A bill extending consumer privacy rights over their deoxyribonucleic acid (DNA), the material required for genetic testing, has passed both houses of the California legislature. The lead author, Sen. Tom Umberg, first introduced the bill this February.
The legislative digest states that the current law, the California Consumer Privacy Act of 2018, “provides various protections to a consumer with respect to a business that collects the consumer’s personal information, including biometric information such as the consumer’s (DNA).” These include informing the consumer what personal information is to be collected and prohibiting the disclosures of test results to third parties without consent.
The proposed bill, the so-called “Genetic Information Privacy Act,” would impose further requirements on “direct-to-consumer genetic testing” companies and others who fit the law’s definition. First, it would require genetic testing companies “to provide a consumer with certain information regarding the company’s policies and procedures for the collection, use, maintenance, and disclosure, as applicable, of genetic data, and to obtain a consumer’s express consent for collection, use, or disclosure of the consumer’s genetic data.”
Second, the bill would mandate that genetic testing companies honor consumers’ revocations of consent and destroy their biological samples within 30 days. Third, the law would require that genetic testing companies “comply with all applicable laws for disclosing genetic data to law enforcement without a consumer’s express consent.” Fourth, companies would also be required to implement and maintain safety practices to protect genetic data from unauthorized access or tampering. Fifth, companies would have to enable consumers to both access and delete accounts containing records of their genetic information.
According to the bill’s legislative digest, it would “exclude the California newborn screening program from its provisions.” The bill would also impose a state-mandated local program, potentially requiring local officials to perform additional, reimbursable duties. Finally, the Genetic Information Privacy Act would impose civil penalties for violations, enforceable through suits filed by either private or governmental complainants.
