if they are biased.

Other important Washington state bills also tackle some of the ramifications of this.  SB 5010, for example, prohibits insurers' from the discriminatory practice of using of credit scores to determine rates.  HB 1078 restores voting rights to Washingtonians directly impacted by our biased criminal legal system.  The three bills I'm highlighting here complement these vital targeted fixes with broader solutions to the systemic issues.

Background links

This is an incredibly complex space, and especially for people who are fairly new to it, there's a lot to catch up on.   Here's a list of short articles (with a couple of longer pieces thrown in) that are useful background for the different bills.

• The Boston Celtics players' Regulating facial recognition technology is a racial justice issue, Veena Dubal's San Francisco was right to ban facial recognition. Surveillance is a real danger,  and Microsoft researcher Luke Stark's Facial Recognition is the Plutonium of AI make the case for a facial recognition moratorium.  EFF's Banning Government Use of Face Recognition Technology: 2020 Year in Review looks at the momentum for this kind of legislation in Portland, Massachusetts, and New Orleans.
• Deborah Raji's How our data encodes systematic racism and Julia Angwin's Machine Bias series are good introductions into algorithmic inequities.   Ruha Benjamin's The New Jim Code has lots more detail.  
• The Office of the Insurance Commissioner's  Now is the time to ban credit scoring and Melissa Santos' Bad credit shouldn't mean higher insurance rates, WA official says discuss SB 5010 and highlight how credit scores (computed by algorithmic decision systems, using data from data brokers that was acquired without people's knowledge) discriminate aginst lower-income people and communities of color.
• The Parent Coalition for Student Privacy's SB5062 does not go far enough to protect consumers or students looks at some of the problems with the Bad Washington Privacy Act.
• How the U.S. Military Buys Location Data from Ordinary Apps and Leaked Location Data Shows Another Muslim Prayer App Tracking Users, both by Joseph Cox in VICE, discuss some scary examples of apps data being sold without users' knowledge or informed consent.   NYPD settles lawsuit after illegally spying on Muslims and the San Francisco Human Rights Commssion's Post 9/11 Surveillance and Profiling of Arab, African, Middle Eastern, Muslim and South Asians (AAMEMSA) Communities are important context, looking at suspicionless surveillance programs that went on for years after 9/11.
• New York’s Contact Tracing Privacy Bill: A Promising Model, from the Brennan Center, talks about the New York state Covid legislation that several of us suggested the legislature look to as a model.
• This is the Stanford vaccine algorithm that left out frontline doctors, on MIT Technology Review, looks at how even a simple algorithm can have disastrous consequences.   3 lessons from Stanford’s Covid-19 vaccine algorithm debacle in STAT notes that "the tool appears not to have accounted for workers’ actual exposure to the virus and changes to hospital rules and protocol during the pandemic."  Transparency requirements help surface these kinds of problems.  Algorithms and the Coronavirus Pandemic, in the Financial Times, looks at other pandemic-related algorithmic issues and the growing "backlash" to automated decision systems.  
• Closing the AI Accountability Gap: Defining an End-to-End Framework for Internal Algorithmic Auditing, by multiple researchers including Deborah Raji,  Timnit Gebru, and Margaret Mitchell.   At the time, Gebru and Mitchell led Google's Ethical AI initiative.  Gebru has since been fired, and Google is currently targeting Mitchell as well.