On September 25, 2020, California Governor Gavin Newsom signed into law AB 713, amending the California Consumer Privacy Act (CCPA). Importantly, the bill clarifies the standard by which patient information is deemed de-identified and therefore exempt from CCPA. It also expands the law’s research exception beyond research associated with clinical trials. Both changes are welcome clarifications for the healthcare, research and life sciences communities. The bill also contains new notice and contract obligations related to the sale or license of de-identified patient information, which are likely to have widespread implications.
The bill was passed as an urgency statute that takes effect immediately, with the California legislature recognizing that “[t]he provisions of [AB 713] would mitigate [the] harm [posed by the CCPA] as soon as possible by preserving access to information needed to conduct important health-related research that will benefit Californians.” This article analyzes the bill as finalized.
