Washington data privacy and facial biometrics legislation approved by state senate

Washington Senators have approved a new data privacy bill modeled on the European Union’s General Data Protection Rule by a 46-1 vote, local publication The News & Observer reports.

Companies using facial recognition must post signs informing the public about it, and can only take action based on matches produced by the technology after human review, under the new law. State agencies will need a warrant to use the technology, except in emergency situations. The bill also requires all businesses and other entities storing or processing personally identifiable data of more than 100,000 people to provide information about that data, as well as operate data correction and removal processes. Smaller companies would have a reduced set of obligations.

“We have an expectation and a right to privacy in the public square as well as our homes,” says Seattle Democrat Senator Reuven Carlyle, the bill’s sponsor.

Many Senate Republicans also voted for the bill. While Ferndale Republican Senator Doug Ericksen suggested that federal regulation would be preferable, and expressed concern that smaller businesses could be adversely affected by compliance costs for a complicated regulatory environment, he said he would vote to approve the bill, as its merits are greater than its risks, according to media reports.

The American Civil Liberties Union (ACLU) opposed the bill, saying public notice would not adequately curb facial recognition use, and that authorities could sidestep limits on governments agency use in the bill by invoking emergency powers. Instead, the ACLU proposed its own legislation to restrict facial recognition technology from use by state and local governments until or unless several conditions could be met.

The data protection bill was supported by Microsoft, and Amazon suggested certain minor adjustments, but it was opposed by police body camera-maker Axon.

A key difference between the new law and Illinois’ BIPA and some other proposed legislation is an absence of the right of individual action. Penalties under the bill range from $2,500 to $7,500 per violation, but would be enforced only by the state attorney general.

Article Topics

Biometric Information Privacy Act (BIPA)  |  biometrics  |  data protection  |  facial recognition  |  legislation  |  privacy