The California State Legislature ('the Legislature') passed, on 31 August 2020 and 1 September 2020, Assembly Bill ('AB') 713 on deidentified health information and Senate Bill ('SB') 980 on the Genetic Privacy Information Act. In particular, AB 713 exempts from the application of the California Consumer Privacy Act of 2018 ('CCPA') information that is deidentified in accordance with the requirements of the Health Information Portability and Accountability Act of 1996 ('HIPAA') and is derived from patient information as well as information that is collected, used, or disclosed in research, as defined under HIPAA. In addition, AB 713 prohibits a business or other person from reidentifying information that was deidentified, unless a specified exception is met and requires, from 1 January 2021 a contract for the sale or license of deidentified information to include specified provisions relating to the prohibition of reidentification.

SB 980 requires direct-to-consumer genetic testing companies that collect, use, maintain, or disclose genetic data collected or derived from a direct-to-consumer genetic testing product or service, or provided directly by a consumer, to provide a consumer with certain information regarding the company's policies and procedures for the collection, use, maintenance, and disclosure of genetic data, and to obtain a consumer's express consent for collection, use, or disclosure of the consumer’s genetic data. Furthermore, SB 980 requires from a direct-to-consumer genetic testing company to honour a consumer's revocation of consent in accordance with certain procedures and to destroy a consumer's biological sample within 30 days of revocation of consent. 

Both bills will need to be signed by the California Governor, Gavin Newsom, before they become law.

You can read AB 713 here and SB 980 here, and track them here and here.