{"id":4206,"date":"2023-04-17T17:14:29","date_gmt":"2023-04-17T17:14:29","guid":{"rendered":"https:\/\/2024.thenexus.today\/index.php\/2023\/04\/17\/my-health-my-data-in-the-home-stretch\/"},"modified":"2023-04-17T17:14:29","modified_gmt":"2023-04-17T17:14:29","slug":"my-health-my-data-in-the-home-stretch","status":"publish","type":"post","link":"https:\/\/2024.thenexus.today\/index.php\/2023\/04\/17\/my-health-my-data-in-the-home-stretch\/","title":{"rendered":"My Health My Data in the home stretch: Washington privacy legislation update, April 17"},"content":{"rendered":"

UPDATE: about two hours after I posted this, the House voted to concur with the Senate version of My Health My Data!<\/p><\/blockquote>\n

“This session ends on Sunday April 23, and privacy legislation has gone down to the wire the last four years. \u00a0It ain’t over ’til it’s over!”<\/p>\n

\u2013 A much more favorable environment, but a lot of complexity: Washington state privacy legislation 2023<\/a>, January 11<\/p><\/blockquote>\n

Sure enough, with only a week left in the session, the fate of the consumer health data privacy law My Health My Data (HB 1155) still hasn’t been fully decided. \u00a0My Health My Data protects “consumer health data”: data from apps, websites, retailers, advertisers, search engines, wearables like Fitbits, and so-called “crisis pregnancy centers” (CPCs), none of which is covered by HIPAA today. These protections are especially important in a post-Dobbs world, as states including neighboring Idaho criminalize providing, receiving, or helping people seek abortion and gender-affirming care. \u00a0But industries who make money by exploiting people’s data without their consent don’t want to be regulated … and the tech industry is very powerful here in Washington.<\/p>\n

Last week, the Senate passed a version1<\/a><\/sup> \u00a0with some significant improvements over the version the House passed last month \u2013 including a “private right of action” allowing people to sue companies and CPCs that break the law, something industry has fought against for years. \u00a0If House votes to concur, which most people seems to think is very likely, then once the Governor signs the bill, My Health My Data will become law. \u00a0That would make it the first consumer health data privacy law to pass anywhere in the US, and the first post-Dobbs data privacy law. \u00a0Given Washington’s justifiable reputation as a tech leader, that’s likely to influence legislation in other states and federally. \u00a0<\/p>\n

But if there are shenanigans the House votes against concurring, <\/figure>\n

\n

Image credit: <\/em>photo of Washington State Capitol by Al Toney, via Wikipedia Commons.<\/a> \u00a0licensed under the Creative Commons<\/a>Attribution-Share Alike 4.0 International<\/a> license.<\/p>\n

\n

Notes<\/h2>\n

1<\/sup> rather confusingly, both the Senate and the House version are referred to as ESHB 1155; \u00a0the acronym stands for engrossed substitute House bill 1155, and “engrossed” means that the substitute bill the Civil Rights & Judiciary committee advanced has been further amended. \u00a0The legislature’s bill page<\/a> links to the Senate version as 1155-S.E AMS ENGR S2826.<\/a>, and to the House version as the Engrossed Substitute<\/a>. \u00a0But wait, there’s more: the interim “striker” version advanced by the Law & Justice committee is also<\/em> referred to as ESHB 1155 and linked to as 1155-S.E AMS LAW S2558.1<\/a>; and there was also a floor striker from Senator Dhingra. Yeesh. \u00a0For simplicity, I’ll refer to them as the Senate version and House version.<\/p>\n

2<\/sup> \u00a0And I wouldn’t be surprised if this underestimates the actual support. \u00a0The question NPI asked combined several different aspects of the bill so was remarkably long:<\/p>\n

Do you strongly support, somewhat support, somewhat oppose, or strongly oppose blocking health tracking apps and advertisers from collecting and selling Washingtonians\u2019 health data without their consent, barring location-specific targeting of people who visit reproductive and gender affirming healthcare facilities, and requiring companies to maintain and publish a privacy policy for people\u2019s health data?<\/p><\/blockquote>\n

When I was summarizing the results to a friend, I described it as “76% support, and everybody else fell to sleep before the end of the question.” <\/p>\n

3<\/sup> 2020’s A bad day for a bad privacy bill, a good day for privacy<\/a> describes how the Senate version of the Bad WPA) didn’t even have a per se clause for Attorney General enforcement \u2013 so the bill was literally unenforceable. Microsoft’s blog post touted the bill’s “strong enforcement” and Future of Privacy Forum’s post inaccurately claimed the AG could enforce it \ud83d\ude02 \ud83d\ude02 \ud83d\ude02 ] \u00a0After spirited discussion and a great floor debate, the 2020 session ended with the bill dying in reconciliation after the House added a per se clause for the AG and a private right of action and tech refused any compromises. \u00a0Good times.<\/p>\n

4<\/sup> Along with a strengthening amendment: Sen. Keith Wagoner (Skagit and Snohomish Counties) proposing extending My Health My Data’s protections to data held by government agencies. Wagoner’s amendment addressed the tribal sovereignty issues Rep. Tarra Simmons (D-Kitsap County) had pointed out with a simliar House amendment, but didn’t address the issue that My Health My Data’s enforcement is via the CPA and the CPA doesn’t apply to government agencies. Chair Dhingra supported the idea in principle, but suggested that it needs to be addressed to another bill that has more comprehensive protections, and expressed hope that legislators from both parties will work on it in the interim. \u00a0Let’s hope that happens! And it’s worth mentioning that the People’s Privacy Act<\/a> (sponsored by Rep. Shelley Kloba (D-Kirkland) and Sen. Bob. Hasegawa (D-Seattle)) does <\/em>cover data held by government agencies, and has bipartisan sponsorship … so once again, as the session draw to a close, the People’s Privacy Act is closer to a hearing than it’s ever been!<\/p><\/p>\n","protected":false},"excerpt":{"rendered":"

UPDATE: about two hours after I posted this, the House voted to concur with the Senate version of My Health My Data! “This session ends on Sunday April 23, and privacy legislation has gone down to the wire the last four years. \u00a0It ain’t over ’til it’s over!” \u2013 A much more favorable environment, but […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[474,476],"class_list":["post-4206","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-my-health-my-data","tag-washington-state-privacy-legislation"],"_links":{"self":[{"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/posts\/4206","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/comments?post=4206"}],"version-history":[{"count":0,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/posts\/4206\/revisions"}],"wp:attachment":[{"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/media?parent=4206"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/categories?post=4206"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2024.thenexus.today\/index.php\/wp-json\/wp\/v2\/tags?post=4206"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}