By Tom James
The Associated Press
OLYMPIA — The state Senate has passed a broad package of data privacy protections, including rules that would give consumers the right to delete data about them held by private companies.
The measure would require businesses or other entities that control or process the identifiable data of more than 100,000 people to allow consumers to find out what data is stored about them, correct errors or request deletion. The measure would also set rules for facial recognition technology for both state and private users.
Lawmakers approved the proposal on a 46-1 vote Wednesday, with even legislators normally critical of government intervention voting in favor. It now goes to the House for consideration.
“We have an expectation and a right to privacy in the public square as well as our homes,” said Sen. Reuven Carlyle, a Seattle Democrat, the bill’s sponsor.
Carlyle added that the measure had been modeled on European rules, which offer similar protections.
The measure also garnered support from many Senate Republicans.
Sen. Doug Ericksen, a Ferndale Republican, voiced concerns about the measure, saying that he would prefer a unified federal regulatory scheme, and that he worried about overcomplicated regulations creating compliance costs that box out smaller businesses.
But Ericksen said Wednesday that he thought the merits of the bill outweighed its risks, and that he would vote for it.
Along with the data protection rules, the proposal also includes rules for the use of facial recognition technology, Carlyle said.
Businesses that want to use the software to analyze the faces of customers or others in public places would have to post signs warning that the technology was in use, and employ human reviewers before making decisions based on facial matches.
And state agencies would be restricted from using the technology without a warrant.
Along with the 100,000-person threshold for the data handling rules, including the option for consumers to delete their data, the proposal also contains a provision for entities that control or use smaller amounts of consumer data.
