Big privacy news from both Washingtons! Once again Washington state leaders are leading the way in privacy for the country. U.S. Rep. Cathy McMorris Rodgers, chair of the House Committee on Energy and Commerce, and U.S. Sen. Maria Cantwell, chair of the Senate Committee on Commerce, Science and Transportation, have jointly proposed the American Privacy Rights Act (APRA).
This bi-partisan and bicameral measure would create a comprehensive data privacy law in the U.S. The bill tackles many areas that have been sticking points for federal consumer privacy legislation including allowing for private rights of action (where individuals can sue companies for violation of privacy rights) and pre-emption of other state laws.
The bill allows for enforcement of rights by state attorney generals, the Federal Trade Commission, and individuals. The legislation also preserves some relief under specific state laws that provide for privacy protections while pre-empting others. It specifically cites relief allowed under Illinois’ Biometric Information Privacy Act, Genetic Information Privacy Act, and California’s Consumer Privacy Act which allows individuals to sue for data breaches.
Notably the proposed law does not specifically cite, Washington’s My Health My Data Act (MHMD). However, it does preserve state’s ability to enforce its own consumer protection laws. The bill also preserves state laws that “protect the privacy of health information, health care information, medical information, medical records, HIV status or HIV testing.”
I have been asked if the American Privacy Rights Act has a chance to pass this year. I believe there’s reason for optimism, in part because of growing concerns surrounding the use of personal information to train generative artificial intelligence (AI) models. In our most recent legislative session law makers, advocates, and industry centered much of the debate on a need for comprehensive privacy law as a foundation before attempting to regulate AI.
With AI impacts looming I look forward to following the progress and debate around the APRA. (See section-by-section summary of APRA.)
April Webinar
The Office of Privacy and Data Protection receives lots of interesting questions and inquiries from agencies on a wide range of privacy and privacy-adjacent topics. Join us this month to get the benefit of hearing some of our answers in a webinar we’re calling “Sometimes Asked Questions.” These questions range on issues from data share agreements, ad tracking pixels, biometrics, demographic data protections, and more. Please email OPDP if you would like to attend: privacy@watech.wa.gov.
- Date: April 25.
- Time: 10 a.m. to 11 a.m.
- Place: Zoom.
Grant Opportunity
We are excited to announce that the next State and Local Cybersecurity Grant Program application is available! If you have privacy or security projects that you would like to see funded, check out the website (State & Local Cybersecurity Grant Program | WaTech) for more details.
Thanks and see you next month with more updates!
Katy Ruckle
State Chief Privacy Officer