OLYMPIA – The Washington Senate today overwhelmingly approved the Washington Privacy Act, one of the nation’s strongest consumer data privacy protection measures.

Based on global standards and best practices, the act strengthens consumer access and control over personal data held by companies and it regulates the use of facial recognition technology.

A bipartisan group of senators voted 46-1 in favor of Senate Bill 6281, sponsored by Sen. Reuven Carlyle (D-Seattle).

“We’re so proud that Democrats and Republicans voted together to recognize that consumer privacy is essential and that data belongs to individuals,” said Carlyle, who chairs the Senate Environment, Energy & Technology Committee. “This bill carefully, responsibly takes the best practices from Europe, California and other states to build a data privacy regulatory framework that will help set a standard and lead the nation in bringing our data privacy laws into the 21st century.”

The comprehensive act builds on central elements of the California Consumer Privacy Act (CCPA) and the European Union General Data Protection Regulation (GDPR) and gives Washington residents meaningful tools to determine how their personal data is used and shared. That includes the right to know who is using consumers’ data and why, the right to correct inaccurate personal data, the right to delete certain personal data, and the right to opt out of the processing of data in key areas.

The act also requires companies to disclose data management policies in order to increase transparency and establishes limits on the commercial use of facial recognition technology.

An overview of the bill is available here.

The bill now goes to the House of Representatives for consideration.

Washington residents overwhelmingly favor efforts to defend data privacy. In a Crosscut Elway poll released in January, 84 percent of respondents said consumer protections for personal online data should be strengthened.

On Wednesday, the Washington, D.C.-based Future of Privacy Forum released a side-by-side comparison of the Washington Privacy Act with the CCPA – the only existing comprehensive consumer privacy law in the United States – and the GDPR.

The group concluded that, in the absence of a comprehensive federal law, “the Washington Privacy Act could serve as a useful regulatory model for other states and for Congress that improves upon the CCPA, provides rights to Washington residents, and helps companies build effective data protection programs.”