Senator Thomas J. Umberg (D-Santa Ana) announced today that his measure, Senate Bill 41 (SB 41) – which would assure consumers that Direct-to-Consumer (DTC) genetic testing companies will use their genetic data solely for the purposes to which they have consented – was signed by Governor Gavin Newsom yesterday.
“At-home DNA tests have provided people with the ability to seek meaningful connections to long-lost family or their own cultural and religious histories. Most people have no idea that this data can then legally be shared with third parties or potentially used against them in a variety of ways” said Senator Umberg. “Genetic testing companies have, to date, gone largely unregulated by either state or national governments. This has led to breaches of sensitive private biological information and a suggestion by even the United States Department of Defense that members of the nation’s military avoid the use of these products.”
In July of last year, a massive security breach at a company exposed the DNA profiles of more than a million people to law enforcement agencies and forced the service to temporarily cease operations. The company, GEDmatch, compares DNA data files from different testing companies to find a consumer’s family tree and ancestral DNA matches. Several media outlets have published stories in the ensuing months of genetic data also being improperly used to conduct drug research, discriminate against possible consumers in regards to insurance products, or being stored on hackable private servers.
The California Consumer Privacy Act (CCPA) regulates (among other things) direct-to-consumer genetic companies by allowing consumers to request information on how their data is being used and to opt out if they so wish. However, this law does not solve for the fact that current authorization forms are confusing, and consumers often lack clarity about consents they are providing.
Umberg’s measure, Senate Bill 41, creates strict guidelines for authorization forms in a manner that allows consumers to have control over how their DNA will be used. In addition, the measure creates civil penalties for companies that fail to comply with the provisions within it. Lastly, SB 41’s predecessor, SB 980 (Umberg, 2020) was vetoed last year by Governor Gavin Newsom under fears that the effort could negatively impact at-home testing and data sharing specific to COVID. SB 41 contains language to ease these concerns of the Administration, as well.
In passing this act, California is joining four other states that have made it clear that consumers should control their genetic data without fear of third-party exploitation. “Forcing these companies to clarify their consent forms and requiring them to obtain written authorization for any genetic data disclosure, including de-identified data, will reassure California consumers that their most personal information is safe,” noted Senator Umberg.
In support of SB 41, Becca Cramer-Mowder, Legislative Coordinator and Advocate for the American Civil Liberties Union stated, “Genetic data is uniquely sensitive because it is an unchangeable personal identifier that has implications not only for the individual but also for the individual’s relatives. All results from genetic testing should be private by default, and SB 41 would put sensible safeguards around this highly private data to ensure consumers have control over their genetic information.”
The provisions of SB 41 will take effect on January 1, 2022.
