California Privacy Update

Written by: Brett Lawrence, Esq.

1. California’s Genetic Information Privacy Act

On October 6, 2021, California passed the Genetic Information Privacy Act (“GIPA”). Under GIPA, California residents have greater control over how their genetic information will be collected and used by specific companies. GIPA becomes effective on January 1, 2022.

GIPA applies to “direct-to-consumer genetic testing companies,” which are entities that perform any of the following services:

1. 1. Sells, markets, interprets, or otherwise offers consumer‑initiated genetic testing products or services directly to consumers;
   2. Analyzes genetic data from a consumer, except for medical professional for treatment or diagnoses; or
   3. Collects, uses, or discloses genetic data from a direct-to-consumer genetic testing product or service, or is directly provided by a consumer.

GIPA requires all the above genetic testing companies to:

1. 1. Provide California residents with certain information regarding the company’s policies and procedures for the collection and use of genetic data;
   2. Implement and maintain reasonable security procedures to protect a consumer’s genetic data; and
   3. Develop policies and practices that allow a consumer to access and delete their genetic data held by the company.

Companies who collect and use a consumer’s genetic data must receive express consent from the consumer prior to collection. Consumers also have the right to revoke their consent at any time. If a consumer revokes their consent, the company must destroy the genetic data within thirty (30) days of the revocation.

2. Former FTC Member Appointed to Lead the California Privacy Protection Agency

California’s recently created state privacy agency, the California Privacy Protection Agency (“CPPA”) , announced earlier this month that the Federal Trade Commission’s former lead technologist, Ashkan Soltani, will lead the CPPA. Mr. Soltani will govern over CPPA’s eventual enforcement of the California Privacy Rights Act, when it becomes enforceable on January 1, 2023.