April 6th, 2023: @Twitter has been randomly shutting down API access for many apps and sadly we were affected today too. Hopefully we will be restored soon! We appreciate your patience until then.
Currently discussing Sen. Mullet's amendment 298, which would significantly narrow the definition of consumer health data. @Dhingrama did a great job of discussing how this amendment would leave a lot of data unprotected. Padden supports, demands roll call.
@Dhingrama Short also opposes. Amendment 298 fails, 22-26
Up next Mullet moves 299, which incorporate 298 + strips per se clause with private right of action. Fails on a voice vote.
Mullet moves 305, the latest in a series of escalating amendments, incorporating 298 and the per se clause *and* a right to cure. Collect 'em all!
@Dhingrama makes a strong argument against the right to cure, highlighting the risk to pregant people in a post-Dobbs world.
305 fails on a voice vote.
Padden proposes amending the authorization for sale to only have categories of third-parties (as opposed to specific third parties) the data will sell to. Says it's modeled on California, @CalPrivacy is that true?
Oh but wait, that's not actually the amendment on issue. Kuderer opposes 292, Boehnke supports ... it fails, not completely sure what it was tbh.
Wagoner moves 291, extending protection to government agencies. I certainly like this idea in theory, but it's not clear how to incorporate it in this bill (with enforcement via the CPA)
@Dhingrama also likes the idea in theory but suggests it belongs in a different bill, a broader comprehensive privacy bill. Short and Padden both urge support. Padden notes that it's the height of hypocrisy to exempt government.
As they vote, it's worth noting that the People's Privacy Act (HB 1433) *does* cover government agencies and has bipartisan cosponsorship.
291 fails, I think on a straight party-line vote.
Short offers 303, pushing back enforcement for a year.
Dhingra opposes. Notes that the striker splits the timeframe: geofencing in 90 days, regulated entities on March 31 2024 (after the holidays), an additional three months for small businesses.
Amendment fails
Padden 294, oh this is the one that he was talking about before about not listing specific third parties in the authorization.
Kuderer opposes, note that HIPAA lists specific third parties, and consumers need to know this info.
Amendment fails
Mullet withdraws 285 (the standalone right-to-cure, which was covered in one of his combos)
Padden moves 293, removing private right of action, and adds a right to cure. Cites businesses pulling out of Illinois after BIPA (which also had PRA), concerns of frivolous ligitation.
There was a similar anti-consumer amendment in the House, and three Democrats joined Republicans in voting for it, but it still failed.
Rare bipartisan agreement that tvw streaming is useful!
OK now back to arguing ...
@Dhingrama notes that the striker adds a commission to look at enforcement. Will we really have frivolous lawsuits? Asks for a no vote.
Short supports.
Amendment fails on a roll-call vote, it'll be interesting to see if any Dems voted yes.
Mullet withdraws 286, removing the per se clause for private actions - it was included in one of his combos. One of the effects of all this legislative maneuvering was that they never had a straight-up vote on this.
The per se clause is one of the biggest differences from the House version so will be a big focus in concurrence and negotiations. Without a Senate vote ... hmm, interesting.
I missed another amendment by Short that fialed, sorry about that.
Dhingra moves an amendment to fix a typo. Adopted unanmiouslyl! Huzzah!
Now the adoption of Sen Dhingra's striker as amended. Adopted.
And now the vote on the bill itself!
@Dhingrama notes there's been a robust discusion of what's in the bill ... now, why it's important.
Our laws haven't kept up with the way we use tech, the way companies sell information, the inferences they make.
Notes that we're all used to seeing ads based on what we search for and say. Sometimes it's helpful -- ads for shoes! Sometimes it's very dangerous. This bill makes people aware of consequences.
"We're going to see screens saying do you agree, and the vast majority of people will consent. But people who are at risk -- gender-affirming care -- have the option of saying please delete info, don't keep it"
Padden agrees with the goals, says there are good things in it, but the private right of action really bothers him -- and the government exemption.
@SenatorTrudeau: this is about autonomy and freedom. Regardless of how you feel about reproductive rights or gender-affirming care, you should support the bill. It's an issue of precedent, protecting the freedom of the individual over tech companies' priorities
Trudeau turns around the private right of action argument, notes that it's really a matter of indivdual rights instead of havingn to rely on the AG. Have to look at it as a holistic issue. Our data is being stored, mined, and shared in a way that's deeply offensive
At the end of the day, one of the foundations of our consumer law is the right of private action. Cites Marbury v. Madison: "There is no right without a remedy."
Bill's about protecting people who are making decisions that are putting them at risk.
Sen. Braun says that if it were- after all, they passed the Bad Washington Privacy Act 48-1 three times, even when it wasn't enforceable! [OK, he didn't mention it wasn't enforceable.] really about freedom, they'd be on the same side -
Braun: we shouldn't pick winners and losers, we shouldn't pick on big tech, we shouldn't boost trial lawyers.
Kuderer: this bill's about protecting consumers. This bill's narrowly tailored to protecting personal healh information. It *should* be treated differently because of the potential for personal harm and incarceration.
If we're going to put profit over people, that's a value I don't share at all. It's a trillion-dollar industry of selling data, I don't think the inconvenience of having to opt in is a problem. Businesses can adapt.
Very willing to work with Sen. Padden on a bill for gov't net year. But that's not what this is about. It's not about trial lawyers, it's about access to justice. I'd like to see the stats on frivolous lawsuits. And the judge can dismiss frivolous lawsuits.
Kuderer: We're going to lead the country providing strong protections for personal health data.
A great note to end on! And now the vote ..
My Health My Data passes the Senate, 27-21 with one excused. Huzzah!!!!
- Republicans are likely to continue to vote against My Health My Data's protections for our health data and pregnant people
- Corporate Democrats are pressing to weaken the bill
- Privacy advocates continue to push to strengthen it. #waleg
The full post has details on the background of how we got here, a look at potential floor amendments, and a preview of what's next if the Senate does indeed pass an amended version of ESHB 1155.
"What are Automated Decision Systems and why you should care?", a webinar Washington state Chief Privacy Officer Katy Ruckle and I did last year, has background.
The 2021 Washington state ADS Workgroup report goes into a lot more detail. government agency leads, researchers (including me!), and representatives from advocacy organizations came up with consensus recommendations for a path forward.
Today's Nexus of Privacy News Mega-Roundup: data brokers selling American's mental health data, state and federal #privacy legislation, news from across the pond ...
Here's a short thread of highlights. See the full newsletter for much more!
- requires opt-in consent before companies collect, use, or share data
- prohibits sales of health data
- restricts geofencing around health facilities
@ACLU's."Identity Crisis: What Digital Driver’s Licenses Could Mean for Privacy, Equity, and Freedom" has more on the risks of #DigitalDriversLicenses.
The 2023 session is already in high gear, and once again there's some significant privacy legislation.
If you're just tuning in, "What's Past is Prologue" and "Significant successes for Washington privacy advocates" have the backstory. privacy.thenexus.today/wa-privacy-mor…