Washington has taken bold steps to protect consumer health data through the My Health My Data Act, a law designed to safeguard sensitive information in an increasingly digital world. A recent lawsuit against a Seattle cannabis dispensary, Uncle Ike’s, underscores just how critical these protections have become, and how businesses must adapt to avoid costly legal consequences.
What Happened?
A proposed class action was filed in federal court alleging that Uncle Ike’s shared private customer information with Google and other third parties through tracking pixels and cookies installed on its website. According to the complaint, these tools transmitted personally identifiable information (PII) without consent, including details about medical marijuana appointments and cannabis purchases.
The lawsuit targets three entities operating the dispensary chain and claims violations of multiple laws, including the Electronic Communications Privacy Act, the Washington Consumer Protection Act, and most notably, the My Health My Data Act.
Understanding the My Health My Data Act
Washington’s My Health My Data Act was enacted to address growing concerns about how businesses collect, store, and share health-related information. Unlike HIPAA, which primarily governs healthcare providers, this law applies broadly to any entity handling health data, including retailers, tech companies, and online platforms.
Key provisions include:
- Explicit Consent: Businesses must obtain informed consent before collecting or sharing health-related data.
- Transparency: Clear disclosures about data practices are required.
- Consumer Rights: Individuals can request deletion of their health data and opt out of certain data-sharing practices.
Violations can lead to significant penalties, including private rights of action, making compliance essential for businesses operating in Washington.
Why This Case Matters
The allegations against Uncle Ike’s highlight a common issue: the use of digital marketing tools like Google Analytics and Meta Pixels. These tools help businesses optimize advertising and understand consumer behavior, but they also collect sensitive data, sometimes without users realizing it.
For cannabis consumers, privacy is especially critical. Information about medical marijuana use can reveal health conditions, treatment plans, and personal choices. Sharing this data without consent not only breaches trust but may violate state and federal laws.
Broader Legal Trends
This lawsuit is part of a nationwide wave of litigation targeting companies that use tracking technologies on websites and apps. Healthcare systems, retailers, and even media companies have faced similar claims. For example:
- Virginia Mason Medical Center agreed to a multimillion-dollar settlement over alleged pixel-related privacy breaches.
- Major corporations like Disney and Condé Nast have been sued for similar practices under state privacy laws.
These cases signal that regulators and plaintiffs’ attorneys are paying close attention to how businesses handle consumer data online.
What Consumers Should Know
As a Washington resident, you have rights under the My Health My Data Act:
- You can request details about what health data a company holds.
- You can demand deletion of your health information.
- You can take legal action if your data is shared without consent.
If you believe your privacy has been violated, consult an attorney experienced in consumer protection and data privacy law.
The Bottom Line
The Uncle Ike’s lawsuit is a wake-up call for businesses and consumers alike. In the digital age, privacy is not optional, it’s a legal and ethical obligation. Washington’s My Health My Data Act sets a strong precedent for protecting sensitive information, and compliance is no longer just a best practice; it’s the law.
For businesses, now is the time to review your data practices and ensure full compliance. For consumers, know your rights and take steps to safeguard your personal health information.
What to Do If Your Privacy Has Been Violated
If you have questions about your rights under the My Health My Data Act or believe your privacy has been compromised, contact Emery | Reddy, PC. Our experienced Privacy Breach Attorneys are committed to protecting Washington consumers from unlawful data practices.
