Alright everybody, it's quiz time.

On Friday lawmakers in Olympia must decide between two different versions of a "groundbreaking" data privacy bill called the Washington Privacy Act.

Both the House and Senate versions purport to give us the power to ask large tech companies to delete our data, edit our data, or not sell our data to a third party for the purpose of targeted advertising—which would be a big fucking deal. Only California and all of Europe gives consumers that much power over their own data. Both versions of the bill also establish some rules for companies who want to scan our faces to meet their commercial or public safety "goals."

Amazon, Microsoft, Google, Comcast, the Seattle Times' Editorial Board and every large Washington company you can think of support the Senate's version of the bill. But every consumer protection group you can think of—the ACLU, the Washington State Association for Justice, the Consumer Federation of America, the Electronic Privacy Information Center, the Electronic Frontier Foundation, the Privacy Rights Clearinghouse, and many others—fervently oppose the Senate's version of the bill. Those consumer protection groups, however, fervently support the House's version of the bill.

So, which version of the bill actually gives us power over our own data?

That's right! The House's version.

But which bill are Democrats leaning toward because they're afraid of pissing off large companies during an election year it's a new regulation and they want to take things slowly?

You guessed it, the Senate's version.

Why does the Senate's bill suck so much? Bottom line: the Senate's version prevents you from suing big companies if they break the law. Conversely, the House's version allows you to sue big companies if they break the law.

If you don't need to hear any more, then do us all a favor and tell Seattle Sen. Reuven Carlyle, who sponsors the bad Senate bill, that you want a data privacy bill enforceable by the Attorney General and all Washingtonians.

You should also tell Bellevue Rep. Amy Walen to withdraw Amendment 2131 from the House's version of the bill—which is under consideration this afternoon—as that amendment would essentially turn the House bill into the bad Senate bill.

•amy.walen@leg.wa.gov
• (360) 786-7848

• reuven.carlyle@leg.wa.gov
• (360) 786-7670
• If you don't live in Seattle or Bellevue, find your legislator and tell them to support the House version of the data privacy bill.

If you do need to hear more, follow along. It won't take long.

Why Does the Senate's Bill Suck So Much?

The Senate bill sucks because its enforcement mechanism sucks.

Though the proposal gives us the power to ask companies to delete or correct our data, the proposal also gives companies the power to reject those requests. The bill lists eight reasons companies can reject those requests. Some of those reasons are good! Some of them seem very broad.

For instance, a company can reject your request to delete or correct your data if they need it to protect you against an "illegal activity" such as fraud, to protect your very life, to provide a service you've expressly asked for, or to conduct "peer-reviewed scientific, historical, or statistical research in the public interest."

But they can also reject your request if they need your data to "conduct internal research," or to "identify and repair technical errors that impair existing or intended functionality," or to "perform solely internal operations that are reasonably aligned with the expectations of a consumer."

One can easily imagine a scenario where a company ignores your request, or rejects your request to delete your data because they need it for "internal research."

If you want to call bullshit on that, you have to sue the big tech corporation. Europe's data privacy act allows you to sue. California's data privacy act allows you to sue in a limited way. Democrats in Congress are fighting Republicans on a similar bill for your right to sue. But the Washington Senate bill does not allow you to sue. The Senate bill doesn't even allow the Attorney General to sue. The Senate bill only allows the Attorney General to fine companies $7,500 per violation.

But the Attorney General says he'll have a hard time doing that, since the Senate bill doesn't allow his office to enforce the law using the Consumer Protection Act. "The Attorney General's Office can enforce the version of data privacy legislation that moved out of the House Information, Technology, and Economic Development Committee. Moreover, this version of the bill gives consumers a voice in enforcing their rights," Attorney General Bob Ferguson said over the phone. "In contrast, my office is unable to enforce the version passed by the Senate—and neither are consumers."

"The Senate bill takes away one of the core aspects of our investigatory ability to enforce the Consumer Protection Act," Ferguson continued. "For example, under the Consumer Protection Act, we can issue basically a subpoena to a company to investigate them. They have to turn over their documents so we can determine what's going on. The way the Senate bill is written now, we lose that authority."

Ferguson's bottom line here is this: Carlyle's bill says it's going to give consumers rights, but not allow them to go to court to enforce those rights. If you have a right you can't enforce, then it's not a right at all.

Sen. Carlyle disagrees. "We just have a difference of opinion," Carlyle said over the phone. "[Ferguson's] view is that individual attorneys should be the enforcement mechanisms. But I think we're looking for patterns of abuse from the global platforms, such as Amazon, Microsoft, Google."

Since Carlyle believes we're creating a "new and unprecedented" right to data privacy, he thinks "we ought to start slow and modest, get the AG focused on consumer complaints, and if we find the AG is unable to enforce it, then I think we look at version 2 and reconsider."

Carlyle adds that it's "ridiculous to hand over a major policy like this to thousands of lawyers on day one," and fears a potential flood of litigation would hurt Washington's companies. "It just might be the case that there might be a propensity for individual lawyers to jump all over global brand companies for a perceived privacy violation," he said.

Ferguson argues that Carlyle has all this backward. "It's not a right for lawyers, it's a right for Washingtonians. Yes, you can hire a lawyer to take on Microsoft or a big entity, you might need one. But it is a Washingtonian's right, not a lawyer's right."

Rather than initially protect big companies from lawsuits, Ferguson argues we should "start with ensuring Washingtonians have the ability to enforce these rights. And if these huge corporations with armies of attorneys can't defend themselves against Washingtonians, then let's have a conversation."

In addition to having a bad enforcement mechanism, the Senate bill also contains a bunch of bullshit language about facial recognition that would essentially allow companies to perpetuate racist practices. I don't have time to get into that now, but, real quick: One provision being considered allows companies to deploy facial recognition software and then test it for racial bias afterward, which is fucked. Another provision requires you to opt-in having your face-image-data processed by some company or store, unless that store owner has a reasonable belief that you have committed a crime, and then they go back in and log your face into their system. The idea that that process won't lead to more people of color being disproportionally targeted by law enforcement is crazy.