Makes health care decisions, in District of Columbia

D.C. Code § [28-3852.01] (Title 28, Chapter 38, Subchapter II, "Security requirements," added by the Security Breach Protection Amendment Act of 2020, D.C. Law 23-98, § 2(a)(5), 67 DCR 3923) · Read the law's page

• This binds any person or entity that owns, licenses, maintains, handles, or otherwise possesses the personal information of an individual residing in the District of Columbia; a person or entity already subject to and in compliance with the security-procedure requirements of the Gramm-Leach-Bliley Act, HIPAA, or the HITECH Act is deemed to comply.
• Implement and maintain reasonable security safeguards, including procedures and practices appropriate to the nature of the personal information you hold and to your own nature and size.
• If you disclose a District resident's personal information to a nonaffiliated third-party service provider, require by written agreement that the third party implement and maintain its own reasonable security procedures and practices over that information.
• When destroying records that contain personal information of your consumers, employees or former employees, including computerized or electronic records and devices, take reasonable steps to protect against unauthorized access to or use of the information, considering the sensitivity of the records, your own nature and size, the costs and benefits of different destruction methods, and available technology.
• A violation is enforced as an unfair or deceptive trade practice: the Attorney General may sue for injunctive relief and a civil penalty of up to $5,000 for a first violation and up to $10,000 for each subsequent violation, and a consumer may bring a private action in which the damages are actual damages, excluding pain and suffering, rather than the treble-damages-or-$1,500-per-violation floor available for most other violations of the Consumer Protection Procedures Act; attorney's fees, punitive damages and an injunction remain available.

D.C. Code § 2-1401 et seq. (general civil rights law, applicable to algorithmic discrimination)

• This law is recorded as enacted, but the record carries no commencement date, so whether it is yet in force has to be established before relying on what follows.
• Do not discriminate on the basis of protected characteristics in employment, housing, education, public accommodations, or other covered domains.
• Do not use an algorithmic system, or other practice, that produces a discriminatory outcome.

D.C. Code § 28-3901 et seq. (general consumer protection law, applicable to AI/automated contexts)

• This law is recorded as enacted, but the record carries no commencement date, so whether it is yet in force has to be established before relying on what follows.
• Do not engage in deceptive or unconscionable trade practices; this prohibition has been applied to automated decision systems.

DC Bill B26-0667, 26th Council (introduced April 20, 2026)

• This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
• Do not use algorithmic surveillance-based price discrimination, an unfair or deceptive trade practice.
• Do not use personal data collected through electronic surveillance, including sensors, device tracking, or biometric monitoring, to charge individual consumers different prices.