I write to urge you to oppose 2SSB 5062, an industry-backed data privacy bill that does not meet the bare minimum standards to protect the privacy of Washingtonians. 2SSB 5062 must be significantly amended with the suggested changes below or should not be passed.
2SSB 5062 does not empower people to understand, exercise, and enforce their privacy rights. Instead, it largely upholds the status quo, in which companies can use people’s data with few restrictions. We have already learned that we cannot rely on corporations to police the ways in which they collect, use, and share our personal information. In just the past year, we learned that data from Muslim prayer and dating apps were sold to US military agencies, putting the Muslim community at further risk of discriminatory profiling; menstrual cycle tracking apps shared private health information such as period dates and pregnancy plans with Facebook; and with the rise of remote learning tools, companies have been collecting highly sensitive data about students, with few restrictions on how they can use or sell that data. 2SSB 5062’s opt-out framework, its many loopholes, and under-resourced, weak enforcement framework will not protect people.
In our increasingly data driven society, we need a strong privacy law — not weak legislation lauded by the very tech companies that stand to profit from data abuse.
The following changes must be made to 2SSB 5062:
1. Change 2SSB’s opt-out framework to an “opt-in” framework where companies must get permission to collect, use, or share people’s data.
2. Strengthen enforcement by including a private right of action, which would allow people to enforce their privacy rights.
3. Remove the preemption provision, and set a floor, not a ceiling for local governments to pass stronger privacy laws where applicable.
4. Close the numerous loopholes present in the language and definitions that enable tech vendors and data brokers to sidestep regulations.