On January 18th, Washington State Senator Reuven Carlyle introduced SB 5376, titled the Washington Privacy Act (WPA). The Interactive Advertising Bureau has reviewed the bill and submitted comments jointly with other leading advertising trade associations. Though we have suggestions and questions for Senator Carlyle, the draft is clearly thoughtful and substantive.
In the wake of action in Europe and California, the Washington State Legislature and policymakers in other States and at the federal level are working to update and modernize consumer protection and privacy laws for the digital age. IAB is serving as a constructive voice in that process. Washington is an undisputed national leader in data driven innovation and technology. According to a study commissioned by IAB and conducted by Prof. John Deighton at the Harvard Business School, the ad-supported Internet ecosystem contributes $38 billion to the Washington State economy and was responsible for more than 100,000 full-time jobs across the State. (iab.com/economicvalue) Because of that, we expect any legislation passed in the Washington State Legislature that creates new requirements over data practices to have a meaningful effect on markets well outside Washington’s borders, as well as on the ideas that legislators in Washington, DC will consider in the year to come.
The iconic American data-driven technology companies headquartered in Washington, born in the last few decades, were built on the foundation of a flexible legal and regulatory environment, as well as a free and open global internet. Countless other companies across our country, that employ thousands of Americans in Washington and elsewhere, rely on direct or indirect access to data to improve, market, and better distribute their goods and services. Nobody wants to disrupt that engine for growth or source of economic value. But as Senator Carlyle and policymakers elsewhere have indicated, data protection and privacy rules that are clear and widely embraced and accepted could provide consumers with useful transparency into how their information is collected and control over how it is used.
We are in agreement with Senator Carlyle that citizens’ privacy rights are just as important as the data-driven innovation and economic value that data and information fuels. We also agree that there is a path forward that allows markets to continue creating opportunity, jobs, and consumer value while balancing a reasonable mechanism for market actors to access data respectfully.
We note and appreciate that the draft legislation preempts local Washington government entities legislating in the area for what we assume are reasons similar to why market actors doing business across state lines would prefer a national standard: better economies of scale and more uniform practices. Furthermore, we recognize that states are taking a leadership position as the laboratories of democracy, and are stepping in with their own ideas and proposals in the absence of an updated national baseline standard. We believe that the ideas in the WPA are important and will inform that national conversation.
The WPA mirrors some of the model and language of the EU General Data Protection Regulation (GDPR). We would argue that this model is excessively process-driven and prescriptive, and we would appreciate consideration of provisions to allow for more flexibility in the application of the principles in question. For example, the proposal lacks reasonable limits on facilitating requests to exercise consumer rights where such requests are unjustified or lack sufficient information to confirm the identity of the consumer. We also believe U.S. privacy legislation should draw upon and leverage the self-regulatory principles that the advertising industry has created to offer industry codes of conduct, with accountability, that protect consumer data while allowing innovation to flourish. For example, the Digital Advertising Alliance (DAA) and its cross-industry self-regulatory privacy principles have been widely implemented across the digital advertising industry and provides transparency and control over their data choices. As detailed in our joint trade letter, we suggest that the WPA distinguish pseudonymized data from individually identifiable information while imposing DAA-like safeguards against the processing of pseudonymized data. In particular, we recommend that the processing of pseudonymized data— data that would not identify a specific consumer—be subject to a mechanism that provides consumers with the ability to exercise choice regarding the processing of such. Data that is not maintained in a pseudonymized or de-identified fashion would be treated as identifiable information. This approach will help ensure Washington residents continue benefit from existing privacy choices afforded to them and not result in data related to their online activities becoming identifiable.
We do appreciate and support some of the concepts in the draft and we believe there are ways that the Washington draft legislation improves on the GDPR language. Examples include the omission of excessive new rulemaking authority. It is also good that the language recognizes that direct marketing should fall under an opt-out standard. Those are important and valuable signals for state legislators to send to the wider discussion about the best approach to privacy and data protection, as well as to the U.S. Congress as that body considers a national standard.
The IAB believes that many of the requirements in the WPA are currently covered in self-regulatory programs. A good place to start a dialogue around data privacy and online advertising is to discuss where the delta in treatment, rules, and governance might exist between what the Washington State Legislature is considering and how we govern ourselves. As we highlight in our letter to Senator Carlyle, we see options for bridging differences in the legislation, and have identified the potential for including a safe harbor in the legislation for adherence to these programs or some modified version of them that provides meaningful protections and choice for consumers.
Sr. Director, Public Policy
Interactive Advertising Bureau