Significant progress, although still a ways to go: privacy and facial recognition legislation advances in Washington State

Continued from A bad day for a bad privacy bill, a good day for privacy. Last major update March 10.

After a dramatic debate on the floor, and standing up to intense lobbying from the tech industry, the Washington House voted in favor of improved versions of two key bills back to the Senate. Now, a House/Senate negotiating committee will try to come up with a version that can pass both houses by the end of the week. The tech industry and law enforcement try to convince legislators to return to the really bad versions of the bills the Senate passed earlier. But momentum’s on the side of the community, consumer, and privacy groups who have been pressing for improvements — and are continuing to press for more.

Kudos to the House!

There’s still a lot of work to do on the legislation, but it’s amazing how much it’s improved since the hearing I talked about in A bad day for a bad privacy bill, a good day for privacy. For example:

• SB 6281, the “Washington Privacy Act” still has loopholes and exceptions, but thanks to an amendments from Reps. Hudgins now has a private right of action — and (unlike the Senate’s version) the Attorney General says this version is enforceable, which is a good thing!
• SB 6280, which regulates law enforcement use of facial recognition, still falls short of a moratorium that so many groups are calling for, but thanks to an amendment from Rep. Entenman now has a significantly stronger warrant requirement — and a new requirement for existing deployments to go on hold until an accountability report is fired.

This is a huge amount of progress in the last two weeks. The private right of action is huge; as Livio De La Cruz of Black Lives Matter — Seattle King County said, it puts the power in our hands. Tech companies were successful in keeping a private right of action out of California’s CCPA privacy legislation, and are currently fighting to keep it out of federal legislation as well. Here’s a real chance for Washington to set a new bar for privacy protection.

There are lots of other improvements in the House versions of the bills as well. A few more examples:

• Significant amendments from Rep. Smith on the floor incorporated language from Consumer Reports and the Electronic Frontier Foundation to give more protections to de-identified data and clarify that photographs are not pseudonymous information.
• The “pre-emption” clause was narrowed significantly in Rep. Hudgins amendment. It would have been better to drop it completely, but at least existing regulations like Seattle’s Broadband Privacy Rule are grandfathered in — and local regulations against face surveillance are no longer prohibited.
• Rep. Santos’ amendment improved SB 6280’s task force on facial recognition (already one of the best features of the bill) by ensuring representation from the AAPI community.

The powerful testimony at the hearing from people like Livio, Stan Shikuma of Japanese Americans Citizens League — Seattle Chapter, Derek Lum of InterIm CDA, Eli Goss of OneAmerica, and Jennifer Lee of ACLU Washington clearly had an impact. So did the consumer and privacy groups who weighed in, including Consumer Federation of America, WashPIRG, Common Sense Kids Action, EPIC, and Privacy Rights Clearinghouse as well as EFF and Consumer Reports. And the Attorney General’s Office (AGO) Consumer Protection Division bombshell testimony on enforceability had a huge impact as well.

The House ITED Committee has taken a major role here. Kudos to Chairman Zack Hudgins, Ranking Member Norma Smith, and all the members of the committee! Reps. Hudgins, Smith, Debra Entenman, and Luanne Van Werven all introduced strong amendments. And Reps. Shelley Kloba, Matt Boehnke, Sharon Wylie, Gael Tarleton, and Vandana Slatter all spoke passionately and knowledgeably during the floor debate. Really impressive work all around!

And kudos as well to the House as a whole, which also did excellent work — in extremely difficult circumstances. I am very sympathetic to the hard choice legislators faced, under incredible time pressure, voting on the 27 (!) amendments that had just been introduced, and then a version of a very complex bill that even its supporters agree is still very imperfect.

Watching the debate, I was very proud to be a Washingtonian. Representatives from both sides of the aisle made good points in the debate, clearly understood the importance of this issue, and were genuinely looking for the best solution even in situations where they had different viewpoints. So thanks to all of you, no matter how you voted.

As Rep. Boehnke said, you’ve earned your stripes. I’m very glad the House advanced these bills, and hope that your colleagues in the Senate seize the opportunity and build on your hard work.

Negotiation time …

Unsurprisingly, the Senate asked the House to recede their amendments and return to the Senate versions of the bills. Also unsurprisingly, the House said no. So now both bills are in House/Senate conference committees, with the vote expected on Thursday, March 12.

It’s hard to know just what will happen. Tech companies and law enforcement are pushing to return to the very weak Senate versions. At the same time, though, consumer, community, and privacy organizations will be pressing for further improvements. On SB 6281, there’s some easy low-hanging fruit, like Rep. Van Werven’s excellent amendment (which alas failed on the House floor) raising the age of children protected from 13 to 16. Rep. Smith’s amendments also offer clear improvements. Maybe the conference committees will see which way the wind is blowing and decide that they also want to have a hand in improving the legislation.

All that being said, groups wanting strong privacy legislation are justifiably very nervous right now — and so am I. It was only a few weeks ago that the Senate voted for an unenforceable version of SB 6281. Maybe they didn’t realize how bad it was; after all, Microsoft, Amazon, the WTIA, and industry-funded “impartial” non-profits and have been telling legislators in Washington and across the country that the unenforceable version included “strong enforcement” that would “raise the bar” on other states.

Then again, maybe legislators really do want unenforceable regulation. Time will tell.

SB 6280: Is there the political will?

On SB 6280, the warrant requirements and strengthened accountability report are certainly much better in the House bill. As Rep. Entenman so memorably said on the floor, the bill provides moral guardrails. And the idea of regulating private use is a good one. The actual language in Section 15 is very weak, and should be removed, but expanding other parts of the bill (for example, Section 3, 6, and 7) to include private use might well be straightforward.

There are several other areas where further improvements seem achievable. Section 3 could be further strengthened. Sections 6 and 7 could be revised to address the concerns I discussed in my testimony and follow-on mail. ACLU Washington has also proposed language for further important improvements to the warrant requirements in Section 12.

The accuracy and biases in all of today’s systems are so bad that a solid review and approval process would quite possibly halt all deployments, so strengthening to Sections 3, 6, and 7 could result in a de facto moratorium. That said, there’s a big risk here: even a strengthened approval process potentially lets bad actors like Clearview AI throw lawyers and money at the problem and get dangerous systems approved.

So this strengthening also would need to be accompanied by provisions that prohibiting any government agency from engaging in face surveillance with a few very narrow exceptions — for example allowing law enforcement to do face matching against the Department of Licensing database, with a warrant, in very specific circumstances such as rape or kidnapping.

And if it’s not possible to include a moratorium in the bill this session, it’s important to begin planning now for a special session once we start to see the accountability reports. As Stan Shikuma said so memorably in his testimony, “never again is now.” If the reports turn out as badly as I (and every AI researcher and civil rights expert I’ve talked to) expect, do legislators really want to wait a year to address the problem?

Here’s a partial list of groups and people who support a moratorium.

• ACLU Washington has joint letters and other comments from many community groups demanding a moratorium, including CAIR Washington, Densho, Entre Hermanos, InterIm Community Development Association, Japanese American Citizens League Seattle Chapter, La Resistencia, MAPS-AMEN (American Muslim Empowerment Network), Puget Sound Sage, Urban League of Metropolitan Seattle, and Washington Immigration Solidarity Network
• 80% of Massachusetts voters support a facial recognition moratorium, and I expect the numbers are similar here.
• The EU is considering a five-year moratorium.
• Google’s CEO supports a moratorium.
• So do many civil rights lawyers and AI researchers. Veena Dubal’s San Francisco was right to ban facial recognition. Surveillance is a real danger, Meredith Whitaker’s Should Government Halt the Use of Facial-Recognition Technology?, and Luke Stark’s Facial recognition is the plutonium of AI all make the case for the importance of a moratorium far more eloquently than I can.

SB 6281: The House debate highlights the path forward

On SB 6281, the outstanding House debate offers a lot of directions for further improvements. Some examples:

• Ranking Member Smith’s discussion of a “floor not ceiling” approach
• Rep. Wylie’s comments that regulations need to send a strong message to bad actors
• Rep. Walsh’s remarks that Rep. Van Werven’s amendment offered a chance for Washington to take a leadership role
• Protections in the dozen amendments from Ranking Member Smith that did not pass, for example restrictions on third-party sharing and data brokers.
• The shift in the discourse towards a real focus on rights, not just regulations.

For me, one of the many highlights of the debate was when Rep. Walsh pointed out that the supposed “tradeoff” between privacy and innovation that people kept talking about isn’t real. Yeah, really!

It’s certainly true that some kinds of innovation are more complicated if you have to take potential harms to consumers and citizens into account. Then again, there’s plenty of room for innovation in technologies that actually do protect privacy. Companies large and small have spent billions of dollars over the years on tracking our behavior and figuring out what ads to show us as a result — but very little on privacy technology. While that’s starting to change in Europe as a result of the GDPR, Washington has a chance to be a world leader here.

During the debate, I heard a lot of concern about businesses having to deal with a “patchwork” of regulations. This was clearest in the debate about Rep. Van Werven’s amendment: legislators’ genuine desire to better protect Washington teenagers clashed with their fears that this hurt Washington-based companies, because other jurisdictions don’t (yet) extend the same protections.

Differing regulations are indeed already a very real challenge with federal regulations, the CCPA, and GDPR. Still, companies who are good actors know how to live with this: designing their offerings for the strongest regulations out there. And often this can turn into a competitive advantage: even in other jurisdictions where regulations don’t (yet) require stronger protections for14–16 year olds, parents and teens see it as a good thing.

Especially given the strong trend in the US and across the world towards stronger privacy projections, a strong Washington Privacy Act can actually give Washington-based businesses an advantage. By contrast, weak or no regulation will make the “patchwork” situation worse as cities and counties in the state feel the need to add more protections. And attempting to prevent that with a pre-emption clause pushes everything to the lowest level of privacy.

In terms of the private right of action, I certainly hear the concerns from companies large and small about frivolous lawsuits. I just wish that instead of desperate efforts to block any private right of action, the same amount of energy went to drafting a good private right of action. Joe Jerome’s Private right of action shouldn’t be a yes-no proposition in federal US privacy legislation on the International Association of Privacy Professionals (IAPP) site has a very solid framework for thinking about this that applies to state legislation as well.

Time for the next battle

Even though there are good paths forward, the tech industry and law enforcement will be lobbying fiercely to go back to the bad bills the Senate passed. We may well be on track for a replay of last year, where the legislation collapsed. If that happens again, expect this to be a big campaign issue in the August primary and November general election. There’s also likely initiatives for November — if lawmakers once again choose not to protect Washingtonians’ privacy and rights.

Then again, politics is the art of the possible, and I’m a lot more optimistic than I was two short weeks ago. Thanks to everybody who’s helped get us here!

UPDATE, March 12: The Senate asked the House to retract their improvements to both bills. The House said no. After which:

• SB 6281 never got out of the reconciliation committee to a final vote.
• A weakened version of SB 6280 emerged from the committee, including a really bad clause on private facial recognition, but got voted down by the Senate. The an even weaker version surfaced, with the effective date of everything but the task force deferred until July 2021. That passed the Senate and then the House.

UPDATE, March 31: Jay Inslee vetoed the SB 6280 task force —which I saw as the best feature of the bill — for budgetary reasons, and signed the rest of it into law. Here’s the ACLU-WA Statement. Brad Smith of Microsoft lauded the “balanced approach” of reducing constitutional protections, exempting private security companies, and no accountability requirements — and suggested it should be a model for other states. Jen Lee’s longer post We Need a Face Surveillance Moratorium, Not Weak Regulation has more.

Originally published at A Change Is Coming. See