0
The flag of Washington state, depicting an image of George Washington's face in a yellow circle, with a green background.

An Overview of Washington’s “My Health, My Data” Act

Health Data, State Privacy Laws, United States
On April 27, 2023, Governor Jay Inslee of Washington signed into law HB 1155, the “My Health, My Data” Act (MHMD Act). The MHMD Act claims to address the lack of protections for health data collected by entities not covered by HIPAA, the federal law that regulates how hospitals, health care providers, and other covered entities can handle health data. To achieve that goal, the MHMD Act was drafted in such a way as to provide sweeping protections that go beyond what most would consider to be protected “consumer health data.” For example, the scope of the definition, as we detail below, may include athletic equipment, footwear, or even groceries such as ginger. In addition, the MHMD Act introduces consumer rights, privacy policy obligations, contractual requirements, and more. To ensure the MHMD Act is adhered to, the legislature included a private right of action, thereby opening the door to plaintiff litigation to enforce the Act. Taking this all into consideration, the Washington “My Health, My Data” Act may be the most consequential US privacy legislation enacted in this decade.
Washington My Health, My Data Act  Scope & Applicability.
  • Covered Entities. The MHMD Act imposes restrictions and obligations on two types of entities, regulated entities and small businesses. The impact of being qualified as a small business rather than a regulated entity is only a three-month delay of the effective date. See Effective Dates, below.
 
    • Regulated Entity. A regulated entity is one that:
      • Conducts business in Washington, or produces or provides products or services that are targeted to consumers in Washington; and
      • Alone or jointly with others, determines the purpose and means of collecting, processing, sharing, or selling of consumer health data. Sec. 3(23).
 
    • Small Business. A small business is a regulated entity that satisfies one or both of the following thresholds:
      • Collects, processes, sells, or shares consumer health data of fewer than 100,000 consumers during a calendar year; or
      • Derives less than 50 percent of gross revenue from the collection, processing, selling, or sharing of consumer health data, and controls, processes, sells, or shares consumer health data of fewer than 25,000 consumers. Sec. 3(28).
 
  • Protected Consumers. A consumer under the MHMD Act is either:
    • a natural person who is a Washington resident; or
    • a natural person whose consumer health data is collected in Washington.
  • “Consumer” does not include individuals acting in an employment context, nor does it include B2B relationships. Sec. 3(7).
 
  • Protected Data. The MHMD Act regulates “consumer health data,” which is defined as information that identifies or is reasonably capable of being associated or linked, directly or indirectly, with a particular consumer and that identifies the consumer’s past, present, or future physical or mental health status. Sec. 3(8)(a); Sec. 3(18)(a). Physical or mental health status includes:
    1. Individual health conditions, treatment, diseases, or diagnosis.
    2. Social, psychological, behavioral, and medical interventions.
    3. Health-related surgeries or procedures.
    4. Use or purchase of prescribed medication,
    5. Bodily functions, vital signs, symptoms, or measurements of any information in this list.
    6. Diagnoses or diagnostic testing, treatment, or medication.
    7. Gender-affirming care information.
    8. Reproductive or sexual health information.
    9. Biometric data.
    10. Genetic data.
    11. Precise location information that could reasonably indicate a consumer’s attempt to acquire or receive health services or supplies.
    12. Data that identifies a consumer seeking health care services.
    13. Any information that a regulated entity or a small business, or their respective processor, processes to associate or identify a consumer with the data described above that is derived or extrapolated from non-health information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning). Sec 3(8)(b)(i)-(xiii).
 
    • Health Care Services. The most notable among the above list is number 12, data that identifies a consumer seeking health care services. The MHMD Act defines “health care services” to mean any service provided to a person to assess, measure, improve, or learn about a person’s mental or physical health. Sec. 3(15). Recognizing that this broad definition could apply to numerous everyday items, Senate members introduced an amendment to expressly exclude such items as athletic equipment, footwear, perfumes, jewelry, toys, cleaning products, recreational cannabis, groceries, and more. However, the amendment was ultimately defeated.
 
    • Biometric Data. It is worth noting that the MHMD Act states that biometric information includes imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template can be extracted. Sec. 3(4)(a).
  Substantive Provisions
  • Security Standards. A regulated entity or small business must establish and maintain data security practices that, at a minimum, satisfy the reasonable standard of care within the regulated entity’s or small business’s industry to protect the confidentiality, integrity, and accessibility of consumer health data. Sec. 7(1)(b).
 
  • Geofencing Restrictions. It is unlawful for any person to implement a geofence around an entity that provides in-person health care services where such geofence is used to identify or track consumers seeking health care services, collect consumer health data from consumers, or send notifications, messages, or advertisements to consumers related to their consumer health data or health care services. Sec. 10.
 
  • Privacy Policy. Regulated entities and small businesses must maintain a privacy policy that discloses:
    • The categories of consumer health data collected and the purpose for which the data is collected, including how the data will be used.
    • The categories of sources from which the consumer health data is collected.
    • The categories of consumer health data that is shared.
    • The list of the categories of third parties and specific affiliates with whom the regulated entity or the small business shares the consumer health data.
    • How a consumer can exercise the rights provided under the MHMD. Sec. 4(1)(a).
 
  • Restricted Data Collection. A regulated entity or small business cannot collect any consumer health data except (i) with consent from the consumer for such collection for a specified purpose or (ii) to the extent necessary to provide a product or service that the consumer has requested from such regulated entity or small business. Sec. 5(1)(a). Consent under the MHMD Act means a clear affirmative act that signifies a consumer’s freely given, specific, informed, opt-in, voluntary, and unambiguous agreement. Sec. 3(6)(a). Notably, consent cannot be obtained by acceptance of a general or broad terms of use agreement or similar document. Sec. 3(6)(b)(i).
 
  • No Sales without Valid Authorization. A “sale” under the MHMD Act means the exchange of consumer health data for monetary or other valuable consideration. Sec. 3(26)(a). It is unlawful for any person to sell or offer to sell consumer health data concerning a consumer without first obtaining valid authorized signed by the consumer. Valid authorization is a document containing:
    • The specific consumer health data concerning the consumer that the person intends to sell;
    • The name and contact information of the person collecting and selling the consumer health data;
    • The name and contact information of the person purchasing the consumer health data;
    • A description of the purpose of the sale, including how the consumer health data will be gathered and how it will be used by the purchaser;
    • A statement that the provision of goods or services may not be conditioned on the consumer signing the valid authorization;
    • A statement that the consumer has a right to revoke the valid authorization at any time and a description on how to do so;
    • A statement that the consumer health data sold pursuant to the valid authorization may be subject to redisclosure by the purchaser and may no longer be protected by this section;
    • An expiration date for the valid authorization that expires one year from when the consumer signs it; and
    • The signature of the consumer and date of signature. Sec. 9(2).
 
  • Data Processor Agreements. The MHMD Act defines a “processor” as any person that processes consumer health data on behalf of a regulated entity or small business. Sect. 3(20). A processor may process consumer health data only pursuant to a binding contract between the processor and the regulated entity or small business that sets forth the processing instructions and limit the actions the processor may take with respect to the consumer health data. Sec. 8(1)(a)(i).
  Consumer Rights The MHMD Act provides consumers with several privacy rights, including:
  • Right to Know. A consumer has the right to confirm whether a regulated entity or small business is collecting, sharing, or selling consumer health data concerning the consumer. Sec. 6(1)(a).
  • Right to Access.  A consumer has the right to access data concerning the consumer, including a list of all third parties and affiliates with whom the regulated entity or the small business has shared or sold the consumer health data and an active email address or other online mechanism that the consumer may use to contact the third parties. Sec. 6(1)(a).
  • Right to Withdraw Consent. A consumer has the right to withdraw consent from the regulated entity’s or the small business’s collection and sharing of consumer health data concerning the consumer. Sec. 6(1)(b).
  • Right to Delete. A consumer has the right to have their consumer health data deleted. Sec. 6(1)(c).
  • Right to Appeal. A consumer has the right to appeal the regulated entity’s or small business’s refusal to take action on a request. Sec. 6(1)(g).
  Exemptions The MHMD Act exempts information subject to HIPAA, GLBA, FCRA, and FERPA. Sec. 12.   Enforcement. Violations of the MHMD Act are enforceable under the Washington Consumer Protection Act (WCPA) as an unfair or deceptive act in trade or commerce and an unfair method of competition. Sec. 11; RCW 19.86.020.
  • State AG Enforcement. The WCPA is enforced by the Washington Attorney General. RCW 19.86.080.
 
  • Private Right of Action. The WCPA includes a private right of action for alleged unfair or deceptive acts or practices. RCW 19.86.093. Civil penalties under the WCPA can rise to $7,500 per violation, RCW 19.86.140, and can include treble damages up to $25,000. RCW 19.86.090.
  Effective Dates
  • For regulated entities, MHMD’s provisions go into effect on March 31, 2024.
  • For small businesses, MHMD’s provisions go into effect on June 30, 2024.
0
Flag of California, depicting a large brown bear beside a red star, above the words "California Republic."

CPRA regulations finalized and effective immediately

California, CCPA, State Privacy Laws, United States
[Update: On March 30, 2023, the California Chamber of Commerce filed suit against the California Privacy Protection Agency, arguing that the amended regulations should not enter force until once year following finalization of the regulations. The court agreed, holding that enforcement cannot occur until one year after the regulations were finalized, thereby pushing the enforcement date from March 29, 2023, to March 29, 2024. The case is being appealed, but it is not expected to be finalized until after the new enforcement date.]
On March 30, 2023, the California Privacy Protection Agency (the Agency) announced that its first rulemaking package for the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), was approved by the California Office of Administrative Law (OAL).[1] Approval by the OAL marks the completion of the rulemaking process, thereby making the regulations effective immediately. “This is a major accomplishment, and a significant step forward for Californians’ consumer privacy. I’m deeply grateful to the Agency Board and staff for their tireless work on the regulations, and to the public for their robust engagement in the rulemaking process,” CPPA Board Chair Jennifer Urban said in a statement.[2] The regulations build upon and clarify provisions within the CPRA, which amended and expanded the CCPA. For example, the regulations allow businesses to offer a “Your Privacy Choices” mechanism on a website’s homepage instead of a “Do Not Sell or Share My Personal Information” mechanism. The regulation had originally been scheduled for completion for July 1, 2022, but due to insufficient staffing and resources, the Agency announced an extended delay to the process.[3] This delay of almost a year left businesses and privacy professionals scrambling, because the CPRA came into effect on January 1, 2023, yet many of its provisions were unclear. Now, finalization begets clarity. That said, the Agency’s enforcement efforts will begin July 1, 2023, which gives little time to comply with the regulations. The Agency has indicated a soft initial approach to enforcement though. Section 7301(b) of the finalized regulation state that the Agency may “consider all facts it determines to be relevant, including the amount of time between the effective date of the statutory or regulatory requirement(s) and the possible or alleged violation(s) of those requirements, and good faith efforts to comply with those requirements.” While this leaves some breathing room, it does not alleviate non-compliance in all instances, and businesses should move to finalize compliance with these regulations. The final regulations, although effective immediately, will not be published publicly until they are processed, which is expected to happen next week. The final regulations will be made available here: https://cppa.ca.gov/regulations/consumer_privacy_act.html
[1] https://cppa.ca.gov/announcements/ (announcement on March 30, 2023) [2] Id. [3] https://iapp.org/news/a/cpra-regulations-delayed-past-july-1-deadline-expected-q3-or-q4/
0
This is the flag of Iowa, depicting an eagle holding a banner that reads, "Our liberties we prize and our rights we will maintain."

And then there were six!

State Privacy Laws, United States
On March 28, 2023, Gov. Reynolds of Iowa signed into law SF 262, a bill for an act relating to consumer data protection. By signing the bill into law, Gov. Reynolds established Iowa as the sixth state to establish a comprehensive data protection framework. “In our digital age, it’s never been more important to state, clearly and unmistakably, that consumers deserve a reasonable level of transparency and control over their personal data,” said Gov. Reynolds. “That’s exactly what this bill does, making Iowa just the sixth state to provide this kind of comprehensive protection.”[1] Full text of the law: here. Iowa’s approach to data protection is similar to Utah’s approach, but it shares a basic framework with Colorado, Connecticut, and Virginia. However, California’s approach remains unique among the pack. We will continue monitoring all state legislatures for more developments.
[1] https://governor.iowa.gov/press-release/2023-03-28/gov-reynolds-signs-sf-75-and-sf-262-law
0
Logo for the European Commission.

The EU’s Digital Markets Act: Who it regulates, how to comply, and next steps

EEA & UK, GDPR, Resource
On October 12, 2022, the Digital Markets Act (DMA) was published in the Official Journal of the EU, thereby creating a new framework for regulating the European Union’s digital market.[1] The DMA seeks to prohibit certain unfair business practices by establishing rules and obligations for entities known as “gatekeepers,” which are large online platforms whose services have a significant impact on the EU internal market.[2] The DMA works in conjunction with its sibling law, the Digital Services Act (DSA), to create an online environment designed to protect the fundamental rights of users and to establish a level playing field for economic growth. However, the DMA — like the DSA and the General Data Protection Regulation (GDPR) — can apply internationally to companies based outside of the EU, so all large online platforms should be aware of what the DMA could mean for businesses that qualify as gatekeepers. Background On December 15, 2020, the DMA was proposed by the European Commission to the European Parliament and to the Council of the EU, alongside the DSA.[3] The DMA and the DSA seek to actualize Ursula von der Leyen’s call to regulate the EU’s digital market, thereby upgrading the liability, safety, and fairness of digital platforms.[4] On March 24, 2022 — after years of negotiations — the Parliament, the Council, and the Commission reached a consensus on key provisions, including the interoperability provisions for large messaging platforms and noncompliance penalties.[5] The text of the DMA was then made public on May 22, 2022.[6] From there, the DMA moved swiftly through the legislative process: on July 5, Parliament formally adopted it;[7] on July 19, the Council formally adopted it;[8] on September 14, the DMA was signed into law;[9] and on October 12, the adopted text was published in the Official Journal of the European Union, thereby setting it to come into force twenty days later.[10] To whom does the DMA apply? The DMA applies to “gatekeepers” that provide or offer “core platform services” to users in the Union, irrespective of whether the gatekeeper is located or established in the EU. A “core platform service” is broadly defined to include a wide range of Internet infrastructure and services, including:
  • Online search engines;
  • Online social networking services;
  • Video-sharing platform services;
  • Operating systems;
  • Web browsers;
  • Cloud computer services;
  • Online advertising services;
  • And more.
Given how broadly the DMA defines core platform services, the core question for most entities is whether their services reach enough EU individuals to establish them as a gatekeeper under the law. A “gatekeeper” is an entity that meets all of the following:
Statutory criteria: Presumed satisfied if:
  1. Has a significant impact on the EU internal market.
  1. Achieves an annual EU turnover of at least EUR 7.5 billion in each of the previous financial years, or have an average market capitalization or fair market value of at least EU 75 billion in the last financial year; and
 
  1. Provides the same core platform service in at least three Member States.
  1. Provides a core platform service that is an important gateway for business users to reach end users
  1. Provides a core platform service that in the last financial year has at least 45 million monthly active end users in the EU; and
 
  1. Has at least 10,000 yearly active business users established in the EU.
  1. Currently enjoys, or will foreseeably enjoy in the near future, an entrenched and durable position, in its operations.
  1. In each of the last three financial years:
    1. has provided a core platform service that has at least 45 million monthly active end users in the EU; and
    2. has at least 10,000 yearly active business users established in the EU.
The DMA puts the onus on companies and other entities to determine for themselves whether they satisfy the above requirements to be labeled a gatekeeper under the law. If an entity makes such a determination, they must notify the European Commission within two months after the thresholds are met. However, even if an entity fails to make such a notification, the Commission can determine for itself whether an entity is a gatekeeper. Can the Digital Markets Act apply to entities outside of the EU? Yes. The DMA applies to any gatekeeper that provides or offers core platform services to users in the Union, irrespective of whether the gatekeeper is located or established in the EU. However, providing or offering a core platform service is not sufficient in itself to establish an online platform as a covered gatekeeper. The online platform must satisfy all three of the bullet points above. And as the explanatory presumptions for each bullet demonstrate, the online platform must have a substantial number of EU users (e.g., 45 million monthly active end users in the EU). Thus, online platforms must be vigilant in monitoring the number of monthly users in the EU, because qualifying as a gatekeeper appears to hinge on the platform’s userbase reach. Of course, tracking this data must be done appropriately and with careful consideration, given that the online platform would also have to comply with the GDPR’s data minimization and purpose principles. Does the DMA treat all gatekeepers equally? No. The DMA prescribes a number of prohibitive and mandatory actions on all gatekeepers. These include:
  • Not combining personal data from the core platform service with personal data from any other core platform services, any other services provided by the gatekeeper, or with personal data from third-party services (Art. 5(2)(b)).
  • Not requiring users to sign in to other services in order to combine personal data (Art. 5(2)(d)).
  • Allowing business users, free of charge, to promote their offers and conclude contracts with customers outside the gatekeeper’s platform (Art. 5(4)).
  • Providing companies advertising on the platform with the daily information, free of charge, concerning each advertisement placed on the core platform (Art. 5(9)-(10)).
However, per Article 8, some obligations are subject to specification. The Commission, either on its own initiative or based on a submission by a gatekeeper, can open a procedure that will lead to the Commission specifying some measures that the gatekeeper must adopt in order to effectively comply with the DMA. The provisions subject to specification are found in Articles 6 and 7, and they include:
  • Allowing third parties to interoperate with the gatekeeper’s own services in certain situations (Art. 6(7)).
  • Allowing business users to access the data they generate in their use of the gatekeeper’s platform (Art. 6(10)).
  • Providing companies advertising on the platform with the tools necessary for advertisers and publishers to carry out their own independent verification of advertisements hosted by the gatekeeper (Art. 6(8)).
  • Not preventing users from uninstalling any pre-installed software or app, if they wish to (Art. 6(3)).
  • Not treating services and products offered by the gatekeeper itself more favorably in ranking than similar services or products offered by third parties on the gatekeeper’s platform (Art. 6(5)).
  • Not preventing consumers from linking up to businesses outside their platforms (Art. 6(6)).
This means that, while all gatekeepers must adhere with the DMA’s obligations, some gatekeepers may have specific instructions on how to satisfy the requirements within the context of that gatekeeper’s unique situation. Are the enforcement penalties harsher than the GDPR? Yes. Under the DMA, if the gatekeeper intentionally or negligently fails to comply with certain requirements, the Commission may impose a fine of up to 10% of the gatekeeper’s worldwide turnover in the preceding financial year. By contrast, GDPR violations can result in a fine of up to EUR 20 million or 4% of a company’s worldwide annual revenue from the preceding financial year, whichever is higher. And it’s worth recalling that gatekeepers are, by definition, extremely large companies serving multi-millions of users, so the company’s annual worldwide turnover would presumably be large as well. What are the next steps for the DMA? Within two months of May 2023, companies providing core platform services must notify the Commission and provide all relevant information for determining whether the company qualifies as a gatekeeper. The Commission will then have two months to decide whether to make such a designation. If a company is deemed a gatekeeper, the company will have six months to comply with the DMA’s rules and obligations.
[1] https://www.skadden.com/insights/publications/2022/10/eu-digital-markets-act-enters-into-force [2] https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/digital-markets-act-ensuring-fair-and-open-digital-markets_en [3] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52020PC0842 [4] https://digital-strategy.ec.europa.eu/en/policies/digital-services-act-package [5] https://www.engadget.com/europe-digital-markets-act-005742387.html [6] https://www.consilium.europa.eu/en/press/press-releases/2022/03/25/council-and-european-parliament-reach-agreement-on-the-digital-markets-act/ [7] https://www.europarl.europa.eu/news/en/press-room/20220701IPR34364/digital-services-landmark-rules-adopted-for-a-safer-open-online-environment [8] https://www.consilium.europa.eu/en/press/press-releases/2022/07/18/dma-council-gives-final-approval-to-new-rules-for-fair-competition-online/ [9] https://twitter.com/EP_SingleMarket/status/1570062248961363969 [10] https://www.consumerprivacyworld.com/2022/10/dma-eu-publishes-the-new-digital-markets-act/
0

Metaverse Law’s Lily Li to guest star on Threat Watch podcast to discuss risks of ChatGPT, generative AI, and LLMs

AI & Algorithms, Cybersecurity, EEA & UK, United States
Near the end of 2022, generative AI models became something of a sensation. Art-based models like Midjourney, DALL-E, and Stable Diffusion threw the art world into a panic, prompting companies to ban AI-generated art.[1] Models like ChatGPT—and its underlying GPT-3.5 and GPT-4 LLMs—seemingly invaded every social sphere, from academia[2] to big tech,[3] and prompted many to start asking, “Will AI replace us?”[4] Given all this buzz around generative AI and LLMs, it’s only natural to consider the IT and security risks stemming from these emerging technologies. Afterall, there have been numerous recorded instances of actors using ChatGPT to build malware,[5] to improve malware,[6] to send phishing emails,[7] and more. To discuss these topics, Metaverse Law’s founder Lily Li will join host Dr. Rebecca Wynn on BrightTALK’s Threat Watch podcast to discuss the many issues, risks, and concerns arising out of the use of AI. WHAT: Metaverse Law’s founder Lily Li will join host Dr. Rebecca Wynn on the Threat Watch podcast to discuss AI, chatbots, LLMs, and more. WHEN: March 30, 2023 — 12:00 pm ET WHERE: Online (with free registration) TOPICS:
  • Data leaking and misuse in the AI supply chain.
  • Data transfer issues resulting from the use of AI.
  • IT and cyber security concerns.
  • Social engineering stemming from AI.
  • And more!
Whether you are currently using or thinking about using AI in your business, you do not want to miss Lily’s discussion on the risks and issues arising from this technology.
[1] https://brushwarriors.com/art-websites-that-ban-ai/ [2] https://www.tidio.com/blog/ai-in-education/ [3] https://www.zdnet.com/article/how-to-use-chatgpt-to-write-code/ [4] https://www.forbes.com/sites/robtoews/2021/02/15/artificial-intelligence-and-the-end-of-work/?sh=75edd9c456e3 [5] https://www.hackread.com/chatgpt-blackmamba-malware-keylogger/ [6] https://blog.checkpoint.com/2023/02/07/cybercriminals-bypass-chatgpt-restrictions-to-generate-malicious-content/ [7] https://research.checkpoint.com/2022/opwnai-ai-that-can-save-the-day-or-hack-it-away/
1 … 11 12 13 14 15 … 29