USA – WASHINGTON Trends and Developments Contributed by: Amy Weston, Eva Novick, Brian Esler and Lauren Fricke, Miller Nash LLP
Navigating Data Privacy in Washington State: A 2026 Outlook for Businesses Introduction For Washington businesses, data privacy has evolved beyond a technical concern to become a central legal and operational reality. The landscape in 2026 is defined by significant new laws, aggressive enforce - ment and a surge in private lawsuits. This article exam - ines the key trends driving that shift, helping organisa - tions understand both the legal requirements and the practical steps needed to thrive. Complex legal devel - opments are distilled into clear, actionable insights for business leaders and operational teams, offering organisations a roadmap for the coming year’s critical compliance and risk management priorities. Key Legal and Regulatory Updates for 2026 Washington’s regulatory environment has solidified with the full implementation and maturation of sev - eral key laws. The Washington My Health My Data Act (MHMDA) remains a cornerstone, but its interpretation by the Attorney General’s office has clarified several previously ambiguous points. Furthermore, though Washington’s first-of-its-kind “Washington Privacy Act” was never passed, businesses in Washington are now operating under its functional equivalent thanks to a combination of sector-specific rules, aggressive application of the Consumer Protection Act (CPA) to data practices, and other states having used the Washington Privacy Act as the basis of their compre - hensive state privacy law. The most significant development is the expansion of “health data” definitions under the MHMDA and related laws. The Washington Attorney General’s office and private plaintiffs can now enforce an admin - istratively broadened law and focus on a wide array of computer-generated information rather than just traditional medical records. This expansion directly impacts businesses far beyond the healthcare sector. • Newly included data types: purchase histories for supplements, fitness tracker data, search queries related to medical symptoms, and wellness app information (even from general mindfulness apps) are now routinely treated as protected health data. • Geofencing restrictions: the use of geofencing technology to identify and target consumers near
healthcare facilities is now virtually prohibited, with severe penalties for violations. • Universal consumer rights: inspired by broader trends, Washington now expects all businesses, regardless of size or sector, to honour core con - sumer rights for health data – the right to access, delete and correct their personal data, and to opt out of its sale. Plaintiff attorneys are actively leveraging the CPA to protect consumer rights and enforce compliance with privacy laws. Courts now construe the CPA to grant consumers rights such as the right to access, cor - rect, delete and opt out of the sale of their personal data, and to require businesses to be transparent about their data practices and to limit data collection to necessary purposes. With litigants able to recover attorneys’ fees and treble damages for violations, the CPA offers a significant financial incentive for plaintiff attorneys. Emerging Litigation Trends: Where the Legal Battles Are Happening Litigation is no longer dominated solely by regula - tory actions. A thriving ecosystem of private plaintiff lawsuits has emerged and extends well beyond the MHMDA’s private right of action. These cases are setting costly precedents and creating new liabilities. The plaintiff’s bar has become sophisticated in iden - tifying technical violations that can lead to statutory damages, which can quickly scale for large customer bases. Some of the more common claims include the following. • Failure to have a health data privacy notice: the MHMDA requires a separate health data privacy notice in addition to the general website privacy notice. • Collection of health data without consent: tracking technologies collecting information about a visit to certain websites or products/services contained on those websites without affirmative express consent are a violation of the MHMDA. See further below regarding implied consent challenges. • Sharing health data: similarly, “sharing” or “sell - ing” health data to third parties, such as website analytics providers, without authorisation can be problematic.
629 CHAMBERS.COM
Powered by FlippingBook