Existing law, the Genetic Information Privacy Act, requires a direct-to-consumer genetic testing company, as defined, to provide a consumer with certain information regarding the company’s policies and procedures for the collection, use, maintenance, and disclosure, as applicable, of genetic data, and to obtain a consumer’s express consent for collection, use, or disclosure of the consumer’s genetic data, as specified. Existing law assesses a civil penalty not to exceed $1,000 for a negligent violation of these provisions, and a civil penalty between $1,000 and $10,000, inclusive, for a willful violation of these provisions.