CA SB980

Establishes the Genetic Information Privacy Act requiring direct-to-consumer genetic testing companies and related entities to provide consumers with clear privacy policies and obtain express consent before collecting, using, maintaining, or disclosing genetic data.

Mandates separate express consent for specific uses including primary testing, sample storage, secondary uses, third-party transfers, and marketing based on genetic data, with easily accessible revocation mechanisms.

Requires companies to destroy biological samples within 30 days of consent revocation, implement reasonable security procedures, and provide consumers access to their genetic data and ability to delete accounts.

Prohibits disclosure of genetic data to health insurance, life insurance, disability insurance, or employment-related entities without specific exceptions for entities not primarily engaged in those functions.

Imposes civil penalties of up to $1,000 for negligent violations and $1,000 to $10,000 for willful violations, with enforcement by the Attorney General, district attorneys, county counsel, or city attorneys.