Editorial: Try again on safeguarding privacy of personal data

By The Herald Editorial Board

Advances that have come at breakneck speed in the collection, use, sharing and sale of consumer data — a range of digitized details that can include identifying information, financial data, history of purchases and even the data used in facial recognition software — require equally prompt action by state and federal lawmakers to put rules in place regarding data privacy and consumer control.

Those rules need to assure consumers and residents retain control of that data, but those privacy guardrails on the information superhighway have to be adopted in a manner that provides public confidence in the protections and in how they are adopted.

Which is why it’s likely for the best that a bill in the state Legislature that sought those protections appears dead this session as lawmakers near the end of their work this year. However — and you knew there was a “but” coming — there is an outside chance the legislation could be taken up again before the gavel falls, even after extraordinary measures were used earlier in the month when the bill failed to survive one deadline, as The Herald’s Jerry Cornfield reported Thursday.

The legislation, Senate Bill 5376, passed in the Senate in early March, 46-1. But in Senate and House hearings, the bill — even with its good intentions — was opposed on diverse points by representatives of consumer, technology, civil rights, law enforcement and legal organizations. In the House, the legislation found insufficient support among lawmakers from both parties and appeared unlikely to advance past an April 9 deadline for approval by a House budget committee.

Rather than let the bill die, Democratic leaders used a procedural tactic, called a “title-only bill,” in which the entirety of the bill’s text was stripped, replaced with a list of general goals and kept alive with the intention of filling in the details later.

The details were left to a panel of lawmakers, six Democrats and one Republican who, in a series of meetings with representatives from Microsoft, Amazon, Comcast, and the Association of Washington Business rewrote the legislation hoping to find a compromise that would be acceptable to both chambers. Not included in the discussions, however, were any advocates from the organizations that had earlier expressed reservations about the bill.

Dissatisfied with the legislation and the process, House lawmakers let the legislation die without action before Wednesday’s 5 p.m. deadline.

In the interest of expediency, supporters of the legislation turned to a little-used procedure that all but erased the public process up to that point, then left the details of regulation in part to those being regulated.

That hurried process skipped the participation of a range of interested parties — many of them dedicated to the interests of consumer protection and individual rights — and gave greater weight to the preferences of those who are in control of individuals’ information.

Even assuming the best of intentions, that’s a recipe for loopholes and unintended consequences.

There’s good reason to pass legislation with the intended goals of protecting data privacy. Consumers do need the ability to know what information has been collected, how it is being safeguarded and how it is being used. And they must have the ability to be able to exert reasonable control over that information, in particular the right to consent to its use.

Regarding facial recognition, it’s easy to see a retailer’s and other businesses’ interest in the technology: using cameras and the software to scan the faces in a crowd for comparison against a database, say, of photos of those with records of shoplifting or other crimes. But for store security or law enforcement, there’s a conversation yet to be had with the general public about how and where that technology should be used and whether a sign notifying the public of the use of that technology provides enough warning and the opportunity to agree or object to that surveillance.

These protections are necessary and need to be adopted promptly at state and federal levels. But how those laws are adopted are as important as their provisions.