United States of America: Passed California Genetic Information Privacy Act including data protection measures for genetic testing companies

Description

Passed California Genetic Information Privacy Act including data protection measures for genetic testing companies

On 9 September 2021 the California Senate passed the Genetic Information Privacy Act (Senate Bill 41), which will now be sent to the governor for signing. The bill would require direct-to-consumer genetic testing companies to provide consumers with certain information regarding the company’s policies and procedures for the collection, use, maintenance, and disclosure of genetic data. Additionally, these companies would have to obtain consumers' express consent for the collection, use, or disclosure of the consumer’s genetic data. The bill further provides that in case of revocation of a consumer's consent, the genetic testing company has to comply with certain procedures, and has to destroy the consumer’s biological sample within 30 days of revocation of consent.

Original source

Scope

Policy Area
Data governance
Policy Instrument
Data protection regulation
Regulated Economic Activity
other service provider
Implementation Level
subnational
Government Branch
legislature
Government Body
parliament

Complete timeline of this policy change

Hide details
2021-09-09
adopted

On 9 September 2021 the California Senate passed the Genetic Information Privacy Act (Senate Bill 4…

2021-10-06
in grace period

The Genetic Information Privacy Act (SB 41) was signed into law on 6 October 2021 by the California…

2022-01-01
in force

The Genetic Information Privacy Act (SB 41) is implemented on 1 January 2022. The act requires comp…

Key regulatory dimensions

Regulated subjects

The businesses, government agencies or individuals affected by this policy or regulatory change.
producer / supplier
1
Type Private organisation
Economic activity other service provider
Category All

Policy change by business practice

The detailed activities within the scope of this policy or regulatory change.
personal data: genetic: data collection
Regulatory tool
Obligation to make customer data available to government agencies
User consent: Opt-in requirement
User right to deletion of personal data
Sanctions
Fine
Regulated subjects
1
personal data: genetic: storage (any form)
Regulatory tool
Obligation to make customer data available to government agencies
User consent: Opt-in requirement
User right to deletion of personal data
Sanctions
Fine
Regulated subjects
1
personal data: genetic: data processing
Regulatory tool
Obligation to make customer data available to government agencies
User consent: Opt-in requirement
User right to deletion of personal data
Sanctions
Fine
Regulated subjects
1

Policy change by business practice

The detailed activities within the scope of this policy or regulatory change.

personal data: genetic: data collection

personal data: genetic: storage (any form)

personal data: genetic: data processing