• by Wendy Davis , Staff Writer @wendyndavis, April 27, 2023

Washington Governor Jay Inslee on Thursday signed what may be the country's broadest privacy law -- the My Health My Data Act, which prohibits app developers, website operators and others from collecting, processing or sharing a broad range of information about consumers' health without their explicit consent.

The law also prohibits companies from using geotargeting techniques to send ads to anyone within 2,000 feet of facilities providing health-care services in Washington state. Additionally, the law bars companies from using location-tracking technology within 2,000 feet of a health care center in order to identify consumers, or to collect health data.

The statute's expansive definition of health data includes not only medical conditions and prescription information, but also “social” or “behavioral” interventions, reproductive or sexual health information, biometric data and genetic data, among other data.

Another provision allows consumers to sue over violations.

The law marks one of the first post-Dobbs attempts to protect the privacy of people seeking abortions and gender-affirming care.

“The right of choice is an issue of freedom,” Inslee stated Thursday when he signed five health related bills, including My Health My Data. “Health care must remain the providence of individual Washingtonians. These laws will keep the tentacles of oppressive and overreaching states out of Washington.”

Supporters, including the ACLU of Washington, called the act “a critical step towards defending and expanding access to abortion and gender affirming care in Washington state.”

At the same time, the law restricts the collection or transfer of health data unrelated to abortion, reproductive health care or gender affirming care.

Mike Hintze, former chief privacy counsel for Microsoft, has written that the ban on geotargeted ads could apply to numerous businesses.

“A grocery store that offers nutrition tips could be providing 'health care services' and that store’s loyalty club app that offers coupons when entering the store could, therefore, be seen as violating this prohibition,” he wrote earlier this month.

The policy organization Chamber of Progress, which is funded by the tech industry, unsuccessfully urged Inslee to veto the bill -- partly due to its broad definition of health data.

That group argued in a letter sent last week that “health data” should “specifically refer to physical or health data, condition or diagnosis generated by the consumer,” but should also be not so broad to include socio-economic data, or so narrow that it excludes menstruation data.

The organization also objected to a provision that allows consumers to sue violators.

The ad-industry self-regulatory group Network Advertising Initiative said Thursday that it shares the goals of the statute, adding that the new law partly aligns with the group's existing code and guidance regarding sensitive data.

The organization recently advised “location solutions providers” -- meaning companies that amass and analyze precise location data -- to refrain from collecting, using or sharing information that could reveal consumers' visits to abortion clinics, homeless shelters, jails or a host of other “sensitive” locales.

The Network Advertising Initiative considers some health data “sensitive” -- including inferences about medical conditions like cancer or sexually transmitted diseases -- but doesn't consider conditions like colds, treatable with over-the-counter products, to be sensitive.

The new Washington law appears to apply to all health data, including the type of information the Network Advertising Initiative doesn't deem sensitive.

CEO Leigh Freund stated Thursday that where the law imposes new requirements, the group “will work with its members, their partners, and all stakeholders to promote best practices for digital advertising businesses to comply.”

David LeDuc, vice president for public policy at the group, tells MediaPost he anticipates that some location analytics companies may simply stop offering services in Washington.

“I think location companies will drastically reconsider what they do in the state of Washington,” he says, adding that those businesses “may just decide that it's wiser to just not operate in the state of Washington.”