Editorial: Adopt protections for internet users’ personal data

By The Herald Editorial Board

Most of us understand the trade-offs that we make in using Facebook, Google, Amazon and other social networks and internet services that have become a huge part of our daily lives.

In exchange for that connectivity with friends, family, the rest of the world and the products and services we want to purchase, these typically “free” services still extract a payment from us in the form of the personal data and information that is freely shared by us or that we consent to provide by clicking an “accept” button following line after line of “terms of service” fine print.

But even if we understand those trade-offs, it doesn’t mean we’re entirely happy about the price we pay in how our personal data and information is used and traded as a commodity. Or with the “creepy” way that some services seem to eavesdrop on our searchers and the sites we visit.

For years, however, there’s been growing push-back and concern about how that data is used and sold to other companies.

Rules to control that flow of information — and allow consumers to have more say in what is and isn’t used and sold — have already been adopted by the European Union and in the U.S. by California. Washington state may be next, borrowing from both, in legislation now in the state Senate that has received approval from two committees and could soon move on to a floor vote.

The Washington Privacy Act, Senate Bill 5062, is a renewed attempt at securing some consumer protection and control. Similar legislation failed in 2019 and 2020 following objections of advocates for consumer and civil rights, among others. Noting previous criticisms, Sen. Reuven Carlyle, D-Seattle, has returned this year with legislation that, while keeping the support of most of the industry, has attempted to strengthen provisions for enforcement.

Under provisions of the bill, consumers would have rights regarding their ability to review, correct and delete personal information and could opt out of providing data that could be used or sold to target advertising or to compile profiles of consumers. Along with additional responsibilities for the companies, the legislation would also give enforcement responsibility to the state Office of the Attorney General.

Previous legislation lacked the support of Attorney General Bob Ferguson, Carlyle said in a recent interview with technology news site GeekWire, but Ferguson has said the current bill as amended would be enforceable by his office.

There remain opponents, particularly the ACLU of Washington state. Jennifer Lee, the ACLU’s technology and liberty manager, during a hearing before the Senate Ways and Means Committee, called the legislation a “weak, industry-backed bill.” Lee faulted the legislation for not requiring companies to seek “opt-in” permission from consumers regarding their data, for not allowing consumer legal action and for not providing adequate funding for the enforcement by the AG’s office.

Under EU regulations, “Countries with populations smaller than Washington state spend over 16 times more than what is being proposed here,” Lee said. Allowing a private right of action — lawsuits and the threat of lawsuits — would reduce enforcement costs to the state, she said.

Lee may be correct about the funding, which would only allow the AG’s office to hire a small staff to handle issues, but Carlyle’s bill offers provisions that could still provide useful protections soon, following years of failed attempts.

Regarding the bill’s industry support, while that might raise justifiable suspicions among some, the legislation required buy-in from those companies, who otherwise were likely to continue lobbying against any consumer protections. And industry support for the legislation varies. Carlyle noted to GeekWire that while Microsoft and Amazon are backing the bill, Facebook has been neutral, and Twitter was “less than enthusiastic behind the scenes.”

Allowing consumers to “opt out” of data collection, rather than requiring companies to first ask their users to “opt in,” also will require an effort to notify and educate consumers about how to protect their private information and data. Some additional funding for those efforts is necessary.

It’s worth noting that California’s legislation, adopted in 2018, has since been strengthened by a citizen’s initiative that will take effect in 2023. A similar effort can be considered in Washington state, but it makes sense to get some protections on the books now for consumers that then can be followed with reforms either by the Legislature or by initiative.

Most of us recognize and even appreciate the connectivity that social networks and internet services provide. But those services shouldn’t require us to pay an unreasonable — and prying — price with our personal information.