2020 Privacy Bills Vetoed

Of interest to those involved in privacy legislation, two significant bills that reached Governor Gavin Newsom’s Desk were vetoed in late September.

AB 1138 by Assemblyman James Gallagher (D-Yuba City)

This bill, on and after July 1, 2021, would have prohibited a person or business that conducts business in California, and that operates a social media website or application from allowing a person who the business actually knows is under 13 years of age to create an account with the website or application unless the website or application obtains the consent of the person’s parent or guardian before creating the account.

The business would have had to use a method that includes reasonable measures to ensure that the person giving their consent is the parent or legal guardian of the person under 13 years of age. The bill would have deemed a business to have actual knowledge of a consumer’s age if it willfully disregards the consumer’s age.

Governor Newsom wrote in his veto message: “I am returning Assembly Bill 1138 without my signature. This bill would require the operator of a social media website or application to prohibit a person known to be under 13 years old from creating an account unless consent is obtained from the person’s parent or guardian.

“As a parent of four, I understand and care deeply about the importance of protections for safe consumption of media and technology by children.

“Existing federal law requires operators of internet websites or online services to obtain parental or guardian consent before collecting personal information from a child known to be under 13 years old. States have the ability to enforce this law.

“Given its overlap with federal law, this bill would not meaningfully expand protections for children, and it may result in unnecessary confusion.

“As I agree with the spirit of this bill, my Administration is open to exploring ways to build upon current law to expand safeguards for children online.”

SB 980 by Sen. Tom Umberg (D-Santa Ana)

This bill would have established the Genetic Information Privacy Act, which would have required a direct-to-consumer genetic testing company, or any other company that collects, uses, maintains, or discloses genetic data collected or derived from a direct-to-consumer genetic testing product or service, or provided directly by a consumer, to provide a consumer with certain information regarding the company’s policies and procedures for the collection, use, maintenance, and disclosure, as applicable, of genetic data, and to obtain a consumer’s express consent for collection, use, or disclosure of the consumer’s genetic data.

Governor Newsom wrote in his veto message: “I am returning Senate Bill 980 without my signature. This bill would establish requirements for direct-to-consumer genetic testing companies, providing opt-in privacy rights and protections for consumers.

“I share the perspective that the sensitive nature of human genetic data warrants strong privacy rights and protections.

“However, the broad language in this bill risks unintended consequences, as the ‘opt-in’ provisions of the bill could interfere with laboratories’ mandatory requirement to report COVID-19 test outcomes to local public health departments, who report that information to the California Department of Public Health. This reporting requirement is critical to California’s public health response to the COVID-19 pandemic, and we cannot afford to unintentionally impede that effort.”

“Because I agree with the primary goal of this bill, I am directing the California Health and Human Services Agency and the Department of Public Health to work with the Legislature on a solution that achieves the privacy aims of the bill while preventing inadvertent impacts on COVID-19 testing efforts.”

With both of these measures, and the Governor’s stated desire to have legislation on these topics, we can expect to see both bills back in some form during the 2021 Legislative Session which officially gets underway on Monday, December 7.