United States of America: Reintroduced People's Privacy Act (SB 5643)

On 8 January 2024, the People’s Privacy Act (SB 5643) was reintroduced to the Washington State Senate. The Act was first introduced in January 2023 but was rejected. The Act creates a charter of people's personal data rights and would apply to business entities in the state of Washington which, annually, have a revenue of at least USD 10 million through at least 300 separate transactions, or process personal information of at least 1'000 unique individuals. If passed, it would grant data subjects in Washington state with the right to know, access, refuse consent, delete, and correct their personal information. Covered entities would be subject to a number of data processing obligations, such as having a clear and easily understandable long-form and short-form privacy policy displayed prominently and readily accessible to data subjects. The Act would also set out the conditions under which personal information can be transferred to third parties. Further, covered entities would need to conduct and document a data protection assessment of certain processing activities, including capturing personal information for targeted advertising and the sale of personal information.