Some arguably vague language in a bill designed to protect sensitive COVID-19 health data forced Governor Jay Inslee to choose between signing a strong data privacy bill or allowing governments and businesses to offer incentives for vaccinated people. Earlier this week Inslee chose the latter option when he vetoed House Bill 1127, sponsored by Washington state House Rep. Vandana Slatter.
Though Inslee's office plans to direct the state Department of Health to issue guidance on how public and private entities should handle the data, and though he's "committed" to "further engaging on this issue," and though the state does need to do everything in its power to get shots into the arms of unvaccinated foot-draggers, the death of the legislation sucks.
As ACLU Technology and Liberty Project Manager Jennifer Lee pointed out over the phone, "many people" will simply not participate in a public health response—whether that’s contact tracing or getting a vaccination—"if they think the personal information they share to participate in those efforts will be used to criminalize or deport them or take their children away."
In other words, a free beer may indeed incentivize some people to get a shot. For others, knowing that ICE won't swipe their kid is a much greater incentive.
When the pandemic hit last year, governments and tech companies (or, if you will, "the digital-health app community") produced "a deluge of apps" to track COVID-19 symptoms and exposure. At the same time, gross mismanagement at the federal level generated a tremendous amount of distrust in contract tracing efforts and in other public health measures designed to curb outbreaks.
Seeing the great potential to save lives with these new digital tools but also the great potential to violate civil liberties en masse, Rep. Slatter worked with a broad coalition to draw up a proposal to put some guardrails on the way governments and businesses could use the COVID-19 health data collected through all these apps.
The bill was quite thorough. The proposal required strong security protections to prevent hacking, set limits on data storage, restricted public and private use of the data to “good faith” public health purposes, and prevented the government from sharing the information with law enforcement or from using it to limit our access to housing, jobs, services and the like.
The legislation also prevented companies from selling the data to third parties or from using it to show us ads they think we'd like. Finally, any agency or organization that collected or used the data from "at least 30,000 individuals over 60 calendar days” would have needed to publish a public report about what they were up to and why they were doing it.
The bill quickly passed with bipartisan support, and set up a foundation on which lawmakers might have created more data privacy laws in other sectors, an issue that has vexed the Legislature for the last few years largely due to a disagreement between House and Senate Democrats over exactly how much to protect giant tech companies from lawsuits.
So, a feat! Yay!
But that feat only lasted until a couple days ago, when Inslee axed the bill. As he explained in his veto message, his office believed some language in the proposal would prohibit "efforts by public and private entities to offer incentives to become vaccinated or to make certain opportunities available to those persons who are vaccinated."
The problem, according to a spokesperson for the governor, laid in the bill's broad definition of “COVID-19 health data.” Inslee's office argued that definition likely included a person’s vaccination status, and there’s a section in the bill that prevents governments and businesses from using COVID-19 health data to make "opportunities unavailable on the basis” of that health data, which would fuck up their attempts to promote the vaccine.
Over the phone, Slatter said she thought the very next subsection in the bill dispelled that concern, as it allowed for that kind of discrimination if "authorized by a federal, state, or local government entity for a COVID-19 public health purpose." That entire section, she added, mirrored a section from very similar federal legislation introduced in the House last year by U.S. Rep. Suzan DelBene. That bill didn't pass.
The Washington bill's authors used a "fairly broad definition" of COVID-19 health data, Slatter said, in order to include "several aspects of the data that were collected that people may not have known about but signed off on because they wanted to participate in a public health response."
But, at the end of the day, some lawyers thought that definition—"data that is collected, used, or disclosed in connection with COVID-19 or the related public health response and that is linked to an individual or device"—in conjunction with the provision I mentioned above "was ambiguous enough" to trouble the state's vaccine incentive plans, and so they put the kibosh on the whole thing.
Slatter said lawmakers "could have done some tweaking on it" had they all sat down and had that conversation earlier, but at the time the bill was written with contact tracing in mind, and so it may have been difficult to write the language in a way that anticipated the state's need to dangle beer and baseball tickets in front of a bunch of people to convince them that it might be a good idea to inoculate themselves against a deadly respiratory virus.
"The veto indicates that this is a complex policy, and it's difficult to get the language right because of this unique situation we're in, but I do think it underscores the fact that we need to continue this conversation. We need to give people some reassurance that their info is protected," Slatter said.
A spokesperson for Inslee's office said the Governor issued a proclamation last summer that "prohibits agencies from disclosing personally identifiable information collected by COVID-19 case investigators," i.e., contact tracers. The Legislature extended that order this session, and it's still in effect today, so there are some protections.
