On September 10, 2021, the last day of the 2021 legislative session, the California State Assembly unanimously passed Senate Bill 41, titled the Genetic Information Privacy Act. The bill will go before Governor Gavin Newsom and must receive his approval over the next 30 days to become law.

The bill expands current protections under the California Consumer Privacy Act covering “biometric data.” It would require direct-to-consumer genetic testing companies, as defined, to provide consumers with certain information regarding policies and procedures for the collection, use, maintenance, and disclosure of genetic data, and to obtain consumers’ express consent for collection, use, or disclosure of the consumers’ genetic data.

This bill would also require direct-to-consumer genetic testing companies to honor consumers’ withdrawal of consent and to destroy these consumers’ biological sample within 30 days of revocation of consent. It further establishes reasonable security procedures and practices that these companies must maintain to protect consumers’ genetic data against unauthorized access, destruction, use, modification, or disclosure, and develop procedures and practices to enable consumers to access their genetic data, and to delete their account and genetic data, as specified.

Finally, this bill would impose civil penalties for any violation of those provisions. There is no right of private action in the bill, though; only the Attorney General, a district attorney, county counsel, city attorney, or city prosecutor may, in the name of the people of the State of California, bring an action for relief.

This bill is narrowly tailored to apply to a limited set of companies. Nonetheless, it is noteworthy in that it relies on the framework of the CCPA and imposes new restrictions, particularly requiring express consent for the collection, use, or disclosure of consumer data. This may serve as a model for future bills targeting specific areas of consumer privacy.