Privacy: genetic testing companies.

Existing law, the California Consumer Privacy Act of 2018, provides various protections to a consumer with respect to a business that collects the consumer's personal information, including biometric information such as the consumer's deoxyribonucleic acid (DNA) . The act requires a business that collects a consumer's personal information to, at or before the point of collection, inform the consumer as to the categories of personal information to be collected and the purposes for which the information will be used, and grants to a consumer the right to opt-out of the sale of the consumer's personal information by the business to a third party. Existing law also prohibits the disclosure by a health care service plan of the results of a test for a genetic characteristic to a third party in a manner that identifies or provides identifying characteristics of the person to whom the test results apply, except pursuant to a written authorization to do so. This bill would establish the Genetic Information Privacy Act, which would require a direct-to-consumer genetic testing company, as defined, to provide a consumer with certain information regarding the company's policies and procedures for the collection, use, maintenance, and disclosure, as applicable, of genetic data, and to obtain a consumer's express consent for collection, use, or disclosure of the consumer's genetic data, as specified. This bill would require a direct-to-consumer genetic testing company to honor a consumer's revocation of consent in accordance with certain procedures, and to destroy a consumer's biological sample within 30 days of revocation of consent. The bill would further require a direct-to-consumer genetic testing company to implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification, or disclosure, and develop procedures and practices to enable a consumer to access their genetic data, and to delete their account and genetic data, as specified. The bill would exclude from its provisions the California Newborn Screening Program, specific tests, and certain information, providers, entities, and activities subject to specified state and federal laws. This bill would provide that the act does not reduce a direct-to-consumer genetic testing company's duties, obligations, requirements, or standards under any applicable state and federal law for the protection of privacy and security and would further provide, if a conflict exists between the act and any other law, that the provisions of the law that afford the greatest protection for the right of privacy for consumers shall control. This bill would impose civil penalties for a violation of those provisions, as specified. The bill would require actions for relief pursuant to these provisions to be prosecuted exclusively by the Attorney General, a district attorney, county counsel, city attorney, or city prosecutor, as specified, in the name of the people of the State of California upon their own complaint or upon the complaint of a board, officer, person, corporation, or association or upon a complaint by a person who has suffered injury in fact and has lost money or property as a result of the violation of the act. Because the bill would require local officials to perform additional duties, the bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.