“We see your CCPA and we raise you some GDPR,”  says Washington state with a new privacy bill.

If passed, the Washington Privacy Act would go into effect on July 31, 2021 and would enact a comprehensive law that includes individual rights that go beyond CCPA.

Key provisions that go beyond CCPA:
  • Strong provisions that align with GDPR (e.g data minimization, purpose limitation, controller processor distinction)
  • Commercial facial recognition provisions
  • Obligations to perform data risk assessments
  • Opt-in consent for the processing of sensitive data (including information from a “known child”)
  • Opt out of profiling in furtherance of decisions that produce legal, or similarly significant effects
  • Consumer rights exceptions for processing “pseudonymous data”
  • Exceptions to the right of access
Key similarities with CCPA:
  • Broad definition of personal data
  • Similar requirement re: privacy notice (transparency)
  • Individuals’ core rights to access and delete data
  • Right to opt out of sale of information
  • Right not to be discriminated against
Remedies:
  • Exclusive enforcement by AG; no private right of action

Details from the Future of Privacy Forum.