“We see your CCPA and we raise you some GDPR,” says Washington state with a new privacy bill.
If passed, the Washington Privacy Act would go into effect on July 31, 2021 and would enact a comprehensive law that includes individual rights that go beyond CCPA.
Key provisions that go beyond CCPA:
- Strong provisions that align with GDPR (e.g data minimization, purpose limitation, controller processor distinction)
- Commercial facial recognition provisions
- Obligations to perform data risk assessments
- Opt-in consent for the processing of sensitive data (including information from a “known child”)
- Opt out of profiling in furtherance of decisions that produce legal, or similarly significant effects
- Consumer rights exceptions for processing “pseudonymous data”
- Exceptions to the right of access
Key similarities with CCPA:
- Broad definition of personal data
- Similar requirement re: privacy notice (transparency)
- Individuals’ core rights to access and delete data
- Right to opt out of sale of information
- Right not to be discriminated against
Remedies:
- Exclusive enforcement by AG; no private right of action