California’s SB 980 Would Codify Strong Protections for Genetic Data
Author: John Verdi (Vice President of Policy)
This week, SB 980 (the “Genetic Information Privacy Act”) passed the California State Assembly and State Senate, with near unanimous support (54-10 and 39-0). If signed by the Governor before the Sept. 30 deadline, the law would become the first comprehensive genetic privacy law in the United States, establishing significant new protections for consumers of genetic services.
As we previously wrote and testified, the Genetic Information Privacy Act incorporates many of the protections in FPF’s 2018 Privacy Best Practices for Consumer Genetic Testing Services. Those Best Practices were drafted and published over the course of 2018 in consultation with a multi-stakeholder group of technical experts, scientists, civil society advocates, leading consumer genetic and personal genomic testing companies, and with input from regulators including the Federal Trade Commission (FTC) and the Department of Health and Human Services (HHS).
Leading genetic testing companies have adopted the Best Practices, making them enforceable by the FTC and state AGs; SB 980 would extend safeguards to users of other genetics companies, protecting consumers and building trust in the industry.
Below we describe 1) that process and results of FPF’s 2018 efforts; and 2) the significance of SB 980 as compared to existing laws and the voluntarily adopted Best Practices.
FPF’s 2018 Stakeholder Process//
In 2018, Future of Privacy Forum conferred with leading genetics services and other experts to explore ways to address consumer privacy concerns related to genetics services. At the time, concerns were emerging in response to the rapid growth of the consumer genetics industry, and highly publicized cases of law enforcement access to genetic data, including the Golden State Killer investigation.
As a non-profit dedicated to convening divergent stakeholders to create workable best practices for emerging technologies, we solicited and received the input of scientists, consumer privacy advocates, government stakeholders, and other experts. FPF published the resulting Best Practices at the end of July 2018.
Since that time, some, but not all, of the direct-to-consumer genetics companies have voluntarily adopted FPF’s Best Practices. Some companies have chosen not to adopt the Best Practices, or to adopt only certain provisions, while others are supportive but have chosen not to formally incorporate the provisions of the Best Practices into their policies. Privacy policies and other voluntary legal commitments can be enforced by the Federal Trade Commission and State Attorneys General.
Why SB 980 is Significant //
If signed by the Governor, SB 980 would be a landmark law for genetic privacy, going beyond existing federal and state laws as well as self-regulation. Although the federal Genetic Information Nondiscrimination Act (GINA) prohibits certain types of discrimination based on genetic information, it does not provide comprehensive privacy protections for the collection of such data or the many ways that it can be used, sold, or shared (including for advertising or law enforcement purposes).
Similarly, the handful of states that have heretofore addressed genetic information privacy have not established comprehensive protections. For example, some states have enacted “mini-GINAs” (including California), or extended its protections to discrimination in life insurance, disability, or long term care (Florida). Somes states have limited law enforcement access (Nevada), and at least one has attempted to take a more comprehensive approach while recognizing genetic information as the property of the consumer (Alaska).
In contrast, SB 980 would establish broad, comprehensive consumer protections for genetic information. The protections go significantly beyond those that exist for other types of personal information in California under the California Consumer Privacy Act (CCPA), an approach that is justified given the unique sensitivity of genetic information. In particular, genetic information has the ability to reveal intimate information about health and familial connections, and is challenging to de-identify. The bill also contains certain aspects that are unique to the consumer genetics industry, such as the requirement that biological samples be destroyed upon request.
Similarly, SB 980 would go beyond FPF’s Best Practices by directly regulating the entire sector, rather than only the companies that have voluntarily chosen to adopt the Best Practices. Furthermore, although voluntary commitments can be enforced by the Federal Trade Commission (FTC) and others, such enforcement is necessarily limited to unfair and deceptive trade practices, and does not always allow for financial penalties. In contrast, SB 980 would establish civil penalties of up to $1,000 (for negligent violations) or $10,000 (for willful violations)
Penalties could add up quickly, as they are calculated on a per violation, per consumer basis.
Conclusion //
Genetic information carries the potential to empower consumers interested in learning about their health and heritage, and to fuel unparalleled discoveries in personalized medicine and genetic research. Given the Future of Privacy Forum’s mission to convene divergent stakeholders towards workable privacy practices for emerging technologies, it continues to be rewarding to play a role in shaping the leading practices for consumer genetic information. We are optimistic that SB 980 represents a major step forward for consumer rights.
Additional FPF Resources //
- California SB 980 Would Codify Many of FPF’s Best Practices for Consumer Genetic Testing Services, but Key Differences Remain (2020);
- FPF Releases Follow-Up Report on Consumer Genetics Companies and Practice of Transparency Reporting (2020);
- A Closer Look at Genetic Data Privacy and Nondiscrimination in 2020 (2020);
- FPF and Privacy Analytics Identify “A Practical Path Toward Genetic Privacy” (2020);
- Consumer Genetic Testing: A Q&A with Carson Martinez (2019).
