{"id":5114,"date":"2022-11-30T17:47:01","date_gmt":"2022-11-30T23:47:01","guid":{"rendered":"https:\/\/blogs.luc.edu\/compliance\/?p=5114"},"modified":"2022-11-30T17:47:01","modified_gmt":"2022-11-30T23:47:01","slug":"the-case-for-expanding-privacy-protections-in-a-post-roe-world","status":"publish","type":"post","link":"https:\/\/blogs.luc.edu\/compliance\/?p=5114","title":{"rendered":"The Case for Expanding Privacy Protections in a Post-Roe World"},"content":{"rendered":"

Kristen Salas Mationg<\/em><\/p>\n

Associate Editor<\/em><\/p>\n

Loyola University Chicago School of Law, JD 2024<\/em><\/p>\n

In Dobbs v. Jackson Women\u2019s Health Organization<\/em><\/a> (Dobbs)<\/em>, the US Supreme Court ruled that abortion is not a fundamental right protected by the Constitution. This decision resulted in additional abortion protections in California, Michigan, and Vermont<\/a>, and prompted many patients, providers, regulators, and tech companies to rethink data privacy. However, because most abortions are still banned in at least 13 states<\/a>, this patchwork of state abortion laws, combined with the lack of any sufficient national privacy law, puts patient privacy at risk.<\/p>\n

<\/p>\n

The data at risk<\/strong><\/p>\n

The Supreme Court\u2019s decision in Dobbs <\/em>sheds light<\/a> on the large amount of data that tech companies collect. Data that could potentially implicate abortion-seeking patients, providers, and businesses in states where abortion is illegal. Because consumers use their phones for almost everything, including searching for the nearest abortion center or using apps to track their period cycles<\/a>, this sensitive data poses privacy threats to both providers and women seeking reproductive care.<\/p>\n

Further, since Dobbs <\/em>was decided in June, privacy experts have warned<\/a> that law enforcement agents in states that have banned or heavily restricted abortion could serve warrants on businesses that collect user data, including tech companies. Shortly after the Dobbs <\/em>decision, Google announced<\/a> that it would provide certain privacy protections to consumers, such as deleting location data soon after a user visits an abortion center, allowing users to more quickly delete menstruation data from their Fitbit, and protecting users from inappropriate government demands.<\/p>\n

The impact of new California legislation <\/strong><\/p>\n

A national leader<\/a> in consumer protection legislation, California recognized the need for additional privacy protections in a post-Roe <\/em>world. Consequently, California Governor Gavin Newsom signed AB 1242<\/a> and AB 2091<\/a> into law on September 27, 2022.<\/p>\n

AB 1242 forbids law enforcement or California-based businesses from cooperating with any out-of-state entities request for information about a lawful abortion conducted in California. The bill also prevents law enforcement from knowingly arresting someone for aiding in a lawful abortion in the state. In order to receive records from California-based companies, AB 1242 requires that out-of-state law enforcement agencies provide an attestation that their investigation doesn\u2019t involve a crime related to an abortion that is lawful in California.<\/p>\n

AB 1242 is the first law in the nation to explicitly block out-of-state investigators from requesting digital information about abortion-related actions that are legal in-state. Notably, this law protects the many tech companies that are based in California that collect sensitive data<\/a>, such as Google, Meta, and Uber.<\/p>\n

Additionally, AB 2091 prohibits health care providers, health care plans, contractors or employers from releasing medical information that would identify an individual, or any information that related to an individual seeking or obtaining an abortion, in response to a subpoena or law enforcement request, if the subpoena or request is for the purpose of enforcing another state\u2019s laws interfering with a person\u2019s right to choose or obtain an abortion.\u00a0 The law authorizes the California Insurance Commissioner to impose a civil penalty of up to $10,000 on insurers that violate these prohibitions.<\/p>\n

While the federal law known as the Health Insurance Portability and Accountability Act (HIPAA)<\/a> helps to protect patient privacy, this law only extends to<\/a> medical records and other personal health information. Notably, consumers generate so much data, such as text messages and location information, that is not covered by HIPAA and could be used to identify abortion providers and those seeking an abortion. Together, AB 1242 and AB 2091 aim to preserve abortion access to individuals that both provide and receive abortion services in California, and work to protect sensitive information not otherwise covered by HIPAA.<\/p>\n

The impact of California\u2019s laws within a national framework<\/strong><\/p>\n

Because the United States has yet to pass a national data privacy law<\/a>, individuals are relying on the states and tech companies to safeguard their sensitive data. Additionally, the White House acknowledged the importance of patient privacy and encouraged regulatory agencies to take action in President Biden\u2019s Executive Order on Securing Access to Reproductive and Other Healthcare Services<\/a>. The Executive Order recognized the Federal Trade Commission\u2019s (FTC) commitment<\/a> to take action against illegal use and sharing of sensitive data, as well as the FTC\u2019s probe<\/a> of over 15 mobile carriers on their data privacy practices, as important steps to protecting Americans\u2019 access to reproductive health services.<\/p>\n

It is still unclear how California\u2019s AB 1242 and AB 2091 will interact with other states\u2019 restrictive abortion laws. However, it is certain that similar data privacy laws protecting sensitive data should be passed on either a national level or in other states that have legalized abortion. In addition to actions taken by regulatory agencies on the national level, a national law or stricter state protections can ensure that abortion access to individuals providing and receiving abortion services is guaranteed in more states beyond California.<\/p>\n","protected":false},"excerpt":{"rendered":"

In Dobbs v. Jackson Women\u2019s Health Organization (Dobbs), the US Supreme Court ruled that abortion is not a fundamental right protected by the Constitution. This decision resulted in additional abortion protections in California, Michigan, and Vermont, and prompted many patients, providers, regulators, and tech companies to rethink data privacy. However, because most abortions are still banned in at least 13 states, this patchwork of state abortion laws, combined with the lack of any sufficient national privacy law, puts patient privacy at risk.<\/p>\n","protected":false},"author":155,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[468,571,1032,1205,1622,1623],"class_list":["post-5114","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-compliance","tag-data-privacy","tag-hipaa-2","tag-journal-of-regulatory-compliance","tag-privacy","tag-cybersecurity"],"_links":{"self":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts\/5114","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/users\/155"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5114"}],"version-history":[{"count":0,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts\/5114\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5114"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5114"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5114"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}