Genetic Privacy

Division 1, Part 2.6 deals with the confidentiality of medical information in California. Chapter 2.6 concerns genetic privacy.

Section 56.18 provides that this chapter is the Genetic Information Privacy Act. The following terms are defined: “affirmative authorization,” “biological sample,” “consumer,” “dark pattern,” “direct-to-consumer genetic testing company,” “express consent,” “genetic data,” “genetic testing,” “person,” and “service provider.”

Section 56.181 states that, in order to safeguard the privacy, confidentiality, security, and integrity of a consumer’s genetic data, a direct-to-consumer genetic testing company is required to do both of the specified actions. A company must provide effective mechanisms, without any unnecessary steps, for a consumer to revoke their consent after it is given, at least one of which utilizes the primary medium through which the company communicates with consumers.

If a consumer revokes the consent that they provided, the company is required to honor the consumer’s consent revocation as soon as practicable, but not later than 30 days after the individual revokes consent, in accordance with both of the specified actions. The direct-to-consumer genetic testing company is required to do both of the specified actions. A person or public entity is prohibited from discriminating against a consumer because the consumer exercised any of the consumer’s rights under this chapter by doing any of the five specified activities.

Section 56.182 explains that any person who negligently violates this chapter is to be assessed a civil penalty in an amount not to exceed $1,000 plus court costs, as determined by the court. Any person who willfully violates this chapter is to be assessed a civil penalty in an amount not less than $1,000 and not more than $10,000 plus court costs, as determined by the court.

Actions for relief pursuant to this chapter are prosecuted exclusively in a court of competent jurisdiction by the Attorney General or a district attorney or by a county counsel authorized by agreement with the district attorney in actions involving violation of a county ordinance.

Section 56.184 explains that the provisions of this chapter do not reduce a direct-to-consumer genetic testing company’s duties, obligations, requirements, or standards under any applicable state and federal laws for the protection of privacy and security.

In the event of a conflict between the provisions of this chapter and any other law, the provisions of the law that afford the greatest protection for the right of privacy for consumers control. This chapter does not apply to any of the seven specified items of information.