Legislation would block sharing of DNA without permission

A California lawmaker has introduced a bill that would bar genetic testing companies from sharing someone’s data with a third party without that person’s prior written permission.

Reached on Wednesday, state Sen. Tom Umberg, D-Santa Ana, the bill’s author, said SB 980 was still “a work in progress.” But he added it will be crafted with the specific goal of not interfering with law enforcement investigations.

“We will clarify that it certainly won’t preclude law enforcement from being able to access databases, so they can solve crimes,” said Umberg, a former federal prosecutor. “DNA is an extraordinary forensic tool. It both allows law enforcement to find the correct perpetrator and in some cases exonerate folks. We don’t want to stand in the way of that.”

He said they were still determining the best way to protect law enforcement access to genetic data. This could include a requirement for a subpoena or court order.

The main target of the bill, dubbed the Genetic Information Privacy Act, is companies that buy and sell third party data, Umberg said. He cited the example of people submitting data to a genetic ancestry company and then receiving advertisements relating to diseases for which they might have a genetic predisposition.

The promise and peril of genetic ancestry testing have been in the news since the 2018 arrest of Joseph DeAngelo. He is accused of being the Golden State Killer, linked to 13 murders and more than 50 rapes across California in the 1970s and 1980s. A former police officer who had been living in a Sacramento suburb for years, DeAngelo was linked to the crime when authorities submitted crime scene DNA to GEDmatch, a personal genomics website.

Both the Association of Deputy District of Attorneys of Los Angeles and Sacramento District Attorney Anne Marie Schubert’s office said they had not had a chance to review the bill and could not comment. Schubert was a key figure in the DeAngelo investigation and has been a longtime proponent of using DNA in law enforcement.

Umberg is also a retired U.S. Army colonel, and in a press release announcing the bill, he said became worried about the privacy implications of consumer genetic testing, especially after the Pentagon warned military service members not to use at-home DNA tests.

The bill builds on the California Consumer Privacy Act. This 2018 state law was designed to allow consumers to protect their online privacy by giving them the right to know what data has been collected about them and to deny companies some uses of that data. That law, AB 375, already includes “biometric data,” such as DNA, among the categories of information subject to protections.

Umberg’s bill would clarify and expand on these protections by explicitly prohibiting sharing of someone’s genetic information. It would change the protections from an opt-out system, in which a person would specifically need to ask that their information not be shared, to an opt-in system, in which someone would need to specify sharing is permitted.

Knowingly violating these rules could result in a misdemeanor and a fine of up to $10,000. The bill also includes an example of the kind of written authorization that would be needed in order to share DNA.

Umberg’s office said SB 980 is sponsored by the California Public Interest Research Group and supported by Consumer Reports. Illinois passed a similar law in 2019.