Privacy: genetic testing companies.

Existing law, the California Consumer Privacy Act of 2018, provides various protections to a consumer with respect to a business that collects the consumer's personal information, including biometric information such as the consumer's deoxyribonucleic acid (DNA) . The act requires a business that collects a consumer's personal information to, at or before the point of collection, inform the consumer as to the categories of personal information to be collected and the purposes for which the information will be used, and grants to a consumer the right to opt-out of the sale of the consumer's personal information by the business to a third party. Existing law also prohibits the disclosure by a health care service plan of the results of a test for a genetic characteristic to a third party in a manner that identifies or provides identifying characteristics of the person to whom the tests results apply, except pursuant to a written authorization. This bill would establish the Genetic Information Privacy Act, which would require a direct-to-consumer genetic testing company, as defined, or any other company that collects, uses, maintains, or discloses genetic data collected or derived from a direct-to-consumer genetic testing product or service, or provided directly by a consumer, to provide a consumer with certain information regarding the company's policies and procedures for the collection, use, maintenance, and disclosure, as applicable, of genetic data, and to obtain a consumer's express consent for collection, use, or disclosure of the consumer's genetic data, as specified. This bill would require a direct-to-consumer genetic testing company, or other company as described above, to honor a consumer's revocation of consent in accordance with certain procedures and to destroy a consumer's biological sample within 30 days of revocation of consent. The bill would further require a direct-to-consumer genetic testing company, or other company as described above, to comply with all applicable laws for disclosing genetic data to law enforcement without a consumer's express consent, implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification, or disclosure, and develop procedures and practices to enable a consumer to access their genetic data and to delete their account and genetic data, as specified. The bill would exclude the California newborn screening program from its provisions. This bill would impose civil penalties for a violation of those provisions, as specified. The bill would require actions for relief pursuant to these provisions to be prosecuted exclusively by the Attorney General, a district attorney, county counsel, city attorney, or city prosecutor, as specified, in the name of the people of the State of California upon their own complaint or upon the complaint of a board, officer, person, corporation, or association. Because the bill would require local officials to perform additional duties, the bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.