Law / United States / 
California
Genetic Information Privacy Act
Officially Genetic Information Privacy Act (GIPA): direct-to-consumer genetic testing companies
Also known as GIPA.
Cal. Civ. Code sections 56.18 to 56.186
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Security, Retention
- Audit expectation
- none
As of .
What it requires
- If you are a direct-to-consumer genetic testing company, give California consumers a plain-language summary of your privacy practices and a prominent, easily accessible privacy notice covering your data collection, consent, use, access, disclosure, maintenance, transfer, security, retention and deletion practices and how to file a complaint alleging a violation of the chapter, plus a notice that deidentified genetic or phenotypic information may be shared with third parties for research.
- Obtain a consumer's express consent, in response to a clear, meaningful and prominent notice and never by inaction or through a dark pattern, before you collect, use or disclose their genetic data, and obtain separate and express consent for each use of the data collected through the product or service (including who has access to it, how it may be shared and the specific purposes), for storing the biological sample after the initial testing, for each use of the data or sample beyond the primary purpose and inherent contextual uses, for each transfer or disclosure to a third party other than a service provider (naming the third party), and for marketing, or facilitating marketing, based on the data.
- Give a consumer effective mechanisms, without unnecessary steps and at least one through your primary medium of communication, to revoke consent. Honor a revocation as soon as practicable and no later than 30 days after it, and destroy the biological sample within 30 days of receiving a revocation of consent to store it.
- Implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification or disclosure.
- Develop procedures and practices that let a consumer easily access their genetic data, delete their account and genetic data (except data you must retain to comply with legal and regulatory requirements) and have their biological sample destroyed.
- Do not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health insurance, life insurance, long-term care insurance, disability insurance or employment, or to an entity that advises one, unless section 56.181(f)(2) applies: the entity is not primarily engaged in those functions, receives the data in a different capacity, and bars any part of it that administers, advises on or decides those matters from accessing the data or sample.
- Do not discriminate against a consumer for exercising rights under the chapter, whether by denying goods, services or benefits, charging different prices or rates, providing a different level or quality, suggesting any of these, or treating the exercise of rights as a basis for suspicion of criminal wrongdoing. This duty binds a person or a public entity.
- Bind a service provider that collects, transports or analyzes a consumer's biological sample or genetic data for you, by contract, not to retain, use or disclose the sample, extracted genetic material, genetic data or any information about the consumer's identity for any purpose other than the contracted services, and not to associate or combine them with information it receives from or collects for others.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Section 56.182: a civil penalty of up to $1,000 plus court costs for a negligent violation, and of not less than $1,000 and not more than $10,000 plus court costs for a willful violation; each violation is separate and actionable (section 56.182(f)), and recovered penalties are paid to the individual to whom the genetic data pertains (section 56.182(d)). The willful ceiling is recorded as per_violation_amount.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
California Attorney General, district attorneys, and the county counsel, city attorneys and city prosecutors section 56.182(c) names, who prosecute actions for relief exclusively, in the name of the people, on their own complaint or on the complaint of a board, officer, person, corporation or association or of a person who has suffered injury in fact and lost money or property.
Settledness
- As of
- Open questions
- Does a company that reports a consumer's results from raw DNA data the consumer uploads, without testing a biological sample, collect "genetic data" as a "direct-to-consumer genetic testing company" under section 56.18(b)(5)(C)?
- Does a company that analyzes genetic data only through a clinician-ordered test fall outside section 56.18(b)(5)(B), which excepts analysis performed by a person licensed in the healing arts for diagnosis or treatment of a medical condition?
What this law does
Binds a direct-to-consumer genetic testing company, which is an entity that sells, markets, interprets or otherwise offers consumer-initiated genetic testing products or services directly to consumers, analyzes genetic data obtained from a consumer, or collects, uses, maintains or discloses genetic data from such a product or service or provided directly by a consumer.
A company must obtain a consumer's express consent for the collection, use and disclosure of genetic data, with separate and express consent for the use of the data collected, including who has access to it and how it may be shared, for storing the biological sample after the initial testing, for each use beyond the primary purpose, for each transfer to a third party other than a service provider, and for marketing based on the data.
A company must honor a consumer's revocation of consent as soon as practicable and no later than 30 days after it, and must destroy the consumer's biological sample within 30 days of receiving a revocation of consent to store it. A company must keep reasonable security procedures and practices, and have procedures that let a consumer access the genetic data, delete the account and genetic data, and have the biological sample destroyed.
A company may not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health, life, long-term care or disability insurance or employment, or to an entity that advises such an entity, except in the narrow case section 56.181(f)(2) describes.
The chapter does not apply to medical information governed by the Confidentiality of Medical Information Act or to protected health information held by a covered entity or business associate under the federal health privacy rules. A person who negligently violates the chapter is assessed a civil penalty of up to $1,000 plus court costs, and a person who willfully violates it a civil penalty of $1,000 to $10,000 plus court costs.
Only the Attorney General, a district attorney or the other public prosecutors the section names may prosecute actions for relief under the chapter, in the name of the people. The chapter took effect on .
When LexLint raises it
When your app profile says your app processes biometric data or trains models.