Technology (Data Privacy)

This bill establishes comprehensive privacy protections for personal data collected by District of Columbia government agencies and third parties on their behalf. It creates a new Chief Privacy Officer role within the Office of the Chief Technology Officer to oversee compliance and grants residents, employees, and service users specific rights over their information. Key provisions require agencies to obtain clear affirmative consent before selling data, strictly limit data collection to what is necessary for government services, and define sensitive categories such as health records and government identifiers that warrant extra care. The legislation also sets rules for how third parties must handle data received from the government and defines what constitutes personal versus de-identified information.

The Protecting Judicial Privacy Act of 2026 prohibits government agencies and private entities from publicly displaying personal information about judges and magistrates in the District of Columbia. This information includes home addresses, phone numbers, email addresses, and details about their children under 18. Under the bill, a judge can send a written request to stop this information from being posted online or in public records, requiring agencies to remove it within five business days and private companies to do so within 48 hours. If a judge's personal data is shared after such a request, they can sue for legal relief and recover legal fees. The law applies to all active and retired judges serving in federal courts and the District of Columbia's court system.

The Surveillance Pricing Prohibition Amendment Act of 2026 prohibits companies in the District of Columbia from using personal data to charge different prices for the same goods or services. It achieves this by legally defining 'surveillance-based price discrimination' as setting prices based on information gathered through electronic surveillance, such as device tracking or biometric monitoring, and classifying this practice as an unfair trade activity. This law directly affects digital marketplaces and other businesses that currently use consumer data to manipulate pricing, ensuring that quoted prices reflect market value rather than individual customer profiles.

This bill protects District of Columbia residents' health data by requiring companies that collect it to obtain explicit consent before use, publish clear privacy policies, and allow data deletion within 183 days. It directly affects health apps, medical providers, and any organization handling personal health information (like medical records or mental health data). Key provisions ban location tracking near health facilities (geofencing), mandate transparent data-sharing disclosures, and give people the right to demand data removal. The law creates enforceable privacy rules for health data, aligning DC with similar state-level protections.