Washington
My Health My Data Act (MHMDA)
| Passed | April 27, 2023 |
| Effective Date | March 31, 2024 |
| Who it applies to |
Entities doing business in Washington or targeting products or services to Washington consumers that collect, process, share, or sell consumer health data. Exempt entities include government agencies, indigenous tribe, and financial institutions subject to the Gramm-Leach-Bliley Act (GLBA). |
| Penalties | Not specified |
What’s notable about it:
While focused on health, Washington’s MHMDA is arguably the strictest privacy law in the whole of the US. The law defines “consumer health data” broadly, imposes very strict requirements over its collection, sharing, and sale, applies to companies of all sizes, and has a “private right of action” enabling consumers to claim up to three times any damages they experience due to a company’s violation of the law—so expect many class action lawsuits.
The Strict Spectrum