House passes bill to protect COVID-19 personal data 

The Washington State House of Representatives has passed legislation designed to protect the privacy and security of Washingtonians’ COVID-19 health data. 

House Bill 1127 gives clear guidelines for organizations that collect and analyze data related to the spread of COVID-19. Since the start of the global coronavirus pandemic a number of entities have become privy to such information, as governments around the world have recruited outside organizations, including large technology companies such as Apple and Google, to build digital tools to help combat the virus. One of these tools are a variety of contact-tracing apps — such as Washington state’s WA Notify app — which use Bluetooth and other smartphone location technologies to work out whether a phone’s user might have been exposed to a COVID-positive individual, or exposed others, and notifies them and the relevant health authorities. This information helps public health experts map the spread of the disease, as well as letting people know if they need to be tested for COVID or seek treatment.  

Contact-tracing apps have been helpful for fighting the pandemic, as they reduce the reliance of contact-tracing agencies on faulty human memories and labor-intensive methods such as interviews. However, concerns over privacy issues have grown in recent months, especially since tech companies like Google are known for spotty records on data privacy, both in the United States and other countries.  

The bill passed by the House strictly limits the COVID-19 data collected by covered organizations to use for public health purposes. Any other use, including for commercial, advertising, policing or immigration enforcement, is strictly prohibited. Furthermore, the bill ensures a person’s right to stop organizations from collecting their data.

The bill also requires that organizations collect the minimum necessary amount of data for their work and destroy the data after 30 days. Public health agencies and health care providers are not included in the bill as they need to hold health data for longer stretches of time and are already governed by strict privacy regulations. 

HB 1127 also creates an exemption in the Public Records Act for COVID-related data. The PRA requires state and local agencies to make their records available to the public, and the exemption ensures that private data collected in response to the pandemic does not become a matter of public record.  

During debate over the bill on the House floor, discussion centered around its complexity. Representatives Jim Walsh, R-Aberdeen, and Vicki Kraft, R-Vancouver, argued that the complex language in the bill would lead to self-defeating loopholes that might actually undermine data privacy. The bill’s main sponsor, Rep. Vandana Slatter, D-Bellevue, drew from her years of experience as a clinical scientist and pharmacist to explain much of the bill’s language.  

On March 1, HB 1127 went to a vote and passed with bipartisan support, 76-21. The bill will now go to the Senate for consideration. The legislative session is due to close on April 25.