#data-protection-law

#data-protection-law

The Information Commissioner's Office (ICO) originally fined DSG Retail £500,000 ($673,000) in 2020, the maximum financial penalty allowed under the Data Protection Act 1998 (DPA 1998) - the relevant legislation at the pre-GDPR time. Its monetary penalty notice (MPN) was upheld by the Court of Appeal's first-tier tribunal but later reversed by the upper tribunal [PDF], which sided with DSG Retail and, if that decision was final, would have effectively nullified the ICO's fine.

The Washington law protects "consumer health data," defined as information linkable to a consumer that identifies their "physical or mental health status." This includes all manner of conditions and treatments, such as gender-affirming and reproductive care.