Here’s the translation into American English:
—
In 2023, the state of Washington made significant progress in data privacy protection with the implementation of the “My Health, My Data” law (HB 1155). This legislation has been enthusiastically received by civil rights and reproductive justice advocates, who played a key role in its creation. The primary focus of this law is the protection of consumer health data, which refers to information that can be associated with an individual and identifies their physical or mental state. This includes a variety of conditions and treatments, particularly in sensitive areas like reproductive care and gender affirmation. Although the ultimate goal is to safeguard all types of personal data, starting with the protection of medical information is a significant step.
Washington’s approach is comprehensive, as it protects all “consumers,” encompassing anyone residing in the state or whose health data have been collected there. This strategy prevents regulated entities from discriminating regarding which data is collected, thus promoting greater collection of sensitive information. However, the law excludes certain contracted service providers that process data on behalf of the government, a factor that has raised some concerns.
A crucial point of this law is the requirement to obtain consumer consent before collecting or sharing their health information. “Consent” is defined as an affirmative and voluntary act, meaning that without this consent, entities are not authorized to collect or share data, except when necessary to fulfill a requested service.
The legislation also includes measures to protect the privacy of location data, which are often collected and sold to advertisers. In this regard, the use of geofences around health services is prohibited, thus providing significant safeguards for consumers.
Among other measures, regulated entities are required to publish a privacy policy that explains the types of data collected and their purposes. Additionally, consumers must be given the opportunity to access their information and delete it, restricting data access only to personnel who truly need it.
The effectiveness of these regulations largely depends on enforcement mechanisms. Washington’s law allows individuals to sue entities that violate their privacy rights, which is essential for ensuring accountability. It also aims to prevent any harm that might arise from forcing consumers to pay to protect their privacy.
This legislative advance highlights that data privacy is a crucial issue in current public policy. However, there is a need to progress toward a more robust framework that recognizes violations of data privacy as a legal harm in itself. In a national context of debate over data privacy regulation, Washington’s experience could serve as a valuable model for other states looking to implement laws that protect their citizens.
Referrer: MiMub in Spanish