My Health My Data heads to the Senate floor: Washington privacy legislation update, April 4

Attorney General Bob Ferguson, Senator Manka Dhingra and Representative Vandana Slatter have a media event at 12:30 today, streamed live on TVW, to discuss polling results regarding the privacy of reproductive health data.

With only three weeks left in the legislative session, the stakes are high for the upcoming Washington State Senate floor vote on the My Health My Data (HB 1155) consumer health data privacy bill. Everybody says they agree with the bill's goals of protecting consumer health data and people seeking reproductive, sexual, and gender-affirming health care. But industry continues to press to weaken enforcement and insert loopholes, Republicans have consistently voted againt the bill so far, and a small handful of industry-friendly Democrats are trying to use their leverage to shape the bill to better serve their corporate masters – or, perhaps, even kill it.

With the Senate expected to vote as early as tomorrow, now's a good time to look at the potential course of the bill.  First though, let's do a brief recap of what's happened to date.

UPDATE: On April 5, the Senate passed an amended version of My Health My Data 27-21, rejecting amendments to remove or limit the per se clause, but delaying enforcement on small businesses an additional three months.  Up next: the House votes on whether to "concur" and accept the Senate's changes.  Stay tuned!

And you may ask yourself ... well, how did we get here?

A bill proposed by Washington state lawmakers would make it illegal for period-tracking apps, Google or any other website to sell consumers' health data while also making it harder for them to collect and share this personal information.

Washington Representative Vandana Slatter, a Democrat, introduced House Bill 1155 [PDF], the My Health, My Data Act, in response to the US Supreme Court ruling last year to overturn Roe v. Wade, which removed constitutional rights to abortion. Since then, a dozen states have banned the procedure.

"It's long overdue that we have increased data protections for our most sensitive health data, and it's taken on an increased urgency in a post-Dobbs world," Slatter told The Register. "This information, if it's bought or sold, can do real harm."

– Proposed Washington law puts period-tracking apps on notice, Jessica Lyons Hardcastle in The Register, January 18

My Health My Data's initial announcement last October  by Rep. Vandana Slatter (D-Bellevue), Sen. Manka Dhingra (D-Redmond), and Attorney General Bob Ferguson.  The bill described in the announcement, and in Rep. Slatter's original version of HB 1155,  not only required opt-in consent before collecting and sharing consumer health data, it also prohibited sales of consumer health data and the use of geofencing at reproductive and gender affirming health care facilities.  At its House Civil Rights & Judiciary (CR&J) Committee hearing, Legal Voice, Gender Justice League, Cedar River Clinics, ACLU of Washington, Pro-Choice Washington, Planned Parenthood Alliance Advocates, SEIU Healthcare 1199NW, patients, and privacy advocates (including me!) all supported it – although CR&J Chair Drew Hansen (D-Kitsap County) prevented not allowing four women and a trans femme person (several of whom have very relevant experience in the tech industry) from testifying.

But the industry lobbyists who water down state privacy regulation testified OTHER, claiming they supported the bill's goals while suggesting numerous "improvements" that undercut the bill's protections.  Chair Hansen  took most of industry's suggestions for improvements, and the CR&J committee advanced SHB 1155, a watered-down substitute version of the original bill. Then the House adopted an amendment from Rep. Amy Walen (D-Bellevue) limiting the "per se" clause for civil suits and making it virtually impossible for individuals to succeed in suits companies (or so-called "crisis pregnancy centers" (CPCs) run by anti-abortion groups) who break the law.

So my feelings were very mixed when the House advanced ESHB 1155 .  On the one hand, the tech industry is very influential here in Washington, so getting anything through the House in the teeth of their lobbying was a huge accomplishment; and the original bill was so strong that even after the watering down, it still has some very valuable protections. Opt-in consent for collecting, using, and sharing consumer health data, and a separate signed authorization required for selling it, is a big deal! But on the other hand, it seemed to me that there were enough loopholes and exemptions in the bill that it would still be easy for law enforcement and bounty hunters to target people getting reproductive and gender-affirming care, and for big tech companies and data brokers to continue to make money by exploiting our data.  Even worse, Rep. Walen's amendment had gutted enforcement and the bill's protections for reproductive rights.

Fortunately, testimony at the Senate Law & Justice committee hearing from Cher Scarlett, Raquel Clavette, and ACLU of Washington's Jennifer Lee – and written testiony from Legal Voice as well as grassroots privacy activists who didn't get to speak at the hearing — highlighted some of the issues with the House bill.  Law & Justice committee member Sen. Yasmin Trudeau, who was previously in the AGO, made a powerful case for why the per se clause is so important from a consumer protection perspective.  And at Town Halls across the state, constituents asked their legislators why the bill had been weakened so much despite the huge outpouring of support.

So Chair Dhingra and the rest of the Law & Justice committee advanced a new version (still formally known as ESHB 1155, although technically it's amendment S2558.1) that restored the per se clause (undoing the effects of the Walen amendment), and included several other important improvements. It's not everything that privacy advocates had been looking for but it's significant progress over the version the House advanced.  But of course that's just one committee's opinion.  Now, the full Senate gets a chance to consider further amendments and then vote on the (potentially-further-amended) bill.

What to expect on the Senate floor

The Senate has to pass My Health My Data by April 12.  If as expected they vote on it this week, we 're likely start to see potential amendments as early as today. My guess is that a small number of corporate Democrats are threatening to vote against the bill unless it's weakened.  If so, the vast majority of Democrats who want to protect people seeking reproductive, sexual and gender-affirming care will have to decide whether to call their bluff.  At this point, all the discussions are behind closed doors, so it's anybody's guess how it'll come out.

If discussions in the caucus room don't lead to agreement and there aren't enough votes to pass something, then it's possible that My Health My Data won't even get a Senate floor vote. That seems very unlikely to me – would Senate Democrats really be so self-destructive that they'd let this key bill fail at this point? But then again, you never know.

Assuming it does get to the floor, one key battle will be over the "per se" clause. Republicans will almost certainly introduce amendments to remove or limit it. Will corporate Democrats do the same?  How else will they try to weaken enforcement?

In the House, Rep. Walen started by introducing an amendment to completely eliminate the per se clause for civil suits along with another to give tech companies, auto dealerships, and CPCs an unlimited number of get-out-of-jail-free cards (aka the "right to cure").  Then she introduced "compromises": severely limiting (but not compeltely removing) the per se clause, and limiting the "right to cure" so that tech companies, auto dealerships, and CPCs only get a limited number of get-out-of-jail free cards.  Then she withdrew the "compromise" "right to cure" amendment, and House Democrats agreed to the "compromise" of severely limiting people's ability to sue tech companies, auto dealerships, and CPCs.

We might well see similar tactics in the Senate.  Then again, there are plenty of other ways to limit enforcement, so perhaps we'll see some different "compromises" suggested.

Of course, enforcement is far from the only issue on the table!  A dozen Indivisible groups sent a letter to the Senate last week asking  lawmakers to oppose all weakening amendments and support strengthening, for example by closing loopholes related to location data and geofencing, a topic Washington Privacy Organizers' short analysis looks at in more detail. It'll be interesting to see if any Democrats propose strengthening amendments. And industry lobbyists have their own wish list.  Republicans are likely propose to once again propose several amendments on industry's behalf,  all of which will be rejected.  

We're also likely to see a Republican amendment to extend the bill's protections to cover data stored by government agencies. There's a lot to be said for this idea in principle; indeed, the People's Privacy Act covers govenment agencies as well as businesses and non-profits.  However,as Rep. Tarra Simmons (D-Kitsap County) pointed out in the House floor debate, the specific language of the amendment Republicans keep proposing is problematic for multiple reasons, including raising sovereignity issues with tribal governments.  So this too will be rejected.  Hopefully legislators from both parties will craft a more workable version of this for next session – or just pass the People's Privacy Act!

There may well be more amendments, with technical fixes smoothing out rough edges.  Often, multiple changes get bundled into a "striker", which can then be further amended.  On the House floor, there were over 20 amendments (although a few got withdrawn before voting), so it could be a lengthy session.

Once all the amendments are voted on, then there's a final vote on the amended bill.  It's rare for bills to be voted down at this stage – if there aren't the votes, then it usually doesn't even come to the floor – but not to sound like a broken record: you never know.

A quick note about gender

As far as I know all the corporate Democrats in the Senate who are pushing to weaken My Health My Data are cis guys.  

Actually, let me be a bit more specific.  As far as I know all the corporate Democrats in the Senate who are pushing to weaken My Health My Data's protections for pregnant people and people seeking gender-affirming care are cis guys.

Just sayin'.

What next?

Assuming the Senate passes something, then ...

• The next step is to go back to the House, who has the option to concur by accepting the Senate changes.
• If the House says no, then the Senate has the option to go with the House's version.  
• If that doesn't happen, then it goes to a cross-chamber negotiating committee who has to come up with a version that both chambers approve.  

And it all has to be done by April 24 – unless of course the Governor tells legislators to stay longer, or calls for a special session.  

So there's still a long way to go for My Health My Data, and one lesson we've learned time and again with privacy legislation in Washington is that it ain't over 'til its over.

Stay tuned!